What is a GPAI model? General-purpose AI under the EU AI Act

A GPAI model is a general-purpose AI model: an AI model trained on large amounts of data that can competently perform a wide range of distinct tasks and be integrated into many downstream AI systems. OpenAI’s GPT models, Anthropic’s Claude, Google’s Gemini, Meta’s Llama and Mistral Large are typical examples. Under the EU AI Act, providers of general-purpose AI models must document the model, share information with downstream providers, adopt a copyright policy and publish a summary of its training content. If your company uses these models, the AI Literacy course from Founderz covers what the EU AI Act asks of your teams.

Key takeaways on GPAI models and the EU AI Act

The EU Artificial Intelligence Act treats GPAI in five main ways:

• The AI Act defines a GPAI model by its generality: one model, many distinct tasks, many possible AI applications.
• Obligations for providers of general-purpose AI models have applied since August 2, 2025. The European Commission has been able to enforce them, including with fines, since August 2, 2026.
• A GPAI model with systemic risk, presumed above 10²⁵ FLOP of training compute, faces extra duties on evaluation, risk management, incident reporting and computer security.
• The General-Purpose AI Code of Practice is a voluntary tool that providers can use to demonstrate compliance.
• Most companies that use ChatGPT, Copilot or Gemini are deployers, not GPAI providers. Their main duty is AI literacy.

What is a GPAI model under the EU AI Act?

The EU AI Act defines a general-purpose AI model as an AI model trained with a large amount of data using self-supervision at scale. It displays significant generality and can competently perform a wide range of distinct tasks, whatever the way the model is placed on the market. It can be integrated into a variety of downstream systems or applications. Models used only for research, development or prototyping before they reach the market fall outside the definition.

In practice, GPAI as defined by the EU AI Act covers the large language models and foundation model families behind today’s assistants, from text to images and video. Separate guidelines, in which the Commission details the AI Act rules for providers, add an indicative criterion. A model trained with more than 10²³ floating-point operations (FLOP), that is, one hundred sextillion operations, and able to generate language, text-to-image or text-to-video is presumed to be a GPAI model.

GPAI model vs AI system

A GPAI model and an AI system are different things under the AI Act. The model is the engine, and it only becomes part of an AI system once it gets an interface and a purpose.

GPT models are GPAI models; ChatGPT is an AI system built on them. When a provider integrates a GPAI model into an AI system, the rules for both the AI system and the GPAI model can apply.

How does a GPAI model differ from narrow AI?

Narrow AI is built for one job, often a classification task: detecting fraud, classifying invoices or recommending products. A general purpose AI model can write, summarize, translate, analyze images and write code without being retrained for each task. That flexibility is why the EU’s approach to AI regulation targets the model itself as well as each AI application.

What obligations apply to GPAI model providers under the EU AI Act?

The rules on general-purpose AI start with Article 53 AI Act, which sets four baseline obligations for every GPAI model provider:

1. Technical documentation: draw up and keep up to date documentation of the model, including how the model is trained and tested and the training, validation, and test data sets used. Provide it to the AI Office and national competent authorities on request.
2. Downstream information: give providers of AI systems the information they need to understand the model’s capabilities and limits and to meet their own obligations.
3. Copyright policy: put in place a policy to comply with EU copyright law, including respecting rights holders who opt out of text and data mining.
4. Training summary: publish a sufficiently detailed summary of the content used for training, using the Commission’s template.

Providers established outside the European Union, including those based in the United States, must appoint an authorized representative in the EU before placing their model on the market. A model must meet these rules wherever it was trained.

Who is responsible for complying with GPAI rules?

The GPAI model provider is responsible for compliance with the AI Act: the company that develops the model, or has it developed, and places it on the EU market under its own name. OpenAI, Anthropic, Google, Meta and Mistral AI are providers of their own models.

Fine-tuning can shift that responsibility. Under the Commission’s guidelines, a downstream actor becomes the provider of a modified model when the modification uses more than one third of the compute used to train the original model. Below that threshold, the original model provider keeps the obligations. The AI Act provides this split so that each obligation sits with whoever controls the model.

Companies that only use AI systems built on these models are deployers. Their obligations under the AI Act come from other parts of the regulation, covered below.

Are open-source GPAI models exempt from the EU AI Act?

Only partly. Models released under a free and open-source software license (an open-source license that allows access, use, modification and distribution), with public weights, architecture and usage information, are exempt from the technical documentation and downstream information duties, and from appointing an EU authorized representative.

They must still adopt a copyright policy and publish the training content summary. The exemption disappears for open-source models that pose systemic risk.

Additional requirements for GPAI models with systemic risk

The AI Act adds a second tier for the most advanced models: AI models with systemic risk, often shortened to GPAI with systemic risk. A model falls into this tier when it has the high-impact capabilities of general-purpose AI models at the frontier of the AI ecosystem, and the regulation presumes them when cumulative training compute exceeds 10²⁵ FLOP, or ten septillion operations. The Commission can also designate a model based on other criteria, such as its number of users.

