Guidelines on the scope of the obligations for providers of general-purpose AI models established by Regulation (EU) 2024/1689 (AI Act)
On July 18, the European Commission (“Commission”) published Guidelines on the scope of obligations for providers of general-purpose AI (GPAI) models under the AI Act[1]. The aim is to clarify key provisions of the EU AI Act applicable to GPAI models, in light of their imminent entry into application on 2 August 2025. The Guidelines are complementary to other documents from the broader enforcement package: the Code of Practice and the Template for the summary of training data.
While not legally binding, these guidelines set out the Commission’s interpretation and application of the AI Act, which will guide its enforcement actions. Therefore, they should facilitate providers’ compliance with their obligations and contribute to the effective implementation of the AI Act.
These guidelines clarify the scope of the obligations and to whom they apply, focusing on four key topics:
- General-purpose AI (GPAI) models
- Providers of GPAI models
- Exemptions from certain obligations
- Enforcement of obligations
Definition of GPAI models
This section of the guidelines focuses on the concept of a ‘GPAI model’. It clarifies when the Commission considers a model to be a GPAI model by providing an indicative criterion.[2]
When is a model a GPAI model?
Article 3(63) AI Act defines a ‘general-purpose AI model’ as ‘an AI model, including where such an AI model is trained with a large amount of data using self- supervision at scale, that displays significant generality and is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market and that can be integrated into a variety of downstream systems or applications, except AI models that are used for research, development or prototyping activities before they are placed on the market’.
This definition lists, in a general manner, factors that determine whether a model is a GPAI model. In order to limit the burden on the many actors that must assess whether they are providers of GPAI models, the Guidelines set out specific criteria for this assessment.
As it is not feasible to provide a precise list of capabilities that a model must display and tasks that it must be able to perform, the Commission’s approach to determine whether it is a GPAI model is based on the amount of computational resources used to train the model (‘training compute’), measured in FLOP as well as the modalities of the model, as an indicative criterion. Training compute is understood as a measure combining the model size (number of parameters) and the number of training examples (training dataset size) into a single number.
Based on the considerations above, the Guidelines expand on the statutory definition of GPAI models in the AI Act, introducing key thresholds and criteria for classification.
Compute threshold
An indicative criterion for a model to be considered a GPAI model is that its training compute is greater than 1023 FLOP, and it can generate language (whether in the form of text[3] or audio[4]), text-to-image, or text-to-video.[5]
This threshold corresponds to the approximate amount of compute typically used to train a model with one billion parameters on a large amount of data. While such models may be trained with varying amounts of compute depending on how much data is used, 1023 FLOP is typical for models trained on large amounts of data (the examples in Annex A.3).
Functional generality requirement
If a GPAI model meets the criterion regarding the compute threshold but, exceptionally, does not display significant generality or is not capable of competently performing a wide range of distinct tasks, it is not a GPAI model. Similarly, if a GPAI model does not meet that criterion but, exceptionally, displays significant generality and is capable of competently performing a wide range of distinct tasks, it is a GPAI model.[6]
For example, models that exceed the 10²³ FLOPS threshold but are specialised (e.g., for transcription, image upscaling, weather forecasting, or gaming) are excluded if they lack general capabilities across a broad range of tasks.
The lifecycle of a GPAI model
The iterative and interlinked process through which a provider may develop a ‘model’, for example, through techniques such as distillation, quantisation, or merging of model weights, makes it difficult to clearly delineate a model and its lifecycle. In light of this challenge, the Commission understands the notion of ‘model’, and consequently its ‘lifecycle’, in a broad sense.
In practice, the Commission considers the lifecycle of a general-purpose AI model to begin at the start of the large pre-training run.[7] Any subsequent development of the model downstream of this large pre-training run performed by the provider or on behalf of the provider, whether before or after the model has been placed on the market, forms part of the same model’s lifecycle rather than giving rise to new models.
Different considerations apply if another actor modifies the model (Section 3.2).
Lifecycle-wide obligations under the AI Act include:
The documentation required under Article 53(1), points (a) and (b) of the AI Act must be drawn up for each model placed on the market and kept up to date throughout its entire lifecycle.
The copyright policy required under Article 53(1), point (c) of the AI Act must be applied throughout the entire lifecycle of each of the provider’s relevant models. Providers may choose to develop one policy and apply it to all their relevant models.
