General-purpose AI model
GPAIAlso called GPAI model, foundation model
A general-purpose AI model is an AI model trained on large amounts of data that can perform a wide range of distinct tasks. It can be built into many different downstream systems. Under the EU AI Act, providers of these models carry their own duties on documentation, copyright and, for the largest models, systemic risk.
How it works
Model providers place a general-purpose model on the EU market and share technical documentation with firms that build on it. A bank that uses such a model inside a chatbot, screening tool or drafting assistant is usually a deployer, not a provider. Its procurement and model risk teams ask for the provider's documentation, test the model for its use case and record the findings.
The AI Act split duties so that model makers answer for the model and deployers answer for how it is used. Models trained with more than 10^25 floating point operations are presumed to carry systemic risk and face extra duties. The Commission's enforcement powers over providers apply from 2 August 2026, so documentation gaps now carry fines.
The rules
Requires technical documentation, information for downstream providers, a copyright policy and a training data summary, with extra duties for systemic-risk models.
Providers of general-purpose AI models placed on the EU marketVoluntary code with chapters on transparency, copyright, and safety and security that providers can use to show AI Act compliance.
Providers of general-purpose AI models, voluntaryGives the Commission power to request information and fine providers up to 3% of worldwide turnover or EUR 15 million, whichever is higher.
Providers of general-purpose AI modelsCommon questions
Is a bank a GPAI provider if it uses a large language model?
Usually not. A bank that builds a model into its own tools is typically a downstream provider or deployer of an AI system. It becomes a GPAI provider only if it develops or substantially modifies a model and places it on the market.
What makes a GPAI model systemic risk?
A model is presumed to have systemic risk when the cumulative compute used to train it exceeds 10^25 floating point operations. The Commission can also designate models based on criteria such as reach and capabilities.
When did GPAI duties start?
Provider obligations applied from 2 August 2025. Models already on the market before that date have until 2 August 2027 to comply. The Commission's fining powers apply from 2 August 2026.
How does GPAI differ from a high-risk AI system?
A GPAI model is a component that can serve many purposes. A high-risk AI system is a finished system used in a listed sensitive area, such as creditworthiness checks. A high-risk system can be built on top of a GPAI model.
Our coverage
News and analysis on AI and model risk from RegTech Post.
Read the coverage →RegTech PostEU AI Act: A Global Benchmark for Governing Artificial IntelligenceRead the article →RegTech PostFrom Chatbots to Credit Scoring: Europe Redefines AI RiskRead the article →