Providers must notify the Commission within two weeks of meeting the threshold. Under Article 55 AI Act, the provider of a general-purpose AI model with systemic risk must also:

• Perform model evaluations, including adversarial testing, using state-of-the-art methods.
• Assess and mitigate possible systemic risks at EU level as part of ongoing risk management.
• Track, document and report serious incidents and corrective measures to the AI Office and national authorities.
• Ensure an adequate level of computer security for the model and its physical infrastructure.

This tier is the AI Act’s main AI safety layer and the core of its regulation of AI risk. The risks in scope are large-scale ones: chemical, biological, radiological and nuclear misuse, cyber offense, loss of control, harmful manipulation and threats to fundamental rights.

The General-Purpose AI Code of Practice

The GPAI Code of Practice is a voluntary compliance tool: providers that sign it can use it to demonstrate compliance with the AI Act’s obligations for GPAI models. The Commission published the first general-purpose AI code of practice on July 10, 2025, drafted by independent experts with input from providers, civil society and rights holders. The Commission and the AI Board then confirmed it as an adequate way to demonstrate compliance. It has three chapters:

• Transparency: a model documentation form that covers the Article 53 information duties.
• Copyright: practical measures for a copyright policy that respects text and data mining opt-outs.
• Safety and Security: a risk management framework for models with systemic risk.

Shortly after publication, the AI code of practice received signatures from most major providers. Those that do not sign must show compliance by other adequate means. Early signatories included Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI and OpenAI. xAI signed only the Safety and Security chapter, and Meta declined to sign.

When do GPAI requirements take effect?

The GPAI rules apply in stages. Obligations started in 2025, enforcement powers arrived in 2026, and older models have until 2027 to comply.

The AI Omnibus, Regulation (EU) 2026/1744, did not change the core provisions of the EU AI Act on GPAI. It did push back the rules for high-risk AI systems to December 2, 2027, or August 2, 2028 for AI built into regulated products, and it expanded the powers of the AI Office.

Who enforces the rules, and what are the fines?

The EU AI Office, part of the European Commission, supervises GPAI providers directly. National competent authorities supervise AI systems used in their countries, so the AI Office and national competent authorities share the work when a GPAI model sits inside an AI system.

For GPAI providers, fines can reach 3% of total worldwide annual turnover or €15 million, whichever is higher.

What GPAI rules mean for your company

The EU AI Act mandates different duties for different roles, and most organizations are deployers, not providers. If your teams use ChatGPT, Copilot or Gemini, the GPAI obligations fall on the model providers, such as OpenAI, Anthropic or Google. Your duties come from other parts of the AI Act:

• AI literacy: providers and deployers of AI systems have had an AI literacy duty since February 2, 2025. Since the AI Omnibus took effect on July 27, 2026, they must take measures to support a sufficient level of AI literacy among their staff.
• Transparency: from August 2, 2026, people must know when they interact with an AI system or see AI-generated content in certain cases.
• High-risk AI systems: if you use AI in hiring, credit scoring or other high-risk areas, stricter rules apply from December 2, 2027.
• Becoming a provider: if you significantly modify a model, or put your own name on a model you place on the EU market, you may become a GPAI provider yourself.

Ask your vendors for the documentation and usage information they publish under the EU AI Act’s GPAI provisions, and give them feedback on gaps. It explains what the model can and cannot do, which feeds your own AI governance, policy and risk assessment, including checks for algorithmic bias. For managers who lead that work, the Responsible AI Leadership program turns the regulation into practical policies.

GPAI as the Global Partnership on AI

The acronym GPAI has a second meaning. The Global Partnership on Artificial Intelligence is an international initiative on AI governance launched in 2020 by a group of governments to support responsible AI based on human rights. Since 2024 it has worked as an integrated partnership with the OECD.

It is a policy forum where governments and stakeholders meet, not a type of model, and it creates no legal obligations for companies. In the EU AI Act, GPAI always refers to general-purpose AI models and systems.

Your next step: build AI literacy in your team

Knowing what a GPAI model is, and which obligations sit with your vendors, is the starting point for regulatory compliance in your company. The AI Literacy course helps teams meet the AI Act’s literacy duty with practical training.

Founderz has trained more than 700,000 learners and has a presence in 170+ countries.

Frequently asked questions about GPAI models

Short answers on GPAI under the EU AI Act.

What does GPAI stand for?

GPAI stands for general-purpose AI. In the EU AI Act it refers to GPAI models and the systems built on them.

Is ChatGPT a GPAI?

ChatGPT is a GPAI system. The GPT models behind it are GPAI models, and OpenAI, as the model provider, carries the obligations for those models under the AI Act.

Is GPAI mandatory?

Compliance with the GPAI rules is mandatory for providers of GPAI models placed on the EU market. Signing the Code of Practice is voluntary; it is one way to demonstrate compliance.

Is GPAI the same as generative AI?

They overlap. Most generative AI models today are general-purpose, but the AI Act defines GPAI by generality, so a generative model trained for one narrow task would not meet the definition.

Does the AI Act apply to models developed outside the EU?

Yes. The scope of the AI Act covers any GPAI model placed on the EU market, wherever the provider is based. Non-EU providers must appoint an authorized representative in the EU.

Which models are GPAI models with systemic risk?

General-purpose AI models may be classified as models posing systemic risk in two ways. Models trained with more than 10²⁵ FLOP of computing are presumed to have high-impact capabilities, and the Commission can also designate models based on other criteria.