AI Act: General-purpose AI (GPAI) models provisions entered into force – What This Means for Your Business

As of 2 August 2025, the European Union is officially enforcing the first binding legal framework targeting general-purpose AI (GPAI) models under the EU AI Act. While much of the attention so far has focused on the high-risk use cases like facial recognition or AI in medical devices (see also our other blogpost on this topic: here), the spotlight is now shifting to GPAI models, the large-scale foundation models that power many of the modern AI tools, like ChatGPT (OpenAI), Gemini (Google) and Copilot (Microsoft). 

This marks an important turning point for companies developing or finetuning GPAI models. This blogpost explores what the provisions entail and what they mean for the businesses that are currently providing and/or using GPAI across the AI value chain. 

What is General Purpose AI? 

The EU AI Act introduces a definition of general-purpose AI. According to Article 3 (63) of the regulation:

 “General-purpose AI model” means “an AI model, including where such an AI model is trained with a large amount of data using self-supervision at scale, that displays significant generality and is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market and that can be integrated into a variety of downstream systems or applications, except AI models that are used for research, development or prototyping activities before they are placed on the market.”

In addition to general-purpose AI models, there are general-purpose AI systems. According to Article 3 (66) of the regulation: 

“general-purpose AI system” means “an AI system which is based on a general-purpose AI model and which has the capability to serve a variety of purposes, both for direct use as well as for integration in other AI systems;” 

For example, ChatGPT is a GPAI system, as it is the deployed application that interacts with users, while GPT-4 is the underlying GPAI model that serves as the core engine behind its capabilities. 

What actually entered into force? 

The key provisions that entered into force now fall under Chapter V of the AI Act, covering rules for GPAI models. These rules aim to introduce transparency, copyright and accountability requirements at the model level, prior to the deployment of the AI model in any specific use case. The main provisions of Chapter V apply to providers of GPAI models, think OpenAI, Google, Meta, Anthropic and Mistral, which are the most noteworthy providers of GPAI models. An important tool for these providers in order to help them comply with the rules in Chapter V is the recently developed General-Purpose AI Code of Practice. The Code was published on 10 July 2025 and complemented by Commission Guidelines on key concepts related to GPAI. GPAI providers who voluntarily sign the Code can show they comply with the AI Act by adhering to the Code. This will decrease the administrative burden and increase legal certainty. 

From 2 August 2025, all new GPAI models entering the EU market (or old GPAI models that are substantially modified after this date) must comply with: 

• Transparency obligations include disclosing model architecture, acceptable use policy, intended purpose and nature, and limitations (restrictions and prohibited use). A detailed list of the transparency obligations can be found in the Code of Practice. There is an obligation for upstream providers to maintain and update the documentation, and to provide it to downstream providers and, upon request, to the AI office or national competent authorities. 
• Training data summary: providers must publish a summary using the template provided by the European Commission. 
• Copyright compliance, which requires among others, putting in place a copyright policy and implementing measures to ensure compliance with Union law on copyright and related rights (i.e. measures to identify and comply with rights reservations expressed pursuant to Article 4 (3) of the TDM Directive). 

For existing models already placed on the market before that date, a two-year grace period applies. They will need to comply fully by 2 August 2027. 

From 2 August 2026, the EU AI Office can formally enforce the AI Act through information requests, remediation orders, fines, etc. The fines can reach up to 15 million or 3% of global turnover, whichever is higher. 

The EU member States also had an obligation to establish by 2 August 2025, a national authority to enforce the AI Act provisions. De Federal Public Service (FPS) Economy published a list of authorities on Federal and regional level that are competent to enforce the AI Act provisions, the list can be consulted via the following link: https://economie.fgov.be/sites/default/files/Files/Online/Overzicht-van-de-Belgische-autoriteiten-voor-de-bescherming-van-de-grondrechten.pdf. 

