GPAI Provider Obligations from Aug 2, 2026: What Really Applies

1. Who qualifies as a GPAI Provider?

Art. 3(63) EU AI Act: a GPAI model is trained on a broad data basis, displays significant generality, and can be integrated into a variety of downstream systems. The Provider is whoever develops the model OR substantially adapts it (fine-tuning that materially changes the intended purpose).

Examples:

• OpenAI with GPT-4: yes, GPAI Provider
• Anthropic with Claude: yes
• Mistral AI: yes
• Aleph Alpha with Luminous: yes
• SAP with Joule (wrapper on GPT/Claude): no, Deployer only
• SME with Custom GPT on Azure: no, Deployer only

2. Art. 53: baseline obligations

All GPAI Providers (without systemic risk) must satisfy:

• Technical documentation per Annex XI: architecture, training data, training compute, evaluation results
• Information for downstream Providers: capabilities, limitations, suitable use cases
• Copyright policy: compliance with Directive 2019/790, opt-out mechanisms for training data
• Training-data summary: public document with data-source overview (template from the AI Office)

3. Art. 55: systemic-risk models

Additional obligations for models with cumulative training compute above 10^25 FLOPs:

• Model evaluation with adversarial testing (red-teaming)
• Risk assessment and mitigation of systemic risks (bias, cybersecurity, disinformation spread)
• Tracking and reporting: serious incidents to the EU AI Office within 14 days
• Cybersecurity protection for model weights

4. Code of Practice

As of April 2026: final version published by the EU AI Office in April 2025, continuously extended. Signatories as of March 2026: OpenAI, Anthropic, Google, Microsoft, Meta, Mistral, Aleph Alpha, Cohere, plus SAP as a downstream Provider. Roughly 90% of GPAI model coverage. The Code is a "compliance presumption" — adherence implies legal compliance.

5. EU AI Office and AISB

• EU AI Office (Brussels, part of DG CNECT): central supervisor for GPAI
• AI Scientific Board (AISB): independent expert advisory body
• Powers: investigations (Art. 92), sanctions (Art. 101)
• 2025-2026 priorities: Code of Practice expansion, GPAI model registry, incident-reporting system

6. SME practical implications

Most SMEs are not GPAI Providers. They use GPAI models as Deployers. Provider status arises only with: own model training (rare in SMEs), substantial fine-tuning (e.g., a medical language model based on Llama), or white-label rebranding with own marketing. When in doubt, get legal clarification — the fine risk is 15M EUR / 3%.

Summary

GPAI obligations apply to a small number of large AI Providers, with a clear escalation for systemic-risk models. SMEs typically remain Deployers. Document your role explicitly in vendor contracts and re-assess after any fine-tuning project that changes the intended purpose.

View EU AI Act Kit →