ComplyLens — EU AI Act checklist

EU AI Act GPAI Obligations: What AI Model Providers Must Do

The EU AI Act treats general-purpose AI (GPAI) models — foundation models like LLMs — separately from high-risk systems. If you train, fine-tune, or deploy a GPAI model for EU users, these obligations apply.

Who is a GPAI provider

A GPAI provider develops or trains a model that can perform a wide range of tasks (foundation models, large language models). A GPAI deployer integrates such a model into a product or service for EU users.

Obligations by role

ObligationProviderDeployerWhen
Technical documentation (training data, architecture, evaluation)✔—Aug 2025 (GPAI rules)
Copyright policy & training-data summary✔—Aug 2025
Transparency: label AI-generated content (Art. 50)—✔Aug 2026
Systemic-risk duties (models >10^25 FLOPs): risk assessment, adversarial testing, incident reporting✔ (systemic tier)—Aug 2025
Human oversight / safety measures✔ (documentation)✔ (deployment)Varies

Practical steps for 2026

  1. Determine your role: provider, deployer, or both.
  2. Document your model/system: training-data summary, evaluation results, intended uses.
  3. Label AI-generated content in your product (watermark, metadata, visible label) — required from August 2026.
  4. Check systemic-risk tier: if your model exceeds 10^25 FLOPs cumulative training compute, the heavy duties apply.
  5. Prepare incident reporting for serious incidents involving EU users.

The December 2026 milestone

Following the Digital Omnibus, most Annex III high-risk provisions moved to 2027, but GPAI transparency and content-labelling obligations apply from August 2026 — and the Code of Practice framework continues to evolve. If you ship any AI product to EU users, the labelling and documentation work is due this year.

Get the EU AI Act Readiness Kit — $149