GPAI Provider Obligations Since Aug 2, 2025: What Really Applies

Timeline (Art. 113 AI Act) — please do not confuse these: On 2 August 2026 the obligations for GPAI providers did not change — Chapter V of the AI Act (Art. 51-56) has applied since 2 August 2025 (Art. 113(b) AI Act). The only addition is Art. 101 AI Act — applicable since 2 August 2026: the power of the European Commission to impose fines on GPAI providers.

The overview below sorts out the dates that are most frequently confused in practice — with a citation for each line.

1. Who counts as a GPAI provider?

Short answer: A GPAI provider is anyone who develops or significantly adapts a general-purpose AI model within the meaning of Art. 3 no. 63 AI Act. The model must display significant generality, be capable of competently performing a wide range of distinct tasks, and be capable of being integrated into a variety of downstream systems or applications; training with a large amount of data using self-supervision at scale is expressly covered as well. Models used for research and development activities or prototyping before being placed on the market are expressly excluded.

A model is not the same as a system. The AI Act distinguishes two concepts: the general-purpose AI model (Art. 3 no. 63) and the AI system as a machine-based system designed to operate with varying levels of autonomy that infers, from the input it receives, how to generate outputs (Art. 3 no. 1). The obligations under Chapter V attach to the model, the high-risk and transparency obligations to the system. Anyone combining both in one product needs two separate obligation lists.

Who is a provider? Anyone who develops the model OR significantly adapts it (fine-tuning that materially changes its suitability for use). At system level, Art. 25 AI Act describes the change of role: a deployer becomes a provider where the intended purpose or the functionality is materially changed, or where the system is placed on the market under its own name.

Examples:

• OpenAI with GPT-4: yes, GPAI provider
• Anthropic with Claude: yes
• Mistral AI: yes
• Aleph Alpha with Luminous: yes
• SAP with Joule (wrapper on third-party GPAI models): not a GPAI provider — downstream provider within the meaning of Art. 53(1)(b) AI Act; at model level it remains a deployer
• A mid-sized company with a custom GPT on Azure: no, deployer only

Practitioner recommendation (not a statutory requirement): Record the role assignment for each model in writing once — with the date, the reasoning and the person accountable for it — and review it again as soon as you change, fine-tune or market the model under your own name.

2. Art. 53: base obligations

Short answer: Art. 53 EU AI Act requires all GPAI providers — even without systemic risk — to meet four base obligations: technical documentation, information for downstream providers, a copyright policy and a public training-data summary. Content, citation and the action step for each obligation are set out below.

1. Technical documentation under Annex XI: architecture, training data, training effort, test results. What to do: draw up documentation containing at least the content of Annex XI and keep it up to date. Why: the provision expressly requires not only drawing it up but also updating it — a version filed once does not satisfy the wording. Art. 53(1)(a) AI Act
2. Information for downstream providers: capabilities, limitations, suitable use cases. What to do: make available information and documentation containing at least the content of Annex XII. Why: the addressee is expressly the provider who integrates the model into its own AI system; it needs this information in order to understand the capabilities and limitations of the model and to comply with its own obligations. Art. 53(1)(b) AI Act
3. Copyright policy: compliance with Copyright Directive 2019/790, opt-out mechanisms for training. What to do: put in place a policy to comply with Union copyright law. Practitioner recommendation (not a statutory requirement): record the handling of reservations of rights in writing and in a repeatable form. Art. 53(1)(c) AI Act
4. Training-data summary: a public document with an overview of the data sources (format provided by the EU AI Office). What to do: draw up and make publicly available a sufficiently detailed summary of the content used for training, following the template provided by the EU AI Office. Why: the format is prescribed; a freely drafted in-house version does not cover the obligation. Art. 53(1)(d) AI Act

Relief for free and open-source models: Art. 53 AI Act provides for a limited application of the obligations under paragraph 1 points (a) and (b) to models released under a free and open-source licence. That limitation does not apply where the model presents a systemic risk — in that case the full technical documentation and the information for downstream providers remain due.

Legacy models: For GPAI models placed on the market before 2 August 2025, the obligations under Art. 53 AI Act apply with a transition period until 2 August 2027 (Art. 111(3) AI Act) — what is postponed is the point in time, not the scope of the obligations.

3. Art. 55: systemic-risk models

Short answer: A GPAI model falls under Art. 55 AI Act if it has high-impact capabilities — assessed on the basis of appropriate technical tools, indicators and benchmarks (Art. 51(1) AI Act), presumed where the cumulative amount of computation used for training exceeds 10^25 floating-point operations (Art. 51(2) AI Act) — or if the Commission so decides on the basis of the criteria in Annex XIII; both routes lead to the classification, and computing power alone is not decisive. Four additional obligations then apply: model evaluation, assessment and mitigation of systemic risks, incident reporting and cybersecurity. Content, citation and the action step for each obligation are set out below.

