The short answer: if you develop a general-purpose AI model — or fine-tune someone else’s so substantially that you effectively create a new one — the EU AI Act’s Chapter V obligations have applied to you since August 2, 2025: technical documentation, information for downstream developers, a copyright compliance policy, and a public summary of training content. Models with systemic risk (roughly: frontier-scale, trained above 10²⁵ FLOPs) carry a second, heavier tier. From August 2, 2026, the Commission’s AI Office can enforce this with fines of up to 3% of global turnover or €15 million.
Most AI startups are not GPAI providers — they build products on top of someone else’s model. But the line is blurrier than founders assume, and crossing it by accident is expensive. Here’s where the line is.
What counts as a GPAI model
A general-purpose AI model displays significant generality — it can competently perform a wide range of distinct tasks and can be integrated into many downstream systems. LLMs and large multimodal models are the paradigm cases. A narrow model that only detects invoice fraud is not GPAI; the foundation model it was distilled from probably is.
Three roles, three very different workloads:
| You are… | Example | Chapter V applies? |
|---|---|---|
| GPAI provider | You pre-train your own foundation model and release it (API, weights, or inside your product) | Yes — full obligations |
| Downstream fine-tuner | You fine-tune/LoRA an existing model for your vertical | It depends — see below |
| Pure consumer | You call OpenAI/Anthropic/Mistral APIs, prompt-engineer, RAG | No GPAI duties — but keep vendor documentation for your own compliance file |
The fine-tuning trap
The question we get weekly: «We fine-tuned an open model — are we now a GPAI provider?»
The working rule from the Commission’s GPAI guidelines (July 2025): a downstream actor becomes a provider when the modification is substantial — the guidelines’ indicative benchmark is training compute for the modification exceeding one third of the compute used to train the original model. Below that, you’re presumptively still a downstream user; above it, you’ve effectively placed a new general-purpose model on the market. Practical markers on each side:
- Usually not a provider: light fine-tuning on your task data, LoRA adapters, RAG, system prompts, quantisation — where the model stays a component inside your product and retains the upstream provider’s general capabilities unchanged.
- Risk zone: continued pre-training on large corpora, capability-changing modification, releasing your tuned model itself (weights or API) for others to build on, branding it as your model.
If you cross the line, obligations attach to the modification — the documentation, training-data summary and copyright policy cover your additional training, not the original model. And even if you stay out of the risk zone, your enterprise customers will ask whose Chapter V documentation covers the stack. Have an answer in writing.
The obligations, tier by tier
Tier 1 — every GPAI provider (since 02.08.2025):
- Technical documentation of the model (architecture, training process, evaluation) — kept current, available to the AI Office and downstream regulators on request.
- Information & documentation for downstream providers — enough for them to understand capabilities, limitations, and integrate compliantly.
- Copyright policy — a policy to comply with EU copyright law, including honouring text-and-data-mining opt-outs.
- Public training-content summary — using the AI Office’s template, published.
Open-source relief: models released under free/open licences with public weights and architecture are exempt from items 1–2 (not from copyright policy and training summary) — unless they’re systemic-risk models.
Tier 2 — systemic-risk models: presumption at training compute above 10²⁵ FLOPs (or Commission designation). Adds model evaluations and adversarial testing, systemic-risk assessment and mitigation, serious-incident reporting, and cybersecurity protections. If you’re here, you know it — and you have a compliance team already.
The Code of Practice: the cheap way to be presumed diligent
The GPAI Code of Practice (published July 2025, Commission-endorsed) operationalises Chapter V: transparency and copyright chapters for everyone, safety-and-security chapter for systemic-risk models. Signing and following it is voluntary — but it’s the recognised way to demonstrate compliance, and the major labs signed. For a startup that is a GPAI provider, adopting the Code’s templates is dramatically cheaper than inventing your own compliance framework.
Grandfathering note: models placed on the market before August 2, 2025 have until August 2, 2027 to come into compliance.
Enforcement reality check
From August 2, 2026 the AI Office can demand documentation, order mitigation, and fine GPAI providers up to €15M or 3% of worldwide turnover. (The 2026 Omnibus also consolidated supervision at the AI Office for AI systems built on a GPAI model by the same provider.) For everyone downstream, the practical exposure is contractual: EU enterprise buyers now ask which model powers your product and where its Chapter V paperwork lives. «It’s Llama-something we tuned once» is not an answer that closes deals.
What to do this month
- Classify yourself honestly (an hour): consumer / fine-tuner / provider, per model, in writing.
- If consumer: collect your vendors’ GPAI documentation links into your compliance file. Done.
- If fine-tuner: document what you modified, with what data and compute — that memo is your defence line on «substantial modification».
- If provider: adopt the Code of Practice templates; publish the training summary; stand up the copyright policy. Budget real engineering time for the documentation.
- Fold it into your wider 10-step AI Act checklist — GPAI is one lane of several, and the deadlines differ per lane.
FAQ
When did GPAI obligations start applying?
August 2, 2025. Pre-existing models have until August 2, 2027. Commission enforcement powers (fines) apply from August 2, 2026.
Does fine-tuning an open-source model make me a GPAI provider?
Usually not, if the modification is light and the model remains a component of your product. The Commission’s guidelines use an indicative threshold of one third of the original model’s training compute; substantial, capability-changing modification — especially if you release the resulting model — can make you a provider for the modification. Document your assessment.
We only use model APIs. Do we owe anything under Chapter V?
No GPAI duties. You still owe the rest of the Act where applicable (transparency, possibly high-risk), and you should keep your vendors’ GPAI documentation on file.
What is the systemic-risk threshold?
A presumption at more than 10²⁵ FLOPs of training compute, or Commission designation. It targets frontier-scale models.
What are the penalties for GPAI non-compliance?
Up to €15 million or 3% of global annual turnover, enforced by the Commission’s AI Office.