EU AI Act GPAI Rules: General-Purpose AI and the Code of Practice

Under the EU AI Act, providers of general-purpose AI (GPAI) models must keep technical documentation, inform downstream providers, adopt a copyright policy and publish a training-data summary. Models with systemic risk face extra safety duties. They apply from 2 August 2025 (2 August 2027 for models already on the market). Companies using GPAI via an API are mostly deployers.

Key takeaways

• A GPAI model (the engine, such as a large language model) is regulated separately from a GPAI system (the product built on it, such as a chat app).
• Article 53 obligations for all GPAI model providers: technical documentation, information for downstream providers, a copyright policy and a public summary of training content using the Commission template.
• Models trained with more than 10^25 floating-point operations are presumed to have systemic risk and must also meet Article 55: evaluations, adversarial testing, risk mitigation, incident reporting and cybersecurity.
• The voluntary GPAI Code of Practice was published on 10 July 2025 and has been signed by most major model providers.
• The Commission's enforcement powers, including fines of up to €15 million or 3% of turnover, apply from 2 August 2026.

GPAI model vs GPAI system

The AI Act draws a line that confuses many readers. A general-purpose AI model (Article 3(63)) is a model trained on large amounts of data, typically with self-supervision at scale, that displays significant generality and can competently perform a wide range of distinct tasks, and can be integrated into many downstream systems. A general-purpose AI system (Article 3(66)) is an AI system based on such a model that can serve a variety of purposes, directly or integrated into other systems.

In everyday terms: the model behind a chat assistant is the GPAI model; the chat app, with its interface, safety filters and integrations, is a GPAI system. Chapter V of the Act (Articles 51 to 56) regulates models. Systems are regulated like any other AI system: by risk tier and, where they interact with people or generate content, by the transparency rules in Article 50. For the full structure of the regulation, see our EU AI Act guide.

The Commission's guidelines for GPAI providers give an indicative test: a model trained with more than 10^23 FLOP that can generate language (text or audio), text-to-image or text-to-video is likely to be a GPAI model. It is a pre-filter, not a bright line; the decisive question is whether the model shows significant generality.

If your organisation builds on these models rather than training them, your obligations come from the use case, not from Chapter V. Opsio's free AI Act gap assessment helps you sort out which role you hold for each AI use and what follows from it.

Article 53: obligations for every GPAI model provider

The open-source exemption covers models released under a free and open-source licence with publicly available weights, architecture and usage information. Providers established outside the EU must appoint an authorised representative in the Union before placing a model on the EU market (Article 54), again with an open-source carve-out for models without systemic risk.

The article text is on artificialintelligenceact.eu, and the authoritative version in Regulation (EU) 2024/1689 on EUR-Lex.

Systemic risk: the 10^25 FLOP presumption and Article 55

A GPAI model has systemic risk if it has high-impact capabilities. Under Article 51, a model is presumed to have them when the cumulative compute used for its training exceeds 10^25 floating-point operations. The Commission can also designate a model on other criteria in Annex XIII, such as number of users or reach. A provider whose model meets the threshold must notify the Commission within two weeks (Article 52), and may argue that, despite the compute, the model does not present systemic risk.

On top of Article 53, Article 55 requires providers of systemic-risk models to:

• perform model evaluations using standardised protocols and state-of-the-art tools, including adversarial testing;
• assess and mitigate possible systemic risks at Union level;
• track, document and report serious incidents and corrective measures to the AI Office and, where relevant, national authorities without undue delay;
• ensure an adequate level of cybersecurity for the model and its physical infrastructure.

The GPAI Code of Practice

Article 56 provides for codes of practice that providers can use to demonstrate compliance until harmonised standards exist. The General-Purpose AI Code of Practice was published on 10 July 2025 after a multi-stakeholder drafting process. It has three chapters: Transparency (with a model documentation form), Copyright, and Safety and Security (the last applies only to systemic-risk models).

As of October 2026, the Commission's list of signatories includes Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI, OpenAI, Aleph Alpha, Cohere and others. xAI signed only the Safety and Security chapter, so it must show compliance with the transparency and copyright obligations by other means. Meta publicly declined to sign in July 2025. The list is updated on a rolling basis, so check the Commission page before relying on it.

Signing is voluntary. Signatories can use the Code to demonstrate compliance, and the Commission has said it will focus its oversight of them on monitoring adherence to the Code. Non-signatories must demonstrate compliance in other ways and can expect more information requests.

