Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Short answer: The EU AI Act regulates responsibilities at three connected layers: the general-purpose AI (GPAI) model, the AI system that incorporates that model, and the organization operating the system. A GPAI model provider must document the model, inform downstream system providers, maintain a copyright-compliance policy, publish a training-content summary, and cooperate with authorities. A downstream organization can separately be the AI-system provider and, when it uses the system, a deployer. One legal entity can hold more than one role, so a label such as “deployer” does not by itself remove model-provider or system-provider duties. GPAI provider obligations have applied since 2 August 2025, according to the European Commission.
What is the difference between a GPAI model provider, an AI-system provider and a deployer?
The decisive question is what the organization does, not what it calls itself. The Act attaches one set of duties to the model, another to an AI system built with that model, and another to the organization using the system. The same company can develop a model, integrate it into a product and use that product internally, creating several simultaneous roles.
As an Amazon Associate I earn from qualifying purchases.
The model layer
A GPAI model is a general-purpose model that can perform a broad range of tasks and can be integrated into different applications. Its provider is responsible for model-level information, documentation, copyright governance and, where applicable, systemic-risk controls. Those duties are concerned with how the model was developed, tested and made available to others.
The AI-system layer
An AI-system provider is the organization that develops, places on the market or puts an AI system into service under the circumstances covered by the Act. If that system incorporates a GPAI model, the system provider has its own obligations for the finished system. The model provider must give the downstream provider enough relevant information and cooperation for that organization to meet its obligations.
#1 Best Overall
The use layer
A deployer is an organization or person that uses an AI system under its authority. Deployer status is distinct from both model-provider and system-provider status. The full Article 26 deployer-duty list and the exact Article 25 circumstances that can make a downstream actor a provider should be checked against the current consolidated regulation for the facts of the case; they should not be inferred from a product label or an informal description of the business.
What obligations apply to general-purpose AI model providers?
Article 53 establishes the baseline duties for providers of GPAI models. The European Commission says these obligations entered into application on 2 August 2025. A provider should maintain an evidence package that can be supplied to the AI Office and national competent authorities and that can also support downstream customers.
Free tools Windows power users keep installed
One-click scans. No signup required.
1. Keep technical documentation current
The provider must draw up and keep current technical documentation covering the model’s training and testing processes and evaluation results. The documentation is for the AI Office and national competent authorities, so it should be sufficiently detailed to explain the development lifecycle, the methods used to evaluate capabilities and limitations, and the results obtained.
“Current” matters: a static launch document is not enough when later training, fine-tuning, safety changes or material model updates alter the model’s behavior. Version control, dated evaluation records and a clear connection between a released model version and its documentation make the duty auditable.
2. Give AI-system providers integration information
A GPAI provider must draw up, maintain and make available specified information and documentation to providers of AI systems that intend to integrate the model. The purpose is practical: a downstream provider needs to understand the model’s capabilities and limitations and to meet the AI Act duties that apply to its own system.
An effective information package normally identifies the supported modalities and tasks, known limitations, evaluation conditions, foreseeable misuse concerns, relevant performance boundaries and technical requirements for integration. The information should be tied to a model version and updated when a change could affect a downstream system’s risk assessment. The Act’s obligation is about making the specified information available; a commercial contract cannot simply erase it.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →3. Adopt a copyright-compliance policy
The provider must put in place a policy to comply with Union copyright and related-rights law. The policy must include identifying and respecting rights reservations made under the referenced copyright directive. This is a governance requirement, not a one-time statement that training data was lawful.
Operational controls should show how the provider identifies reservations, records decisions about data sources, handles notices and updates the policy as legal or technical practices change. The policy should be owned by a responsible function and connected to procurement, data-ingestion and model-release procedures.
4. Publish a sufficiently detailed training-content summary
The provider must make publicly available a sufficiently detailed summary of the content used for training, using the template provided by the AI Office. The summary is intended to give the public and affected stakeholders meaningful information about training content without requiring disclosure of every individual item in the corpus.
“Sufficiently detailed” does not mean a marketing description. A provider should identify the major categories and sources of training content in the structure required by the AI Office template, keep the publication aligned with the released model and update it when a new training run creates a materially different model.
