A GPAI model, or general-purpose AI model, is an AI model that displays significant generality and can competently perform a wide range of distinct tasks, and that can be integrated into many downstream systems and applications. In AI regulation, the term has a precise legal meaning under the EU AI Act, which sets specific obligations for the providers of such models.
Typical GPAI models are large language models and multimodal foundation models trained on large amounts of data, often with self-supervision. The AI Act regulates them separately from AI systems, because one model can power thousands of products whose risks the original developer cannot foresee individually.
How the AI Act defines and classifies a GPAI model
The legal definition rests on generality and integrability, not on a particular architecture. A model trained for one narrow purpose, such as detecting defects in welding images, is not a GPAI model, while a model that writes text, summarizes documents, translates and generates code typically is. Models used only for research and development before being placed on the market fall outside the definition.
The Act creates two tiers. Every GPAI model carries baseline obligations, and models with systemic risk carry additional ones. A model is presumed to have systemic risk when the cumulative compute used for its training exceeds 10^25 floating-point operations, and the Commission can also designate models based on other criteria such as reach and capabilities.
The table below separates the two tiers.
| Tier | How a model qualifies | Obligation level |
|---|---|---|
| GPAI model | Significant generality and wide task range | Documentation, copyright policy, training summary |
| GPAI model with systemic risk | Above 10^25 FLOP or designated | Baseline plus evaluation, mitigation, incident reporting |
| Open-source GPAI model | Weights and architecture publicly released under a free license | Reduced duties unless it has systemic risk |
Obligations of GPAI model providers
The obligations fall on the AI provider that develops the model or has it developed and places it on the EU market under its own name. Providers established outside the union must appoint an authorized representative in the EU.
| Obligation | Applies to | Practical content |
|---|---|---|
| Technical documentation | All GPAI models | Training process, data, compute, evaluation results |
| Downstream information | All GPAI models | Capabilities and limits for integrators |
| Copyright policy | All GPAI models, including open source | Respect for text and data mining opt-outs |
| Training content summary | All GPAI models, including open source | Public summary using the official template |
| Model evaluation and adversarial testing | Systemic risk models | Standardized evaluations and red teaming |
| Risk assessment and mitigation | Systemic risk models | Union-level systemic risks |
| Serious incident reporting | Systemic risk models | Report to the AI Office without undue delay |
| Cybersecurity protection | Systemic risk models | Protect weights and infrastructure |
A provider whose model reaches the systemic risk threshold must notify the Commission within two weeks. The provider may argue that the model does not in fact present systemic risk, but the burden of showing this lies with the provider.
GPAI model, GPAI system and high-risk AI system
A frequent source of confusion is the difference between a model and a system. The model is the trained component, such as the weights of a language model. A system adds an interface and other components, such as a chat application, and the AI Act regulates the two through different chapters.
| Concept | What it is | Main rules |
|---|---|---|
| GPAI model | Trained general-purpose component | Chapter on general-purpose AI models |
| General-purpose AI system | System built on a GPAI model | Transparency and system rules |
| High-risk AI system | System used in an Annex III or safety area | Conformity assessment and risk management |
| AI deployer | Organization using a system | Use according to instructions, oversight |
A company that fine-tunes or modifies a GPAI model may become a provider of a new model if the modification is substantial; guidance from the Commission links this to the share of original training compute used. A company that integrates the model into a high-risk use becomes the provider of that high-risk system and must meet its separate obligations.
Timeline, Code of Practice and enforcement
The GPAI rules have applied since 2 August 2025 for models placed on the market from that date. Models already on the market before then must comply by 2 August 2027. The EU AI Office within the Commission supervises GPAI providers directly, rather than national authorities.
The GPAI Code of Practice, published in 2025 and developed with industry, academia and civil society, offers a voluntary way to demonstrate compliance through chapters on transparency, copyright, and safety and security. Providers that sign it benefit from greater legal certainty, while others must show compliance through alternative means.
| Date | Event | Consequence |
|---|---|---|
| 2 August 2025 | GPAI obligations apply | New models must comply |
| 2 August 2026 | Fining powers become enforceable | Fines up to 3 percent of turnover or 15 million euros |
| 2 August 2027 | Deadline for legacy models | Earlier models must comply |
Common misunderstandings
- Not every large model has systemic risk: the presumption depends on training compute or designation.
- Open source is not a full exemption: copyright and summary duties still apply.
- Users of a chatbot are not GPAI providers: deployers have different duties.
- Signing the Code is not mandatory, but it simplifies demonstrating compliance.
- The compute threshold can change through delegated acts as technology evolves.
Because the compute threshold is a proxy, it is contested. Efficient training methods can produce highly capable models below it, while compute alone says little about specific dangers, which is why the Act allows designation based on capabilities and reach.
A plain-language summary
A GPAI model is a very flexible AI, such as a large language model. It can do many different jobs. Other companies build their own products on top of it. European law treats these models as a special group because a problem in one model can spread to many products.
Companies that make such models must explain how they were built. They must respect copyright. They must also tell product builders what the model can and cannot do. The most powerful models face extra safety checks, much like the stricter inspections for the largest aircraft.
An example from practice
A European startup trains a multilingual language model and plans to offer it through an interface for developers. Its legal team confirms that the model is a GPAI model but that its training compute is well below 10^25 FLOP, so the systemic risk tier does not apply.
The startup prepares technical documentation covering data sources, training compute and evaluation results, publishes a training content summary on the official template, and adopts a copyright policy that honors machine-readable opt-outs during web crawling. It also writes an integration guide that lists known limitations, including weaker performance in low-resource languages.
When a hospital software vendor wants to use the model in a triage tool, the startup supplies its documentation. The vendor, not the startup, carries the high-risk system obligations for the triage product, and it can rely on the startup’s information to meet them.