The extra burden for “Systemic Risk” models 

Not all GPAI models are treated equally under the AI Act. Some models, especially the most powerful and advanced ones, will be classified as “systemic risk” models due to their vast computing power (“most advanced”) and potential impact that is equivalent to the most advanced models. 

To capture the most advanced models, the AI Act lays down a compute threshold (for now) of 10²⁵ floating-point operations (FLOP) or more used for training the model. In this case there is a presumption of “high-impact” capabilities, which makes it a systemic risk model. Providers that are developing a model that meets this threshold of 10²⁵ must notify the Commission within two weeks of reasonably foreseeing or reaching the threshold. The presumption can be rebutted by providers by supplying robust evidence that the model does not present a systemic risk. However, this can be rejected by the Commission and the providers are held to the strict obligations during the review period. 

These “most advanced” systems face even stricter requirements, such as: 

• Performing regular model evaluations and detailed risk assessments throughout the lifecycle of the systemic risk model 
• Logging serious incidents and vulnerabilities and reporting of serious incidents to the AI office, and as appropriate, to national competent authorities 
• Implementing strong risk mitigation measures 
• Potentially notifying the AI Office of upcoming deployments 

Until now it is unclear what is meant by “potential impact that is equivalent to most advanced models”, and the Commission is empowered to designate models as posing systemic risk, based on criteria such as the evaluation of capabilities of the model, number of users, scalability or access to tools. 

This means that companies operating at the cutting edge of foundation model development will not only need robust documentation pipelines but also ongoing governance systems that can evolve with the models. 

What does this mean for businesses integrating or modifying GPAI models 

You might think that these provisions only apply to GPAI model providers like OpenAI or Google, but if a downstream actor substantially modifies a GPAI model, it may also be considered a provider of the GPAI model and become subject to the corresponding model obligations in Chapter V of the AI Act. 

To clarify this, we will distinguish between two types of (downstream) businesses: 

1. Businesses that are integrating a GPAI model into their own AI-system: These downstream actors are typically considered providers of the AI system, not of the GPAI model itself. As a result, they are not subject to the obligations for GPAI model providers under Articles 53 to 55. Instead, they must comply with the baseline requirements that apply to all AI system providers, such as transparency obligations and promoting AI literacy among their staff, and complying with high-risk requirements when the AI system is classified as high risk.

2. Businesses that are further modifying or fine-tuning a GPAI model into a new model      These businesses might be considered providers of the new modified GPAI model. In such cases, the obligations under the AI Act will generally apply only to the modifications made, for example by requiring the provider to update technical documentation or disclose details of the fine-tuning process. However, this applies only if the modification is considered substantial. According to the European Commission’s guidelines, a modification is likely to be considered substantial if it leads to a significant change in the model’s generality, capabilities, or systemic risk. As an indicative threshold, the Commission proposes that a modification should be treated as substantial if the compute used for the modification exceeds one-third of the compute used to train the original model. When this threshold is met, the downstream actor may be classified as the provider of a modified general-purpose AI model and become subject to the transparency obligations under Article 53, and, where applicable, the systemic risk obligations under Article 55 of the AI Act. If the compute used to train the original model is unknown or cannot reasonably be estimated, fallback thresholds apply: 10²³ FLOP for standard GPAI models, and 10²⁵ FLOP for GPAI models presumed to carry systemic risk. 

Conclusion 

Although Chapter V of the AI Act will not apply to most businesses immediately, caution is essential for organisations that fine-tune or otherwise modify general-purpose AI models. The European Commission clarifies that not all modifications will make a downstream actor a provider, but significant changes to a model’s generality, capabilities, or systemic risk may trigger this status. In particular, this may be the case where the compute used for modification exceeds one-third of that used to train the original model.

Understanding your position in the AI value chain is essential. Even if you are only a downstream user, regulators will expect transparency about how the model is used, its origin, and its potential risks. Taking early steps to assess and document your involvement can help avoid serious compliance challenges later on.