General-purpose AI model (GPAI)

The EU AI Act regulates general-purpose AI (GPAI) models separately from the AI systems built on them. Large language models and multimodal models offered through an API or released for download are typical examples. Providers of GPAI models must prepare technical documentation, give downstream providers enough information to understand the model and meet their own duties, put in place a policy to comply with EU copyright law, and publish a sufficiently detailed summary of the content used for training. Some of these duties are lighter for models released under free and open-source licences.

Models classified as presenting systemic risk, because of their high-impact capabilities, carry additional obligations: model evaluation including adversarial testing, assessment and mitigation of systemic risks, serious incident reporting and adequate cybersecurity. A codes of practice mechanism helps providers demonstrate compliance. For an organization that integrates a GPAI model into its own chatbot, the model provider carries the model duties, while the organization may become the provider or deployer of the resulting AI system.