5. Cooperate with authorities
The provider must cooperate as necessary with the Commission and national competent authorities. Cooperation can include supplying documentation, clarifying model behavior, responding to information requests and supporting investigations or corrective action. A provider that serves customers across the Union should assign an accountable contact and preserve the records needed to respond consistently.
Does a free and open-source GPAI model avoid Article 53 duties?
Only in a narrow respect. A GPAI provider can qualify for an exception from Article 53(1)(a) and (b)—the two documentation duties—when the model is released under a qualifying free and open-source licence and model parameters, including weights, architecture information and usage information, are publicly available.
The exception is not a blanket exemption from Article 53. It does not remove the copyright-compliance policy, the public training-content summary or the cooperation duty. It also does not apply to a GPAI model with systemic risk. A provider should therefore document why the licence and public-availability conditions are met and separately track every Article 53 duty that remains applicable.
What extra duties apply to a GPAI model with systemic risk?
Article 55 adds obligations for providers of GPAI models with systemic risk. These duties address risks that can affect people or systems across the Union rather than only the behavior of one customer’s application.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Model evaluation: evaluate the model with appropriate protocols and tools, including documented adversarial testing.
- Systemic-risk assessment and mitigation: assess possible systemic risks at Union level and take measures to mitigate them.
- Serious-incident handling: track and document serious incidents and report them, together with corrective measures, without undue delay.
- Cybersecurity: provide adequate protection for the model and its physical infrastructure.
These requirements call for repeatable processes rather than a single safety exercise. Adversarial tests should have documented scope, methods, findings and remediation. Incident records should connect the event to the affected model version, the response taken and any communication or correction. Cybersecurity controls need to cover both the model service and the facilities or hardware on which the model is developed or operated.
How do the Commission’s FLOP thresholds relate to systemic risk?
The Commission’s current explanatory material describes a presumption of systemic risk for training compute above 1025 floating-point operations (FLOP), while noting that the threshold is under review. The Commission’s scope guidance also describes GPAI models in its scope discussion as trained above 1023 FLOP and capable of generating language.
Rank #3
Those figures should be treated as current Commission explanations, not permanent, self-executing safe harbours. They are not empirical outcome statistics, and a compute estimate alone does not replace a case-specific legal assessment. Keep the date and version of the Commission material used for a classification decision, and recheck the threshold when the model or the guidance changes.
How do GPAI model obligations interact with downstream AI-system obligations?
The obligations are cumulative, not interchangeable. A model provider supplies model-level documentation and cooperation; the downstream AI-system provider evaluates and governs the completed system under the provisions that apply to that system. The downstream provider cannot assume that the model provider’s Article 53 work completes the system’s compliance.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat the model provider must supply
The model provider’s information and documentation should allow the system provider to understand the model’s capabilities, limitations, intended conditions and relevant risks. Cooperation is an express part of the relationship: the Commission says the model provider must cooperate with the downstream provider so that provider can meet its own AI Act obligations.
What the system provider must do independently
The system provider remains responsible for the system it develops or places into service. Integration choices, prompts, retrieval data, fine-tuning, interfaces, human oversight, monitoring and the system’s intended purpose can all affect the system’s legal classification and risk. Model documentation is evidence for that assessment, not a transfer of responsibility.
When one company occupies both roles
If a company develops a GPAI model and then integrates it into its own product, it can be both the GPAI model provider and the AI-system provider. It must satisfy the applicable Article 53 duties for the model and the applicable system-provider duties for the product. Internal separation of teams can help assign ownership, but it does not change the legal roles.
Who is a provider of an AI system?
The Commission’s Article 50 FAQ frames the provider as the organization that develops, places or puts an AI system into service under the relevant conditions. That framing is useful for an initial role map, but the exact facts matter: control over development, branding, deployment and material changes can affect the analysis.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesDo not use a vendor’s contract label as the sole answer. A company that starts with a third-party model may become the system provider through how it packages, modifies or offers the resulting system. The precise Article 25 reclassification test should be verified in the current consolidated provisions before making a compliance conclusion.
What does deployer status mean under the EU AI Act?
A deployer uses an AI system under its authority; it is not automatically the provider of the underlying GPAI model. A business can therefore deploy a system supplied by another provider without assuming the model provider’s Article 53 documentation duties.
