Obligations for General-Purpose Models

Chapter V of the AI Act regulates the model, not the application. Four obligations apply to every provider of a general-purpose model, and a further set applies only to models classified as carrying systemic risk. These have applied since 2 August 2025.

What counts as a general-purpose model

The definition in Article 3 turns on generality rather than size: a model trained on a large amount of data using self-supervision at scale, displaying significant generality, capable of competently performing a wide range of distinct tasks, and capable of being integrated into a variety of downstream systems. Models used for research, development or prototyping before being placed on the market are excluded.

Two boundaries matter in practice. A model fine-tuned from a general-purpose model is capable of making the fine-tuner a provider of a general-purpose model in its own right — the Commission’s guidelines address where a modification is substantial enough for that to happen, and light instruction-tuning on a small dataset is generally not it. And a general-purpose model is a different thing from a general-purpose AI system: the model is the weights, the system is the model plus whatever serves it.

The four baseline obligations

Article 53 sets them out. Every provider of a general-purpose model placed on the Union market carries all four, regardless of size, openness or capability.

Providers established outside the Union must appoint an authorised representative in the Union, under a separate article in the same chapter. That representative holds the documentation and is the point of contact for authorities, which is the mechanism by which the chapter reaches non-EU labs at all.

The copyright policy and the training summary

These two are the most-read obligations in the chapter and they do different jobs.

The copyright policy is an internal compliance obligation with an external hook. Article 4 of the 2019 Copyright in the Digital Single Market Directive permits text and data mining of lawfully accessible works, but only where the rightholder has not reserved the right in an appropriate manner — for content made publicly available online, by machine-readable means. The AI Act obliges a model provider to have a policy for identifying and respecting those reservations. Recital material in the Act asserts that this applies to models placed on the Union market whatever jurisdiction the training happened in, which is a deliberate extraterritorial reach and one of the more likely candidates for future litigation. The underlying question of whether the training itself infringes is answered differently in different jurisdictions.

The training content summary is a transparency obligation aimed at rightholders. The Commission published a template for it in July 2025. It asks for a narrative description of the data sources by category — large public datasets by name, data licensed from named categories of rightholder, data scraped from the web with the main domains, user data, synthetic data — rather than an enumeration of works. The point of contention when it was drafted was exactly how granular “sufficiently detailed” has to be, and the template is the Commission’s answer to that question rather than a court’s.

Systemic risk: the threshold and the extra duties

A general-purpose model is classified as carrying systemic risk if it has high-impact capabilities, assessed against technical tools and methodologies, or by a Commission decision. The Act sets a rebuttable presumption: a model is presumed to have high-impact capabilities when the cumulative amount of compute used for its training, measured in floating point operations, is greater than 10²⁵. That number can be amended by delegated act, and it was set in 2024 — treat it as a threshold with a shelf life.

A provider that meets the threshold must notify the Commission without delay, and in any event within two weeks. It may argue that despite crossing the threshold its model does not present systemic risk, but the burden is on it and the Commission may reject the argument.

Where the classification sticks, four further duties apply:

• Model evaluation according to standardised protocols, including conducting and documenting adversarial testing with a view to identifying and mitigating systemic risks.
• Assess and mitigate possible systemic risks at Union level, including their sources, arising from the development, placing on the market or use of the model.
• Track, document and report serious incidents and possible corrective measures to the AI Office and, as appropriate, national competent authorities, without undue delay.
• Adequate cybersecurity protection for the model and its physical infrastructure.

Note the asymmetry with the high-risk regime: there is no conformity assessment here and no notified body. Systemic-risk obligations are supervised directly by the Commission through the AI Office, which is also the body that can fine for breach.

The open-source carve-out and its limits

Models released under a free and open-source licence, where the parameters including weights, information on architecture and information on model usage are made publicly available, are exempt from the technical documentation and downstream information obligations — the first two of the four in the table above.

They are not exempt from the copyright policy or the training content summary. And the carve-out disappears entirely for a model with systemic risk. So the practical position for a well-known open-weights model above the compute threshold is that it carries all the Article 53 duties and all the systemic-risk duties, and the openness buys it nothing under this chapter.

A second limit that matters when you are choosing a model: monetisation defeats the exemption in the wider Act. A licence that is free in name but attached to a paid service is not what the text has in mind.

The Code of Practice

The Act invites the drawing up of codes of practice to demonstrate compliance with Chapter V. The General-Purpose AI Code of Practice was published in July 2025 with three chapters: Transparency, Copyright, and Safety and Security. The first two apply to all general-purpose model providers; the third applies only to systemic-risk models.

Signing is voluntary. What signature buys is a presumption of good faith and a simplified route to demonstrating compliance — the Commission has indicated that adherence reduces the administrative burden and gives signatories more legal certainty. Several major labs signed; at least one large provider publicly declined at the outset. Refusing does not make you non-compliant. It means you must demonstrate compliance some other way, and there is currently no other well-trodden route.

The Transparency chapter comes with a Model Documentation Form. If you are a downstream developer, that form is the most useful artefact in the whole package, because it is closer to a filled-in Annex XII than anything a marketing-driven model card will give you.

What reaches you as a downstream developer

If you build on a hosted general-purpose model, none of Chapter V binds you — unless your modifications make you a provider of a general-purpose model in your own right. What binds you is whatever role you hold for the system you ship.

What you should be collecting from the model provider, and keeping:

1. The Annex XII downstream information, or the Model Documentation Form if they signed the Code. This is the document that tells you the model’s intended use, its limitations, its acceptable use policy and its technical means of integration.
2. The published training content summary, with the date you retrieved it. This is your evidence on provenance questions later.
3. The copyright policy, if published, and any statement about reservations of rights.
4. Evaluation results relevant to your use. Generic benchmark scores are not that; ask for what was tested on the failure modes that matter to your application.

Then keep a dated copy of each. A vendor page that changes silently is not evidence of what you relied on when you made the decision, and the evidence pack an auditor asks for is built out of exactly this kind of dated retrieval.