GPAI Compliance: Template for General-Purpose AI per Art. 53-55

Main article: GPAI provider obligations — who is a provider, which obligation applies from when, who supervises and which fining provision applies. This page shows what goes into the individual documents. The EU AI Act Guide gives the overview of the entire AI Regulation, and all articles on the topic can be found in the EU AI Act topic hub.

Who needs these documents

Under Art. 3(63) AI Act, a general-purpose AI model is a model that displays significant generality, is capable of competently performing a wide range of distinct tasks and can be integrated into a variety of downstream systems. Models used for research, development or prototyping activities before they are placed on the market are excluded — the exception is contained in the definition itself.

The documents are drawn up by the provider of the model: whoever develops it or has it developed and places it on the market under its own name or trademark (Art. 3(3) AI Act). Whoever uses an AI system under its own authority in a professional capacity, including a general-purpose AI system (Art. 3(66)) based on a third-party model, is a deployer (Art. 3(4)) and does not draw up these documents. Whoever builds the model into its own AI system is a downstream provider (Art. 3(68)) and the recipient of the information package under Annex XII. When a use turns into the provider role is clarified in section 1 of the obligations article.

The documents at a glance

Technical documentation under Annex XI

Art. 53(1)(a) AI Act requires the provider to draw up and keep up to date the technical documentation, including the training and testing process and the results of the evaluation. Annex XI, Section 1 sets out the minimum content, as appropriate to the size and risk profile of the model. As a checklist:

• General description (point 1): tasks of the model and the type of AI systems into which it can be integrated; acceptable use policies; date of release and methods of distribution; architecture and number of parameters; modality and format of inputs and outputs; licence
• Integration (point 2(a)): technical means such as instructions of use, infrastructure and tools
• Design and training (point 2(b)): design specifications, training methodologies and techniques, key design choices including rationale and assumptions
• Data (point 2(c)): type and provenance of the training, testing and validation data, curation, number of data points, scope, selection and methods to detect biases
• Computational resources and energy (point 2(d) and (e)): computational resources, such as the number of floating-point operations, training time, and the known or estimated energy consumption, alternatively derived from the computational resources

The technical documentation is not published. It is made available to the AI Office and the competent national authorities upon request; everything these bodies receive is subject to the confidentiality obligations of Art. 78 (Art. 53(7)). The Transparency chapter of the Code of Practice provides the Model Documentation Form for this purpose, which indicates for each field whether the information is intended for downstream providers, the AI Office or national authorities. Signatories also commit to keeping earlier versions for ten years after the model has been placed on the market (Measure 1.1).

Information package for downstream providers under Annex XII

Under Art. 53(1)(b) AI Act, the model provider draws up and keeps up to date information for providers who intend to integrate the model into their AI systems. They should be able to have a good understanding of the capabilities and limitations of the model and to comply with their own obligations; trade secrets remain protected. Minimum content under Annex XII:

• tasks of the model and the type of AI systems into which it can be integrated; acceptable use policies; date of release and methods of distribution
• where applicable, interaction with hardware or software that is not part of the model itself, and the versions of relevant software
• architecture, number of parameters and licence
• technical means for integration
• modality, format and maximum size of inputs and outputs, such as the length of the context window
• where applicable, type, provenance and curation of the training, testing and validation data

The Act sets no delivery deadline. Signatories of the Code of Practice publish contact details for requests and provide additional information that downstream providers need for integration no later than 14 days after receipt of the request, save for exceptional circumstances (Transparency chapter, Measure 1.2). This is a voluntary commitment, not a statutory deadline.

