The GPAI regime: what providers of general-purpose AI models must already do

While the high-risk obligations are expected to shift to late 2027, the regime for general-purpose AI models (GPAI) is already running at full speed. Chapter V has applied to new models since 2 August 2025, and on 2 August 2026 the European AI Office gains the power to enforce it. For anyone offering large models — or building on them — this is currently the most concrete part of the AI Act.

The baseline obligations (Article 53)

Every provider of a GPAI model must: draw up and maintain technical documentation; provide information and documentation to parties integrating the model into their own AI systems; operate a policy to comply with European copyright law, including respecting text-and-data-mining reservations; and publish a public summary of the training content. For that summary a mandatory template has been available since 24 July 2025, asking among other things for the main data sources and domain names.

Additional requirements for systemic risk (Article 55)

Models with systemic risk — presumed above a training compute of 10^25 FLOPs, or upon designation by the Commission — carry a second layer: model evaluations including adversarial testing, assessment and mitigation of systemic risks at Union level, reporting of serious incidents to the AI Office, and an adequate level of cybersecurity for the model and its infrastructure.

The Code of Practice as the compliance route

The GPAI Code of Practice of 10 July 2025 translates these open obligations into concrete measures in three chapters: transparency, copyright and safety. Signing is voluntary, but signatories get a simplified supervisory path — adherence to the Code counts as the accepted route to Chapter V compliance. Major providers, including Microsoft and Google, have signed; the signatories have formed a Signatory Taskforce chaired by the AI Office to apply the Code consistently.

Enforcement and the date that matters

From 2 August 2026 the AI Office can request information, order evaluations, impose measures and issue fines of up to €15 million or 3 percent of worldwide annual turnover (Article 101). Models already on the market before 2 August 2025 must comply in full by 2 August 2027. For European organisations that build no models of their own, the regime is indirect but essential: their suppliers' documentation and training-data summaries will be the basis on which they can demonstrate their own diligence — from procurement to literacy.