On July 18, 2025, the General-Purpose Artificial-Intelligence (GPAI) guidelines were released by the European Commission pursuant to the EU Artificial Intelligence Act (Act), which took effect on August 1, 2024.
While these guidelines are not legally binding, they reflect how the European Commission interprets the Act and provide guidance for future enforcement actions and compliance expectations.
Ronin Legal examines these guidelines and their implications for GPAI providers.
What Qualifies As GPAI
Article 3(63) of the EU AI Act defines GPAI as a model trained on large-scale data using self-supervision. These models show broad capabilities and can handle a wide range of tasks. The model’s use is not limited by how it is placed on the market and can be integrated into many different systems and applications.
Models used only for research, development, or prototyping before market placement are excluded from this definition.
Technical Thresholds
A model qualifies as GPAI if its training compute exceeds 10^23 FLOP and has the ability to generate language, text-to-image, or text-to-video outputs.
Models with training compute exceeding 10^25 FLOP are presumed to have systemic risk, triggering enhanced obligations. The Commission can also designate models as systemically risky on its own initiative or following alerts from the scientific panel.
Who Must Comply
The guidelines cover four key areas: what qualifies as a GPAI model, who is considered a provider placing such models on the market, which providers may be exempt from certain obligations, and how providers must comply with the Act’s requirements.
The AI Act applies to any actor that places a GPAI model on the EU market, regardless of whether they are based within the Union or in a third country. Providers located outside the EU must appoint an authorized representative established within the EU before placing their model on the market.
Timeline and Enforcement
Obligations for GPAI providers will apply starting August 2, 2025. The European Commission, through the AI Office, is responsible for supervising, investigating, enforcing, and monitoring compliance.
Providers who have already placed GPAI models on the EU market before August 2, 2025, have a grace period and must become fully compliant by August 2, 2027. This obligation applies across the model’s entire lifecycle.
Standard GPAI Obligations
All GPAI providers must meet baseline requirements throughout the model lifecycle:
- Maintain and update documentation required under the Act
- Apply copyright policy to each relevant model (providers may adopt a single policy across all models)
- Create a publicly available summary of content used during training
- Conduct risk assessments and implement mitigation measures
- Apply governance-related risk controls
GPAI providers must also maintain technical documentation, share relevant information with downstream providers, and make documentation available to the AI Office and national authorities.
Enhanced Obligations for Systemic Risk Models
Providers of GPAI models with systemic risks must meet enhanced responsibilities. They must continuously assess and mitigate systemic risks, taking appropriate measures throughout the model’s lifecycle. Additionally, cybersecurity protection and physical security must be ensured.
Models meeting the systemic risk threshold trigger additional obligations:
- Notify the Commission within two weeks of meeting the threshold
- Notify the Commission before completing training if the provider can reasonably foresee the model will meet the criteria (within 2 weeks of such estimation)
- If the estimated value does not meet the threshold, closely monitor actual compute usage
Providers can submit supporting arguments if they believe their model does not present systemic risks despite meeting the threshold. If the Commission designates a model as systemically risky on its own initiative, providers can challenge the decision by filing a reasoned request for reassessment within six months.
Market Placement Scenarios
“Placing on the market” refers to making a GPAI model available within the EU for distribution or use as part of a commercial activity. The guidelines address different scenarios:
Upstream Provider
Upstream Provider refers to the entity or system that creates and supplies the foundational AI models.
When a GPAI model is developed by an upstream actor and made available for the first time to a downstream actor on the EU market, the upstream actor qualifies as the provider and must comply with GPAI obligations.
Downstream Provider
Downstream provider means a provider, which integrates an AI model, regardless of whether the AI model is provided by themselves or provided by another entity. If a downstream actor integrates a model into an AI system and places that system on the Union market, the downstream actor becomes the provider. However, a downstream actor is only deemed the provider of a modified GPAI model if changes substantially impact the model’s generality, capabilities, or systemic risk.
Third Country Scenarios
When a GPAI model is first made available to a downstream actor outside the EU, the upstream actor is generally treated as the provider if that downstream actor later brings the system into the EU. However, if the upstream actor explicitly excludes the model’s distribution or use in the EU, the downstream actor becomes the provider.
Looking Ahead
These guidelines help harmonize GPAI providers’ obligations under the Act. Providers of GPAI models who choose not to follow a code of practice assessed as adequate must demonstrate full compliance with Chapter V of the AI Act and explain how their chosen measures achieve compliance. This route may increase regulatory scrutiny, as the absence of a standardized code of practice makes it harder for the AI Office to assess compliance. For organisations navigating this complex legal terrain, partnering with an experienced AI law firm can provide critical insight into regulatory expectations and risk mitigation strategies under the EU AI Act.
Authors: Shantanu Mukherjee, Alan Baiju, Akshara Nair