The summary of the content used for training required under Article 53(1), point (d) of the AI Act must be drawn up and made publicly available for all the provider’s models placed on the market.
The systemic risk assessment and mitigation required under Article 55(1) of the AI Act must be carried out continuously for each model throughout its entire lifecycle.
When is a GPAI model a GPAI model with systemic risk?
‘GPAI models with systemic risk’ form a special class of GPAI models. Providers of such models are subject to additional obligations concerning the assessment and mitigation of the ‘systemic risks’ presented by these models, under Articles 52 and 55 of the AI Act. The AI Act defines a ‘systemic risk’ as ‘a risk that is specific to the high-impact capabilities of GPAI models, having a significant impact on the Union market due to their reach, or due to actual or reasonably foreseeable negative effects on public health, safety, public security, fundamental rights, or the society as a whole, that can be propagated at scale across the value chain’ (Article 3(65) AI Act).
Classification
Under Article 51(1) AI Act, a GPAI model is classified as a GPAI model with systemic risk if it meets either of the following two conditions:
- it has ‘high-impact capabilities’, namely ‘capabilities that match or exceed those recorded in the most advanced models’ (Article 3(64) AI Act);
- based on a decision of the Commission, ex officio or following a qualified alert from the scientific panel, it has capabilities or an impact equivalent to those set out in the preceding point, having regard to the criteria set out in Annex XIII.
From the moment when a GPAI model meets either of the two conditions above, the model is classified as a GPAI model with systemic risk and its provider must comply with the relevant obligations.
Automatic presumption: Based on FLOPS threshold
Whether a given GPAI model has high-impact capabilities should be ‘evaluated based on appropriate technical tools and methodologies, including indicators and benchmarks“, under Article 51(1), point (a) of the AI Act. These tools and methodologies are to be further specified by the Commission through the adoption of delegated acts. Notwithstanding future adoption of such delegated acts, Article 51(2) AI Act states that a GPAI model is ‘presumed to have high-impact capabilities pursuant to paragraph 1, point (a), when the cumulative amount of computation used for its training measured in floating point operations is greater than 1025.’ This is because the cumulative amount of computation used for the training of a GPAI model (‘cumulative training compute’), measured in FLOP is considered to be a relevant metric for identifying high-impact capabilities.
Notification
When a GPAI model has met, or it becomes known that it will meet a requirement leading to the presumption that the model has high-impact capabilities, the provider must notify the Commission in line with Article 52(1) AI Act. The notification must happen ‘without delay and in any event within two weeks after that requirement is met or it becomes known that it will be met’ (Article 52(1) AI Act).
In particular, a notification may be required before training is complete if the provider can reasonably foresee that the requirement that leads to the presumption of the model having high-impact capabilities is reasonably likely to be met. Since the ‘planning’ and ‘upfront allocation of compute resources’ take place before the start of the large pre-training run, providers should estimate the cumulative amount of training compute that they will use before starting this run (Annexes A.1 and A.2 to these guidelines).
Procedure for contesting classification
When a provider notifies the Commission under Article 52(1) AI Act, they ‘may present, with its notification, sufficiently substantiated arguments to demonstrate that, exceptionally, although it meets that requirement, the general-purpose AI model does not present, due to its specific characteristics, systemic risks and therefore should not be classified as a GPAI model with systemic risk’ (Article 52(2) AI Act). The Guidelines regulate the procedure for contesting classification in detail in paragraphs 34 to 42.
Discretionary Designation
In addition to the above mechanism whereby a GPAI model is classified as a GPAI model with systemic risk through having high-impact capabilities, the AI Act also lays down a designation mechanism. Specifically, under Article 52(1), Article 51(1), point (b), and Article 52(4) AI Act, the Commission may designate a GPAI model as a GPAI model with systemic risk on its own initiative (ex officio) or following a qualified alert from the scientific panel, as provided for in Article 90(1), point (a) of the AI Act.
The designation can occur:
- under Article 52(4) AI Act, if the Commission concludes that a model has capabilities or an impact equivalent to high-impact capabilities based on the criteria set out in Annex XIII AI Act, or
- under Article 52(1) AI Act, if the provider of a general-purpose AI model meeting the condition referred to in Article 51(1), point (a), AI Act failed to notify the Commission, in breach of its obligation under Article 52(1) AI Act. In this case, the provider may be fined under Article 101 AI Act.