Copyright policy under Art. 53(1)(c)

The Act requires a policy to comply with Union law on copyright and related rights, in particular to identify and comply with a reservation of rights under Art. 4(3) of Directive (EU) 2019/790, including through state-of-the-art technologies. Where rightholders have reserved text and data mining in a machine-readable way, the provider must recognise and respect this. The Act prescribes no structure; the Copyright chapter of the Code of Practice provides one that works as a checklist:

• a policy in a single document, with assigned responsibilities (Measure 1.1)
• only lawfully accessible content: no circumvention of effective technological protection measures such as paywalls, exclusion of websites that courts or authorities in the EU and the EEA have recognised as persistently and repeatedly infringing on a commercial scale (Measure 1.2)
• crawlers that read and follow robots.txt in accordance with RFC 9309, as well as other appropriate machine-readable reservation protocols; public information on the crawlers used (Measure 1.3)
• technical safeguards against infringing outputs and a prohibition of infringing use in the terms of use (Measure 1.4)
• a point of contact and an electronic complaints mechanism for rightholders (Measure 1.5)

This list is a content structure on this page and not part of a kit.

Training data summary under Art. 53(1)(d)

The summary of the training content is the only one of the four core documents that is published. It follows the template that the Commission published on 24 July 2025 as an explanatory notice and template. The obligation also applies to providers of open-source models, because the exception in Art. 53(2) covers only points (a) and (b). The template has three parts:

1. General information: provider, model and model versions, date of placing on the market, modalities and size of the training data, latest data collection date, languages
2. Data sources: publicly available datasets (large ones named individually), licensed and other private third-party datasets, data crawled by the provider itself with crawler, collection period and list of the most relevant domain names, user data, synthetic data, other sources
3. Data processing: measures to respect reservations of rights in text and data mining and to remove illegal content

For the domain list, the template requires the top 10 % of all domain names, measured by the size of the crawled content. SMEs, including start-ups, list the top 5 % or 1,000 domain names, whichever is lower. The template protects trade secrets through a graduated level of detail: for some of the sources, a general description is sufficient instead of naming individual datasets.

Systemic risk: classification and notification to the Commission

A model has systemic risk if it has high-impact capabilities or if the Commission so decides, ex officio or following a qualified alert from the scientific panel, on the basis of the criteria in Annex XIII (Art. 51(1)(a) and (b) AI Act). High-impact capabilities are presumed where the cumulative training compute exceeds 10^25 floating-point operations (Art. 51(2)). The Commission may amend this threshold by delegated act (Art. 51(3)). Annex XIII lists, among other things, the number of parameters, the dataset, the amount of computation, benchmarks and reach. The Commission's list under Art. 52(6) shows which models have been classified.

Once the condition is met, the provider notifies the Commission without delay and in any event within two weeks after it is met or it becomes known that it will be met (Art. 52(1)). For the notification as a document, this means:

• the information necessary to demonstrate that the condition is met, such as the calculation of the training compute
• optionally, sufficiently substantiated arguments that, owing to its specific characteristics, the model exceptionally does not present systemic risks (Art. 52(2)); if they are not sufficiently substantiated, the Commission rejects them (Art. 52(3))

After a designation by the Commission ex officio or following a qualified alert (Art. 52(4)), a request for reassessment is possible at the earliest six months after the decision (Art. 52(5)).

Additional documents under Art. 55

Providers of models with systemic risk fulfil the obligations of Art. 55(1) in addition to Art. 53 and 54. Each of them produces its own records:

• Model evaluation (point (a)): using standardised protocols and tools reflecting the state of the art, including conducting and documenting adversarial testing; in addition, in the technical documentation, the evaluation strategies with results, information on red teaming and model adaptations and, where applicable, the system architecture (Annex XI, Section 2)
• Risk assessment and mitigation (point (b)): possible systemic risks at Union level, including their sources. A suitable structure for a risk register: description, source, severity, probability, measure; severity and probability are also named in Art. 56(2)(d)
• Incident documentation (point (c)): keep track of and document relevant information about serious incidents and possible corrective measures, and report it without undue delay to the AI Office and, as appropriate, to the competent national authorities
• Cybersecurity (point (d)): evidence of an adequate level of cybersecurity protection for the model and its physical infrastructure

For incidents, the Act only says "without undue delay". Specific deadlines for the initial report are set only by the Safety and Security chapter of the Code of Practice, as a voluntary commitment of the signatories:

Open-source models and authorised representatives

Where a model is released under a free and open-source licence and its parameters, including the weights, the architecture and the information on model usage, are made publicly available, the technical documentation and the Annex XII package are not required (Art. 53(2) AI Act). The copyright policy and the training data summary remain, and the exception does not apply in the case of systemic risk. Whether a particular model meets the requirements is covered in the article AI Act and open-source models.

