What are the four core GPAI provider obligations?

Technical documentation of the model and its training and testing, information for downstream providers integrating the model, a policy for complying with EU copyright law including TDM reservations, and a publicly available sufficiently detailed summary of training content.

Do non-EU GPAI providers need an EU representative?

Yes. Article 54 requires a provider established outside the Union to appoint, by written mandate, an authorised representative established in the Union before placing the model on the EU market.

Who enforces GPAI obligations?

The European AI Office within the Commission, rather than national market-surveillance authorities. It has exclusive powers to supervise and enforce the GPAI rules, including requesting documentation and evaluating models.

EU AI Act glossary · Operator roles· Art. 53–55

GPAI model provider

A GPAI model provider places a general-purpose AI model on the EU market. It must meet Articles 53–55: technical documentation, downstream information, a copyright policy, a training-data summary, and — for systemic-risk models — stricter testing and cybersecurity.

These obligations have applied since 2 August 2025. The Article 53 core is fourfold: keep and update technical documentation of the model including its training and testing process, make information available to downstream providers who integrate the model, put in place a policy to comply with Union copyright law including the text-and-data-mining reservation, and publish a sufficiently detailed summary of training content using the AI Office template. Non-EU GPAI providers must appoint an EU authorised representative under Article 54. Systemic-risk models add the Article 55 duties on top.

Where GPAI model provider sits in the Regulation

Art. 53
Art. 54
Art. 55

Who it binds

GPAI model provider: why it matters

The GPAI provider sits at the head of the supply chain, so its documentation is an input to everybody downstream: a company building a high-risk system on a foundation model cannot complete its own Annex IV file without it. Supervision is centralised in the AI Office, which means enforcement here is Commission-level rather than distributed across 27 national regulators. And because the copyright policy and training-data summary survive even the open-source relief, releasing weights publicly is not an exit from the regime.

Worked example

GPAI model provider in practice

A European startup fine-tunes an open-weights model on domain data and publishes the result under its own name for others to build on. It has placed a GPAI model on the EU market, so it needs its own technical documentation for the modification, a downstream information package, a copyright policy covering the fine-tuning corpus and a public training-content summary. Its compute is nowhere near 10²⁵ FLOP, so Article 55 does not apply — but Article 53 fully does.

Correction

GPAI model provider: the mistake people make

Assuming the GPAI regime and the AI system regime are alternatives. They stack. A company that both provides a model and ships a product built on it holds GPAI provider duties for the model and AI system provider duties for the product, with separate documentation for each.

Questions

GPAI model provider: common questions

What are the four core GPAI provider obligations?: Technical documentation of the model and its training and testing, information for downstream providers integrating the model, a policy for complying with EU copyright law including TDM reservations, and a publicly available sufficiently detailed summary of training content.
Do non-EU GPAI providers need an EU representative?: Yes. Article 54 requires a provider established outside the Union to appoint, by written mandate, an authorised representative established in the Union before placing the model on the EU market.
Who enforces GPAI obligations?: The European AI Office within the Commission, rather than national market-surveillance authorities. It has exclusive powers to supervise and enforce the GPAI rules, including requesting documentation and evaluating models.

Keep reading

GPAI model provider: terms that come up alongside it

General-purpose AI (GPAI) modelArt. 3(63)

The foundation-model category with its own obligation set under Articles 53 to 55.

Systemic risk (GPAI)Art. 51, 55

The compute-threshold tier that adds evaluation, incident and security duties to a GPAI model.

Training-data summaryArt. 53(1)(d)

The public summary of what a general-purpose model was trained on.

Authorised representativeArt. 22

The mandatory EU contact point a third-country provider must appoint before selling.

GPAI provider obligations

See how GPAI model provider applies to your systems

Run the free 2-minute EU AI Act checker — no sign-up.

Run the free check