In both cases, the provider must comply with the obligations for providers of GPAI models with systemic risk from the moment the model is classified as a GPAI model with systemic risk. In the first case, this is the moment when it is informed of the designation decision. In the second case, this is the moment when the model meets the condition laid down in Article 51(1), point (a) of the AI Act.
Procedure for contesting designation
Under Article 52(5) AI Act, providers of GPAI models that have been designated by the Commission as GPAI models with systemic risk under Article 52(4) AI Act may, at the earliest six months after designation, submit a reasoned request for the Commission to reassess the designation. In doing so, they should provide ‘objective, detailed and new reasons that have arisen since the designation decision’ for why their model no longer presents systemic risks (Article 52(5) AI Act). Where the designation is maintained by the Commission following its reassessment, providers may request a further reassessment at the earliest six months after that decision.
Providers placing on the market general-purpose AI models
This section of the guidelines focuses on the concepts of the ‘provider’ and ‘placing on the market’ of a general-purpose AI model. It aims to offer clarity on when an actor along the AI value chain must comply with the obligations for providers of general-purpose AI models under the AI Act.[8]
When is an actor a provider placing on the market a general-purpose AI model?
In accordance with Article 3(3) of the AI Act, a ‘provider of a GPAI model’ is
- a natural or legal person, public authority, agency or other body
- that develops a GPAI model or
- that has a GPAI model developed and places it on the market under its own name or trademark, whether for payment or free of charge.
In turn, Article 3(9) AI Act defines a ‘placing on the market’ of a GPAI model as ‘the first making available of a GPAI model on the Union market’, while Article 3(10) AI Act defines the ‘making available on the market’ of a GPAI model as ‘the supply of a GPAI model for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge’.
In line with Article 2(1), point (a), AI Act, an actor that places a GPAI model on the Union market may become the provider of that GPAI model and be subject to the obligations for providers of GPAI models under the AI Act ‘irrespective of whether they are established or located within the Union or in a third country’. To facilitate compliance, providers established or located within a third country must appoint an authorised representative established in the Union before placing a model on the Union market (Article 54 AI Act).
Recital 97 AI Act further clarifies that ‘GPAI models may be placed on the market in various ways, including through libraries, application programming interfaces (APIs), as direct download, or as a physical copy.’
Examples of placing on the market of GPAI models
The Guidelines list examples giving insights into when a GPAI model should be considered to be placed on the market, building on the examples given in recital 97 AI Act:
- a GPAI model is made available for the first time on the Union market via a software library or package; via an application programming interface (API); as a physical copy; via a cloud computing service; or by being copied onto a customer’s own infrastructure;
- a GPAI model is uploaded for the first time to a public catalogue, hub, or repository for direct download on the Union market;
- a GPAI model is integrated into a chatbot made available for the first time on the Union market via a web interface or into a mobile application made available for the first time on the Union market via app stores;
- a GPAI model is used for internal processes that are essential for providing a product or service to third parties or that affect the rights of natural persons in the Union.
In addition, the Guidelines describe special cases in which a GPAI model that is integrated into an AI system should be considered to have been placed on the market (according to recital 97 AI Act).
Upstream and downstream responsibility allocation
According to recital 97 AI Act, ‘AI models are typically integrated into and form part of AI systems’. Furthermore, ‘[the] rules for general-purpose AI models and for general-purpose AI models that pose systemic risks, … should apply also when these models are integrated or form part of an AI system.’
- An upstream actor is the provider of GPAI model and must meet GPAI provider obligations when:
- integrates its own model into its own AI system that is made available on the market or put into service (that model should be considered to be placed on the market and, therefore, the obligations in this Regulation for models should continue to apply in addition to those for AI system), according to Article 97 AI Act,
- develops or has developed a GPAI model and makes the model available for the first time to a downstream actor on the Union market (the model should be considered to have been placed on the market)
- The downstream actor integrating the model into an AI system and placing the system on the Union market or putting it into service in the Union may be the provider of the system, and in this case, has to comply with the applicable requirements and obligations for AI systems laid down in the AI Act.
When an upstream actor develops or has developed a GPAI model and makes the model available for the first time to a downstream actor outside the Union market, and the downstream actor integrates the model into an AI system, which it places on the Union market or puts into service in the Union:
- the upstream actor should then be considered the provider of the model (unless the upstream actor has excluded, in a clear and unequivocal way, the distribution and use of the model on the Union market, including its integration into AI systems that are intended to be placed on the Union market or put into service in the Union),
- if the upstream actor has done this, the downstream actor that integrates the model into a system and places the system on the Union market or puts it into service in the Union should be considered the provider of the model.
