What is a general-purpose AI (GPAI) model?
A general-purpose AI (GPAI) model is the legal term the EU AI Act uses for an AI model that displays significant generality, competently performs many distinct tasks, and can be integrated into a variety of downstream systems. In practice the definition covers large language models and other foundation models. The Act regulates the model separately from the AI systems built on it, because one model can end up inside thousands of products.
A GPAI model is not itself an AI system under the Act. It becomes part of one when a company wraps it with an interface, a prompt, and a purpose. The company that builds that system is then its provider or deployer, with obligations set by the system’s risk classification.
GPAI models in the EU AI Act
Providers of GPAI models must maintain technical documentation covering training, testing, and evaluation, supply downstream providers with the information they need to understand the model’s capabilities and limits, adopt a policy to comply with EU copyright law, and publish a summary of the content used for training. Providers of models released under a free and open-source license, with weights and architecture publicly available, are exempt from the first two duties but still owe the copyright policy and the training summary.
A GPAI model with systemic risk carries additional duties. The Act presumes systemic risk when training compute exceeds 10^25 floating-point operations, and the European Commission can also designate models by decision. These providers must run model evaluations including adversarial testing, assess and mitigate systemic risks, report serious incidents to the AI Office, and protect the model with adequate cybersecurity. A voluntary code of practice gives providers a way to show compliance.
Why GPAI models matter
Most companies will never be a GPAI provider, but almost every company deploying generative AI depends on one. A machine-tool manufacturer that embeds a language model in its service software sells an AI system into the EU and needs the model provider’s documentation to complete its own technical file. A company that fine-tunes an open-weight model substantially enough may become the provider of a new GPAI model.
What to watch for
- Ask the model provider for the downstream documentation the Act requires and keep it with your own system records.
- Check the license of any open-weight model you deploy, because the open-source exemption covers the model provider’s duties and leaves your obligations as a system provider or deployer unchanged.
- Track how much you modify a model, since significant fine-tuning can shift provider obligations onto your company.
- Treat the GPAI rules as separate from the risk classification of your system, which is driven by its intended use.