What Are the Key dates for GPAI?

For how these dates fit with the high-risk and transparency deadlines after the Digital Omnibus, see the EU AI Act timeline.

Enforcement: the AI Office and Commission powers

GPAI model providers are supervised centrally by the Commission through the AI Office, not by national authorities. Under Articles 91 to 94 the Commission can request documentation and information, conduct evaluations of a model (including via independent experts), and request measures such as mitigation, restriction of market availability, or withdrawal. A scientific panel of independent experts can issue qualified alerts about systemic risks.

Article 101 lets the Commission fine GPAI providers up to €15 million or 3% of worldwide annual turnover, whichever is higher, for breaches such as failing to supply documentation or ignoring a request for measures. These fining powers apply from 2 August 2026.

The Digital Omnibus (Regulation (EU) 2026/1744) extended the AI Office's reach: it now has exclusive supervision of AI systems built on a GPAI model where the model and the system come from the same provider or group, and of AI integrated into very large online platforms and search engines. A chat product and the model behind it, from the same company, now answer to one supervisor.

What it means if you only use ChatGPT, Claude or Gemini via an API

Most organisations do not train foundation models. If you call a model through an API or use a vendor's assistant, the Chapter V obligations sit with the model provider, not with you. Your position is usually:

• Deployer of an AI system. You must meet deployer duties for the use case: AI literacy for staff, and, if the use is high-risk (for example CV screening), the Article 26 deployer obligations. See provider vs deployer obligations.
• Provider of your own AI system. If you build a customer-facing chatbot on a GPAI model and run it under your brand, you are the provider of that system, and Article 50(1) requires it to tell users they are talking to AI.
• Possibly a GPAI model provider, rarely. If you fine-tune or modify a model substantially, you may become provider of a modified model. The Commission's guidelines indicate this is presumed only where the modification uses more than a third of the original model's training compute, which ordinary fine-tuning does not approach.

What you should do: ask your model vendor for its Annex XII downstream information and its Code of Practice status; record each use in your AI inventory; set rules on what data staff may send to the model; and check the GDPR implications of prompts that contain personal data, covered in EU AI Act vs GDPR. The assessment linked below asks exactly these questions and turns your answers into a vendor due diligence checklist and an acceptable use policy.

Frequently asked questions

What is a general-purpose AI model under the EU AI Act?

It is a model trained on large amounts of data that shows significant generality and can competently perform a wide range of distinct tasks, and can be integrated into many downstream systems. Large language models and image-generation models are typical examples. The Commission's guidelines use training compute above 10^23 FLOP plus language or image generation as an indicative signal.

What is the GPAI Code of Practice?

It is a voluntary code, published on 10 July 2025, that helps GPAI model providers comply with Articles 53 and 55. It has chapters on transparency, copyright, and safety and security. Most large providers have signed it; xAI signed only the safety chapter and Meta declined. Signing is optional, but non-signatories must prove compliance another way.

When do GPAI obligations apply?

From 2 August 2025 for models placed on the market from that date. Models already on the market before then have until 2 August 2027. The Commission's power to fine GPAI providers applies from 2 August 2026, so as of October 2026 the obligations are fully enforceable for new models.

Do businesses that use ChatGPT need to comply with GPAI rules?

Generally no. The GPAI model obligations fall on the company that develops the model and places it on the market. A business using ChatGPT, Claude or Gemini is normally a deployer and must meet deployer duties such as AI literacy, plus Article 50 transparency if it builds a chatbot or generator for others, and high-risk duties where the use case is high-risk.

What fines apply to GPAI providers?

Under Article 101 the Commission can fine GPAI model providers up to €15 million or 3% of total worldwide annual turnover, whichever is higher. Fines can follow, for example, from failing to provide requested documentation, supplying incorrect information or not complying with requested measures. These powers apply from 2 August 2026.

Know where you stand as a GPAI user

If your AI runs on someone else's model, your obligations depend on how you use it. Assess your AI governance against the EU AI Act in about 40 minutes: 14 steps of questions, a maturity score across ten governance areas and four editable Word documents written from your answers, including an AI vendor due diligence checklist and an AI risk assessment template. Free, no card, no obligation.

This article is general information, not legal advice. Check the consolidated text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Date-sensitive statements are correct as of October 2026.