GPAI (General Purpose AI)

AI models with a general purpose (significant general capability) – provider obligations under Art. 53–55 EU AI Act

26 April 2026 · Category: EU AI Act · Compliance-Kit

TL;DR

General Purpose AI (GPAI) within the meaning of Art. 3 no. 63 AI Act refers to AI models that, by virtue of their significant general capabilities, can be used for a variety of tasks. Examples: ChatGPT, Claude, Gemini, LLaMA. Provider obligations under Art. 53–55 have applied since 2 August 2025. Where there is systemic risk (more than 10²⁵ FLOPs of training compute): additional obligations under Art. 55.

Scope DE/AT: Applies equally in Germany and Austria (Regulation (EU) 2024/1689) — as a directly applicable EU regulation, the articles are identical in wording in both jurisdictions; no national implementation leeway.

What is GPAI (General Purpose AI)?

GPAI models are subject to three pillars of obligations under the GPAI Code of Practice (final version 10 July 2025):

Transparency: training data summary (Art. 53(1)(d)), model card, documentation for downstream providers
Copyright: EU copyright compliance, respecting opt-outs, robust internal policy
Safety & security (GPAI with systemic risk only): model evaluation, adversarial testing, incident reporting, cybersecurity

Threshold for 'systemic risk' (Art. 51(2)): more than 10²⁵ FLOPs of cumulative training compute (strictly > 10²⁵; the value of 10²⁵ itself does not yet trigger the presumption). At present (2026) this covers only frontier models (GPT-4 class, Claude Opus, Gemini Ultra).

Practical example

Practical consequence for SMEs as deployers of GPAI:

Using ChatGPT: you are a deployer, not a provider — no GPAI obligations directly
However: AI literacy under Art. 4 (mandatory since 02/2025)
For an Annex III use case (HR, recruitment = Annex III no. 4): high risk under Art. 6(2) — the additional high-risk obligations apply from 2 December 2027 (Art. 113 AI Act as amended by Regulation (EU) 2026/1744). Art. 6(1) (Annex I products) and the corresponding obligations apply from 2 August 2028.

Anyone building their own RAG systems on a GPAI API and distributing them under their own name: substantial modification → becomes a provider.

Frequently asked questions

Am I a GPAI provider if I integrate ChatGPT into our software?

No, provided you keep the OpenAI brand and use the model unchanged. You remain a deployer. In the case of re-branding or substantial modification: possibly a provider.

What is the GPAI Code of Practice?

A voluntary compliance framework recognised by the European Commission. Signing up creates a presumption of conformity for Art. 53–55. Published in final form on 10 July 2025 by the AI Office.

What obligations do I have as a GPAI user?

As a deployer: AI literacy + screening for prohibited practices + for Annex III (e.g. HR/recruitment under no. 4, high risk pursuant to Art. 6(2)) the high-risk deployer obligations from 2 December 2027 (checking the relevance of input data, logs, FRIA where applicable).