General-purpose AI under the EU AI Act: provider obligations and what downstream users get

GPAI model providers

Providers placing a general-purpose AI model on the EU market. Duties apply from 2 Aug 2025; Commission fines from 2 Aug 2026 for models placed after 2 Aug 2025; legacy models by 2 Aug 2027.

Providers of GPAI models with systemic risk

Models presumed to have high-impact capabilities where training compute exceeds 10^25 FLOP carry extra duties under Article 55.

Downstream providers and deployers

Organisations integrating a GPAI model into an AI system. They receive documentation, and become a GPAI provider only if they make a substantial modification.

• Technical documentation of the model, including training and testing and evaluation results, kept up to date and available to the AI Office on request (Annex XI).
• Information for downstream providers so they can understand the model's capabilities and limits and meet their own obligations (Annex XII).
• Copyright policy to comply with EU copyright law, including identifying and honouring rights reservations.
• Public summary of training content, using the Commission's template.

Open-source providers get a partial exemption from some documentation duties, but not from the copyright policy or the training-content summary, and never when the model has systemic risk.

A model is presumed to have high-impact capabilities, and therefore systemic risk, when cumulative training compute exceeds 10^25 floating-point operations (Article 51(2)). Providers of these models must additionally:

• Perform model evaluation, including adversarial testing.
• Assess and mitigate systemic risks.
• Report serious incidents to the AI Office.
• Ensure an adequate level of cybersecurity for the model and its physical infrastructure.

A provider can try to rebut the presumption. Built-in safety measures do not by themselves rebut it, according to guidance commentary.

Usually not. The Commission guidelines set an indicative criterion that a model is general-purpose if its training compute is above 10^23 FLOP and it can generate language, images or video. A downstream modifier becomes a provider of the modified model only if the compute used for the modification exceeds one third of the original model's training compute. These thresholds come from a summary of the guidelines on the Modulos guidance page (secondary source) and are indicative, not binding. Ordinary fine-tuning and prompt or retrieval configuration typically stay below them, but take legal advice for a specific case.

The Commission published the General-Purpose AI Code of Practice on 10 July 2025. It is voluntary and has three chapters: Transparency (with a Model Documentation Form), Copyright, and Safety and Security, which applies only to systemic-risk models. The Commission page lists signatories including Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI, OpenAI, Aleph Alpha and Cohere. xAI signed only the Safety and Security chapter. Signing gives more legal certainty and a lighter way to demonstrate compliance; it does not remove exposure to fines.

Why this matters if you build on models: check which models you approve have a signatory provider, and request their Model Documentation Form or equivalent. Under Article 25(4), providers of high-risk systems and third-party suppliers of components must agree in writing on information and technical access, and GPAI models are not covered by the open-source exemption from that duty.

The Omnibus did not change the GPAI duty dates or the Article 101 fine dates. It gave the AI Office exclusive supervisory competence over AI systems built on a GPAI model by the same provider, and over AI integrated into very large online platforms and search engines. Which authority supervises a given system depends on who provides the model and the system, so confirm it for your case.

Compliance-by-design. Swfte provides the technical controls, governance mechanisms and evidence to support deployment within applicable requirements. The exact posture depends on your use case, jurisdiction, deployment and configuration. This is not legal advice.

Hosting today: customer data is stored in AWS eu-west-1 (Ireland), as stated on the trust page. EU region, in-country, dedicated and on-prem options are the platform position: what it is designed to let you do, scoped with you through a dedicated deployment engagement, not self-serve.

• Swfte is not the GPAI provider of the models it routes to. Training documentation, copyright policy and training-content summaries are the model providers' obligations.
• It does not train frontier models, so Article 55 systemic-risk duties are not what your use of the platform creates.
• It does not verify a provider's Code of Practice status for you. Check the Commission's signatory list.
• It does not decide whether your own fine-tuning makes you a GPAI provider.

• European Commission: guidelines for providers of general-purpose AI models
• European Commission: General-Purpose AI Code of Practice
• AI Act Article 53, GPAI provider obligations (AI Act Service Desk)
• AI Act Article 101, fines on GPAI providers (AI Act Service Desk)
• AI Act Article 25, value-chain responsibilities (AI Act Service Desk)
• Regulation (EU) 2026/1744, the Digital Omnibus on AI (EUR-Lex) (Adopted 8 July 2026, published 24 July 2026, in force 27 July 2026.)
• AI Act Service Desk: implementation timeline (European Commission) (Reflects the Digital Omnibus amendments.)
• Modulos: Commission guidance on GPAI models (Secondary summary, used for the 10^23 FLOP indicative criterion and the one-third modification threshold.)

• EU AI Act timeline

• AI Act penalties

• High-risk checklist

• AI literacy (Article 4)

• EU AI Act guide

• AI governance

  Governance that runs inside AI, not beside it.

• AI sovereignty

  Seven kinds of control over your AI estate.

• Trust Profile

  The record of what each AI system is and may do.

• Trust centre

  What Swfte can show today, and what it does not claim.