GPAI models: what are they and who counts as a provider?

GPAI (General-Purpose AI) is the AI Act's category for models trained at scale and capable of performing very different tasks: LLMs like GPT, Claude, Gemini or Llama are the typical example. The regulation dedicates a specific chapter to their providers (the companies that build the model): technical documentation, information for those integrating the model downstream, a copyright policy, a summary of training data, and additional obligations for systemic-risk models. These obligations are enforceable from 2 August 2026, with fines of up to 3% of global turnover or 15 million euros. The GPAI category exists to separate these "generalist" models from vertical AI systems built for one specific task (a medical image classifier, a recommendation engine), which stay under the AI Act's generic regime without the dedicated chapter. For models classified as systemic risk, those above a certain training compute threshold, additional safety evaluations and cybersecurity obligations apply: a distinction that matters mostly for the big labs, but one any company integrating these models still needs to understand.

See also: AI Act · The EU's risk-based AI regulation: transparency, GPAI rules and sanctions apply from 2 August 2026, with high-risk duties partly postponed.

Provider or deployer: which one are you really

This is where most companies trip up. If you use GPT or Claude via API, or a commercial copilot, you are a deployer: light obligations (transparency, AI literacy), no GPAI provider duties. Building a RAG application on top of someone else's model does not make you a provider. You can become one, though: if you put a model on sale under your own name or brand, or if you take an open-source model, modify it substantially (for instance with significant fine-tuning) and distribute it, provider obligations can shift to you. The line between "customization" and "new model" has to be assessed case by case, and it is the right question to ask before publishing a fine-tuned model, not after.

What to do with your stack

Three concrete moves. First, map where GPAI enters your stack: direct APIs, commercial copilots, self-hosted open-source models, AI features inside SaaS you already use. Second, demand from your vendors the documentation the AI Act imposes on them: you need it for your own audits and to answer your customers. Third, if you fine-tune, keep a register of derived models (base model, datasets, versions, where they are deployed): healthy MLOps practice that doubles as compliance evidence. The practical risk is not a fine tomorrow morning: it is discovering you became a provider without knowing it.

This entry is informational and does not constitute legal advice: for decisions on regulated data, involve your DPO or legal counsel.