Under Art. 55(1) AI Act they apply in addition to the obligations under Art. 53 and Art. 54 AI Act:

• Model evaluation with adversarial testing (red teaming). What to do: carry out and document the evaluation in accordance with standardised protocols, including adversarial testing. Art. 55(1)(a) AI Act
• Risk assessment and mitigation of systemic risks (bias, cybersecurity, spread of disinformation). What to do: assess and mitigate possible systemic risks at Union level. Why: the reference point is expressly the Union level, not the individual customer deployment. Art. 55(1)(b) AI Act
• Tracking and reporting: report serious incidents without delay (without undue delay) to the EU AI Office. What to do: record and document incidents and report them without delay to the EU AI Office and, where applicable, to the competent national authorities. Art. 55(1)(c) AI Act
• Cybersecurity protection for model weights. What to do: ensure an adequate level of cybersecurity for the model and its physical infrastructure. Why: the wording expressly includes the physical infrastructure — protecting the weights alone falls short. Art. 55(1)(d) AI Act

4. Code of Practice

Short answer: The GPAI Code of Practice is a code of practice within the meaning of Art. 56 AI Act on which providers may rely under Art. 53(4) AI Act (for systemic risk: Art. 55(2) AI Act) in order to demonstrate compliance with their obligations — but it does not create a statutory presumption of conformity.

As at 2 May 2026: the final version was published by the EU AI Office on 10 July 2025 and has been extended continuously. Signatories, as at March 2026:

• OpenAI, Anthropic, Google, Microsoft, Meta, Mistral, Aleph Alpha, Cohere
• SAP (as a downstream provider)
• 90% of GPAI models covered in total

Reliance on codes of practice under Art. 56 AI Act expressly applies until a harmonised standard is published; only that standard creates the presumption of conformity, to the extent that it covers the obligations. Anyone who neither follows an approved code of practice nor complies with a harmonised European standard must demonstrate adequate alternative means of compliance, which are to be assessed by the Commission. Nor does signing protect automatically against a divergent assessment by the Commission.

What follows from this: A management system under ISO 42001 does not replace this building block: for high-risk AI systems it covers a large part of risk management (Art. 9) and of the QMS (Art. 17), but not the code-of-practice level.

Practitioner recommendation (not a statutory requirement): Maintain a mapping table 'chapter of the Code of Practice → own document/evidence'. It is the basis on which a request from the Commission can be answered without having to reconstruct anything.

5. Role of the EU AI Office and the scientific panel

Short answer: The EU AI Office (Brussels, part of DG CNECT) is the central supervisor for GPAI models and can conduct investigations (Art. 92) and impose sanctions (Art. 101). It is advised by the scientific panel of independent experts (Art. 68 AI Act). In 2025-2026 the AI Office is prioritising the build-up of the Code of Practice, the GPAI model register and the incident-reporting system.

For providers, two addressees and one clarification follow from this: the reporting of serious incidents under Art. 55(1)(c) AI Act goes to the EU AI Office — where applicable, additionally to the competent national authorities. Investigations under Art. 92 AI Act are conducted by the Commission. No national authority is competent for the supervision and enforcement of Chapter V; the reporting obligation under Art. 55(1)(c) AI Act remains unaffected by this.

Note on Germany and Austria: The AI Act is an EU regulation and applies directly and identically in Germany and Austria — there are no divergent national provisions here, only national implementing and authority structures. For Chapter V (GPAI models) the European Commission has exclusive supervisory and enforcement powers in any event and entrusts their exercise to the EU AI Office (Art. 88(1) AI Act); the national market surveillance authorities under Art. 70 AI Act are therefore not competent for GPAI provider obligations. In Germany, the market surveillance authority has been the Federal Network Agency (Bundesnetzagentur) since 29 July 2026 (§ 2(1) of the German AI Market Surveillance and Innovation Promotion Act (KI-MIG)), unless sectoral authorities — such as BaFin — are competent; as at the date of this article (17 August 2026), Austria has not designated a market surveillance authority under Art. 70 AI Act, and the AI Service Desk at RTR (KI-Servicestelle der RTR) is an information and advisory body without supervisory powers. None of this changes the exclusive competence for Chapter V.

What is governed nationally is only the designation of the authorities under Art. 70 AI Act — the contact details of the single point of contact had to be made publicly available by 2 August 2025 under Art. 70(2) AI Act — and the penalty regime within the framework of Art. 99(1) AI Act; none of this changes the competence for Chapter V.