Providers established in a third country appoint, by written mandate, an authorised representative established in the Union before placing the model on the market (Art. 54(1)). Among other things, the authorised representative verifies the technical documentation and keeps a copy of it, together with the provider's contact details, at the disposal of the authorities for ten years after the model has been placed on the market (Art. 54(3)(a) and (b)). For open-source models without systemic risk, the appointment is not required (Art. 54(6)).

Code of Practice: which chapter belongs to which document

The Code of Practice was published on 10 July 2025; the Commission and the AI Board have confirmed it as an adequate voluntary tool. Providers may rely on it to demonstrate compliance until a harmonised standard is published (Art. 53(4), for systemic risk Art. 55(2)). Only a harmonised standard gives rise to a presumption of conformity; providers that use neither demonstrate alternative adequate means of compliance, which the Commission assesses. Classification in detail: section 4 of the obligations article.

According to the Commission's page (as at 31 July 2026), the signatories include Aleph Alpha, Amazon, Anthropic, Cohere, Google, IBM, Microsoft, Mistral AI, OpenAI and ServiceNow. xAI has signed only the Safety and Security chapter and must demonstrate transparency and copyright compliance by other adequate means; Meta is not on the list.

Deadlines and fines in brief

• Since 2 August 2025: Chapter V with Art. 51 to 56 applies (Art. 113(3)(b) AI Act). For models placed on the market from that day onwards, all documents on this page have been owed since then.
• Since 2 August 2026: Art. 101 applies. The Commission may impose fines on providers of GPAI models, with or without systemic risk, of up to 3 % of worldwide annual turnover or EUR 15 million, whichever is higher; in doing so, it also takes into account commitments made in the relevant codes of practice (Art. 101(1)).
• Until 2 August 2027: providers of models placed on the market before 2 August 2025 catch up on the obligations (Art. 111(3)).

Regulation (EU) 2026/1744 (Digital Omnibus on AI) has been in force since 27 July 2026. It does not change the GPAI obligations of Art. 53 and 55, and Art. 111(3) remains at 2 August 2027. The fining provisions in context are shown in section 8 of the obligations article; the timeline is set out in the introduction to the obligations article.

Germany and Austria: For Chapter V, the Commission alone is competent in both countries and entrusts the implementation to the AI Office (Art. 88(1) AI Act); national market surveillance authorities can only request it to exercise its powers (Art. 88(2)). In Germany, that has been the Federal Network Agency (Bundesnetzagentur) since 29 July 2026, unless otherwise provided (§ 2(1) KI-MIG). As at 17 August 2026, Austria has not designated a market surveillance authority under Art. 70 AI Act. Supervision in detail is shown in section 5 of the obligations article.

Integrators and deployers: which documents to request

Most companies will not become GPAI providers themselves. For companies that integrate a model into their own AI system (downstream providers, Art. 3(68)), the practical question is whether the model provider supplies the Annex XII package; mere deployers have no statutory entitlement to it. It is intended to enable downstream providers to understand the capabilities and limitations of the model and to comply with their own obligations (Art. 53(1)(b)(i) AI Act). Before integrating a model into your own product, you should request the package under Annex XII, ask for a published summary of the copyright policy and check whether the training data summary has been published. Suppliers that have signed the Code of Practice commit to publishing contact details for such requests. How employees may use third-party models in day-to-day work is governed by an acceptable use policy.

The EU AI Act Kit contains no templates for documenting your own GPAI model under Annex XI or XII. For the role of deployer or integrator, it provides from the Basis package (EUR 990 net, one-off) the provider/deployer role determination, a vendor assessment questionnaire for supplier due diligence and, in Module 11, a document on the GPAI Code of Practice, as a version for Germany or Austria with 12 months of legal-status updates.