The complete Article 26 duty list is not reproduced here because the applicable duties depend on the system, the use and the current legal text. Before relying on a deployer classification, review Article 26 and any applicable Commission interpretation for the specific system. Record the factual basis for the classification, the system provider’s identity, the intended use, the people responsible for operation and the controls used to supervise the system.
How can an organization map its roles and duties?
Use a role-and-version register rather than a single “AI owner” label. The following sequence keeps model, system and use questions separate.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Identify the model: record the GPAI model name, version, provider, release date, licence, modalities and whether the provider has classified it as systemic risk.
- Identify the model provider: determine which organization developed and makes the GPAI model available, and obtain its Article 53 information package, copyright policy statement and training-content summary.
- Describe the integrated system: document the system’s purpose, interface, data flows, fine-tuning or retrieval components, human controls and the organization placing it into service.
- Test system-provider status: examine who controls development, branding, release and material modifications. Apply the current Article 25 provisions rather than relying on a generic marketplace or reseller description.
- Test deployer status: identify every organization using the system under its authority and map the relevant Article 26 duties for that use.
- Assign evidence owners: give named teams responsibility for model documentation, system risk records, incident handling, user information, cybersecurity and supplier cooperation.
- Set review triggers: reassess roles after a new model version, fine-tuning, a change in intended purpose, a new user group, a major data-source change or a material incident.
GPAI provider versus AI-system provider or deployer: what changes?
| Question | GPAI model provider | AI-system provider or deployer |
|---|---|---|
| What is regulated? | Model-level development, documentation, information for downstream providers, copyright policy, training-content summary and systemic-risk duties where applicable. | The AI system and/or its use. Exact provider-versus-deployer duties depend on the system’s status and role and must be checked in the operative provisions. |
| Who receives the duties? | The model provider, with documentation for authorities and information for AI-system providers that intend to integrate the model. | The organization that develops, places or puts the system into service as provider, or uses it under deployer status, as applicable. |
| What is the key overlap? | A model provider can also integrate its model into an AI system and then have system-provider duties. | A downstream system provider still has its own duties; the model provider must cooperate and provide relevant information. |
| What is established here? | Article 53 baseline duties and Article 55 systemic-risk duties. | The Commission’s provider definition and Article 50 transparency framing; a complete Article 25 or Article 26 analysis requires verification of the current consolidated text. |
What should a GPAI model provider prepare for customers and authorities?
A practical compliance file can be organized around the legal duties while preserving the distinction between mandatory content and helpful operational detail.
- Model identity: version, release date, architecture description and change history.
- Training and testing record: processes, evaluation protocols, results, limitations and links between tests and released versions.
- Downstream information pack: capabilities, limitations, expected use conditions, integration requirements and known risks in a form system providers can use.
- Copyright policy: governance owner, rights-reservation handling, data-source controls and update history.
- Training-content summary: the public summary prepared with the AI Office template and a process for keeping it aligned with model releases.
- Authority-cooperation process: contacts, response procedures, document-retention rules and escalation paths.
- Systemic-risk annex, when applicable: adversarial-testing records, Union-level risk assessment, mitigation measures, serious-incident log, corrective actions and cybersecurity controls for the model and physical infrastructure.
This file should distinguish information intended for public release from confidential technical material supplied to authorities or downstream providers. It should also state the conditions under which a downstream provider may rely on an evaluation and when that provider needs to perform additional system-level testing.
What should an AI-system provider request from a GPAI vendor?
Before integrating a model, the system provider should request the current model version, the Article 53 information and documentation, the training-content summary, the copyright-policy description and any systemic-risk materials that apply. Ask how updates are announced, whether behavior can change without a version change, how incidents are reported and what cooperation the provider will give during a regulator or customer inquiry.
Put those requests and update obligations into the supplier arrangement, but do not treat a contract as a substitute for the statutory role analysis. If the vendor cannot supply information needed to assess the system, document the gap, evaluate whether the integration can proceed safely and legally, and consider a different model or a narrower use until the issue is resolved.
Recommended Free Tools
Is the GPAI Code of Practice mandatory?
No. The Commission presents the GPAI Code of Practice as a voluntary, adequate way for model providers to demonstrate compliance with the provider duties in Articles 53 and 55. The Commission’s Q&A states: “The Code of Practice only concerns the obligations in the AI Act for providers of general-purpose AI models.”