Downstream modifiers as providers of GPAI models
According to recital 97 of the AI Act, GPAI models may be modified or fine-tuned into new models. In particular, downstream actors may modify a GPAI (with or without integrating it into an AI system). Nevertheless, the AI Act does not specify the conditions under which downstream modifiers should be considered the providers of the modified GPAI models.
The Commission deems that it is not necessary for every modification of a GPAI model to lead to the downstream modifier being considered the provider of the modified GPAI model, but only if the modification leads to a significant change in the model’s generality, capabilities, or systemic risk.
Threshold for reclassification:
A downstream actor becomes the new GPAI provider if the training compute used for the modification exceeds one-third of that used to train the original model:
- ≥ 1/3 of 10²³ FLOPS for all GPAI models
- ≥ 1/3 of 10²⁵ FLOPS for GPAI models with systemic risk
Scope of obligations:
Only modification-specific obligations apply: documentation, training data summary, and copyright policy relate only to the additional compute and data. However, if modifying a systemic-risk GPAI model, the downstream actor must comply fully with all systemic risk obligations, including notification to the Commission.
Exemptions from certain obligations for certain models released as open-source
Articles 53(2) and 54(6) AI Act lay down exemptions from some of the obligations for ‘providers of AI models that are released under a free and open-source licence that allows for the access, usage, modification, and distribution of the model, and whose parameters, including the weights, the information on the model architecture, and the information on model usage, are made publicly available’ as long as the model is not a GPAI model with systemic risk. This section of the Guidelines first describes the obligations to which these exemptions apply, and then clarifies the conditions that must be fulfilled for these exemptions to apply.[9]
Scope of the exemptions
No obligation to provide documentation to downstream providers or, upon request, to the AI Office or national authorities.
Non-exempt requirements:
Must comply with training data summary and copyright policy requirements.
If designated as a GPAI model with systemic risk, they must fully meet all applicable obligations, including systemic risk management, model evaluations, incident reporting, and cybersecurity.
Conditions for the exemptions to apply
To qualify as open source under the AI Act, the model must be released under a free and open-source licence. Recital 102 AI Act clarifies that the licence must allow the model to be ‘openly shared’ and users to be able to ‘freely access, use, modify and redistribute’ the model‘ or modified versions thereof’. In the following, the Commission stated the relevant interpretation of the terms: access, usage, modification and distribution.
Examples of restrictions that would disqualify a licence from meeting these criteria include:
- non-commercial or research-only use
- prohibitions on distributing the model or its components
- usage restrictions triggered by user scale thresholds
- requirements to obtain separate commercial licences for specific use cases.
Permissible restrictions
Users can use, modify, and distribute general-purpose AI models under free and open-source licences, in compliance with the terms and conditions of the licence. These can include:
- crediting the original creators,
- respecting the terms of distribution,
- and making any modifications or improvements available under the same or comparable licence terms.
- reasonable and proportionate safeguards against high-risk use (e.g., public safety), provided they are non-discriminatory
Lack of monetisation
As clarified by recital 103 AI Act, in order for the exemptions to apply, no monetary compensation should be required in exchange for access, use, modification, and distribution of the AI model. In this context, monetisation should be understood not only as the provision of the model against a price but also as other types of monetisation strategies. The following are scenarios that the Commission considers to be forms of monetisation:
- dual-licensing (e.g., free for academic use, paid for commercial use)
- pay-to-access support, maintenance, or updates
- hosted access subject to fees or
- advertising revenue.
By contrast, the following are scenarios that the Commission would not consider, for the purposes of applying the exemptions, to be forms of monetisation:
- the model is provided together with paid services that do not affect the usability or free usage of the model and that are purely optional.
- paid services or support are made available alongside the model, without any purchase obligation, as long as the model’s usage and free and open access are guaranteed (such as premium versions of the model with advanced features or additional tools, update systems, extensions, or plug-ins that help users work with the open-source model or extend its functionality).
Enforcement of obligations
The guidelines explain the implications for providers of general-purpose AI models that choose to adhere and implement the General-Purpose AI Code of Practice, and outline Commission expectations regarding compliance as from 2 August 2025.[10]