6. Practice for SME downstream providers

Short answer: Most SMEs are not GPAI providers but deployers; provider status arises above all in the following three scenarios — two at model level, one at system level.

You become a GPAI provider within the meaning of Chapter V in particular through:

• Training your own model (very rare in SMEs)
• Fine-tuning that materially changes the model's suitability for use (e.g. a medical language model based on Llama)

If you market a third-party model under your own name — a wrapper with white-label branding and your own marketing — you become the provider of the AI system under Art. 25 AI Act. Whether you additionally qualify as the provider of the GPAI model itself, and are thus subject to Art. 53 and Art. 55 AI Act, is a question for the individual case — if in doubt, clarify it with a lawyer.

An example from SME practice: a RAG system on a GPAI API that is marketed as a standalone assistant (change of role under Art. 25 AI Act, Section 1).

The effort differs considerably between the roles. Practitioner effort estimate (empirical values, as at 2 May 2026 — not a statutory requirement, not quoted prices): for pure deployers in the SME segment 0.2 FTE over 4 months and EUR 5,000-20,000 plus training, whereas for GPAI providers 2-5 FTE over 12 months and EUR 250,000-1,000,000.

If the role assignment remains open after this review — typically with fine-tuning of medium depth — that is the point for legal clarification. Practitioner recommendation (not a statutory requirement): until then, record the review date, the model reviewed and the interim result.

7. Deployer perspective: what applies to users of GPAI from 2 August 2026

Short answer: Anyone who merely uses GPAI models is not an addressee of Art. 53 AI Act — that provision is addressed to providers of GPAI models — but, in the cases covered by Art. 50 AI Act, has been subject to the transparency obligations set out there since 2 August 2026, and these depend on the role: Art. 50(1) (informing people that they are interacting with an AI system) and (2) (machine-readable marking of synthetic audio, image, video and text content) are addressed to providers, while (3) (information in the case of emotion recognition and biometric categorisation) and (4) (disclosure of deepfakes) are addressed to deployers.

As long as you use a third-party GPAI product unchanged, paragraphs 3 and 4 apply; with a change of role under Art. 25 AI Act (Section 1), the chatbot notice and the machine-readable marking are added.

Two further obligations have applied irrespective of this since 2 February 2025: AI literacy under Art. 4 AI Act and the prohibition of the practices under Art. 5 AI Act (including manipulation, exploitation of vulnerabilities, social scoring, emotion recognition in the workplace and in education institutions, and biometric categorisation to infer sensitive attributes).

Practitioner rhythm (recommendation, not a statutory deadline): In a 12-month roll-out plan, a GPAI inventory and a review of Code-of-Practice compliance have proved effective in months 4-5, and the transparency workflow under Art. 50 in month 6. As an ongoing routine, it has proved effective to take the GPAI inventory again whenever a model or a provider changes, rather than by the calendar.

8. Fine framework: which provision for which breach

Short answer: For GPAI providers, Art. 101 AI Act applies (fines imposed by the Commission, up to EUR 15 million or 3% of total worldwide annual turnover, whichever is higher); the general fine tiers of Art. 99 AI Act are graduated by type of breach and range from EUR 7.5 million / 1% to EUR 35 million / 7%.

All lines state upper limits set by the AI Act itself; they apply equally in Germany and Austria. Within a line, the higher of the two values is generally decisive — for the exception for SMEs and start-ups under the tiers of Art. 99 AI Act, see below the table.

Two points of precision that make the difference in practice. First, for the tiers of Art. 99 AI Act, SMEs and start-ups benefit from the privilege in Art. 99(6) AI Act: there, the lower of the two values applies. Second, Art. 4 AI Act (AI literacy) does not fall under Art. 99(4) AI Act — breaches of the AI-literacy obligation have no EU fine framework of their own; penalties follow national law within the framework of Art. 99(1) AI Act.

Germany and Austria: What is shaped nationally is solely the penalty regime within the framework of Art. 99(1) AI Act, not the upper limits set out above. For the GPAI provider obligations, the allocation of competences described in Section 5 applies — the relevant fine provision there is Art. 101 AI Act.

Digital Omnibus: Regulation (EU) 2026/1744 (Digital Omnibus AI) has been in force since 27 July 2026; it does not affect the GPAI provider obligations under Art. 53 and Art. 55 AI Act, but postpones the application of Chapter III Sections 1-3 for Annex III systems to 2 December 2027 and for Annex I systems to 2 August 2028. For GPAI planning, this means: do not factor in any postponement.