Glossary · AI governance
GPAI rules follow the model, wherever it ends up.
An AI model, often trained on a large amount of data, that can competently perform a wide range of distinct tasks and be built into many downstream systems.
Back to the glossary01 · In plain words
In plain words
An AI model, often trained on a large amount of data, that can competently perform a wide range of distinct tasks and be built into many downstream systems.
Most AI rules look at what a system is used for. A general-purpose AI model is different, because its maker cannot know every use. Large language models and image generators are the familiar cases. The AI Act puts duties on whoever provides the model, so that the companies building on it downstream get what they need to meet their own duties.
Spelled out: General-purpose AI, used in the EU AI Act for general-purpose AI models and the systems built on them.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
If you train a model, or change one enough, and make it available, you may be a GPAI provider with documentation and copyright duties. If you only build on someone else's model, you are a downstream provider who relies on the information the model provider must hand over. Either way, buyers ask. The model chapter has applied since 2 August 2025. Models with systemic risk, presumed when training compute exceeds 10 to the power of 25 floating-point operations, carry more: model evaluation, adversarial testing, serious-incident reporting and cybersecurity protection.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- Article 3(63) and 3(66)
- The definitions of a general-purpose AI model and of a general-purpose AI system built on one.
- Article 53
- Baseline provider duties: technical documentation, information for downstream providers, a copyright policy and a public summary of training content.
- Articles 51 and 55
- When a model is classed as having systemic risk, and the extra duties that follow.
- The General-Purpose AI Code of Practice
- A voluntary code, published in 2025, that providers may use to show how they meet the model duties.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a fine-tuned legal-language model offered by API
A Chennai startup takes an open-weight language model, fine-tunes it on Indian and European case law, and offers it through an API to law-tech firms in France and Germany. Two questions decide its position. Is the change large enough to make it the provider of a new GPAI model, or is it a light adaptation? And does the base model carry systemic risk? If the startup is a provider, it owes documentation, downstream information, a copyright policy and a training-content summary covering its own contribution. Its API customers, who build research tools for lawyers, are downstream providers of AI systems and will ask the startup for that information.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- AI system
- The model is the engine. A general-purpose AI system is a product built around it, such as a chat assistant. Duties for each sit in different chapters of the Act.
- Foundation model
- An industry phrase with no legal weight in the final Act. The legal test is generality and the ability to serve many distinct tasks.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- List every model you train, fine-tune or redistribute, and every third-party model you build on.
- For models you place on the market, decide whether you are the provider and keep the Article 53 records.
- Ask upstream model providers for the downstream information they owe you, and file it.
- Check whether any model you use or supply is classed as having systemic risk.
- GuideISO 42001 and the EU AI ActLaw vs standard, the risk tiers, dates, and the article-by-article map.
- GuideAI role emulatorProvider or deployer? Describe your AI and see what's yours to evidence.
- GuideSOC 2 for AI companiesTraining data, model providers and customer prompts.
Sources: Regulation (EU) 2024/1689, Articles 3, 51, 53, 55 and 111, from EUR-Lex; European Commission guidelines on obligations for general-purpose AI models; the General-Purpose AI Code of Practice.
Questions about GPAI
When does fine-tuning make us a GPAI provider?
When the change is significant.
The Commission's guidance treats a modifier as a new provider only when the modification is significant, and uses the compute spent on modification as an indicator. A small fine-tune usually stays below it. Record the compute used and your reasoning either way.
Do open-source models escape the rules?
Partly.
Models released under a free and open-source licence, with their weights and architecture public, are exempt from some documentation duties under Article 53(2). They still need a copyright policy and a training-content summary, and the exemption does not apply to models with systemic risk.
What about models released before August 2025?
They have until August 2027.
Under Article 111(3), providers of models placed on the market before 2 August 2025 must take the steps needed to comply by 2 August 2027.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.