The Code does not create a new set of AI-system-provider or deployer obligations. A provider that does not use the Code still needs to comply with the binding regulation and should be able to demonstrate compliance by other means. Conversely, signing or following the Code does not eliminate the downstream system provider’s separate assessment.
Are the Commission’s GPAI guidelines legally binding?
No. The Commission states: “These guidelines are not legally binding.” They explain the Commission’s approach to scope and obligations, and the Commission says it will base enforcement on the guidelines, but only the Court of Justice of the European Union can give an authoritative interpretation of Union law.
Use the guidelines as an important compliance aid, preserve the version and date relied upon, and obtain a case-specific legal assessment where classification is uncertain. The binding regulation and its current consolidated text remain the starting point for a formal conclusion.
When did the GPAI obligations start, and what should teams check in 2026?
| Date or status | Practical meaning |
|---|---|
| 2 August 2025 | The European Commission states that GPAI provider obligations entered into application on this date. |
| 27 July 2026 consolidation date | The service-desk Article 53 material identifies the consolidated AI Act text on which its explanation is based. Confirm that the text has not changed before relying on a legal conclusion. |
| Under review | The Commission’s explanation of the more-than-1025-FLOP systemic-risk presumption says the threshold is under review. |
| Ongoing | Commission scope guidance and the GPAI Code of Practice can be updated; neither replaces the regulation or a fact-specific assessment. |
For a 2026 compliance review, record the exact consolidated regulation, Commission guidance and Code version used. Recheck them after a material model release, a new Commission publication or a change in the model’s compute classification.
What are the most common role-mapping mistakes?
- Calling every downstream user a model provider: using a model does not by itself make the user the GPAI provider.
- Calling every model provider a deployer: deployment is a separate use role and must be established from the facts.
- Treating documentation as a transfer of liability: the model provider’s file helps the system provider but does not complete the system’s obligations.
- Assuming open source removes all duties: the exception covers only the two specified documentation duties and excludes systemic-risk models.
- Using FLOP figures as permanent thresholds: the Commission describes them as guidance, and the systemic-risk threshold is under review.
- Calling the Code mandatory: the Commission characterizes it as voluntary.
- Using Article 25 or Article 26 from memory: provider reclassification and deployer duties depend on the current legal text and the particular system.
- Leaving supplier cooperation informal: without versioned information, update notices and incident contacts, a downstream provider may be unable to show how it assessed the system.
What should an organization do now?
Start with a written inventory that separates each GPAI model, each integrated AI system and each organization that uses the system. For every model, obtain and version the Article 53 materials; for systemic-risk models, add the Article 55 evidence. For every system, perform a separate provider-versus-deployer analysis under the current Articles 25 and 26, document the assumptions and assign owners for updates, incidents and authority requests.
The governing principle is layered accountability: model-level compliance supports, but does not replace, system-level and use-level compliance. Treat Commission guidance and the voluntary Code as practical aids, keep their dates visible, and escalate uncertain role classifications for authoritative legal verification.
Frequently Asked Questions
Does accessing a GPAI model through an API make my company a GPAI provider?
API access alone does not automatically transfer the model-provider role to the customer. The customer may still become an AI-system provider through how it develops, brands or places an integrated system into service, so the facts and the current Article 25 test must be examined.
Must an open-source GPAI provider publish a training-content summary?
Yes, the open-source exception described for qualifying licences concerns only the two Article 53 documentation duties. The copyright policy and public training-content summary remain separate obligations, and systemic-risk models do not receive that documentation exception.
Can one legal entity hold model-provider, system-provider and deployer roles at the same time?
Yes. For example, a company can release a GPAI model, build a customer-facing application with it and use that application for its own operations. Keep separate evidence and accountable owners for each role so that one role’s controls are not mistaken for another’s.
What should we do if a model supplier will not provide the information needed for our system assessment?
Record the missing information and the requests made, then determine whether the system can be assessed and operated lawfully without it. The gap may require narrowing the use, selecting another model or seeking advice from the competent authority or qualified counsel before deployment.
Are the Commission’s FLOP thresholds fixed forever?
No. The Commission describes the more-than-10^25-FLOP figure as a current presumption of systemic risk and says the threshold is under review. Preserve the date of the guidance used and reassess the classification when the Commission updates its explanation or the model’s training profile changes.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
