Key points

• The EU AI Act's obligations for providers of general-purpose AI (GPAI) models have applied since August 2025, and the Commission's enforcement powers over those providers began in August 2026.
• Companies that build products on third-party models are usually deployers or downstream providers, not GPAI providers, but they can become providers if they significantly modify a model or place it on the market under their own name.
• Models placed on the EU market before August 2025 have until August 2027 to comply, which makes the next twelve months a transition window rather than a grace period.
• Contracts with model providers are now the main tool for obtaining the documentation and assurances that deployers need for their own compliance.
• Timelines for other parts of the Act, including high-risk system obligations, have been the subject of proposed adjustments. Companies should confirm the current status before fixing compliance plans.

Why general-purpose AI is treated separately

The EU AI Act regulates AI systems by risk, but it deals with the large, flexible models that sit underneath many applications in a distinct chapter. A general-purpose AI model is one trained on large amounts of data that can competently perform a wide range of tasks and be integrated into many downstream systems. The legislators recognized that obligations placed only on end applications would leave the underlying models unexamined, and that downstream companies often lack the information needed to assess them.

The result is a two-layer structure. Providers of general-purpose models carry obligations about the model itself. Providers and deployers of AI systems built on those models carry obligations about how the system is used. Understanding which role your organization occupies is the starting point for everything else.

What providers of GPAI models must do

Providers of all GPAI models must maintain technical documentation, supply information and documentation to downstream providers who integrate the model, put in place a policy to comply with EU copyright law, including respecting machine-readable rights reservations, and publish a sufficiently detailed summary of the content used for training, using a template issued by the AI Office.

Models that present systemic risk face additional duties. A model is presumed to have high-impact capabilities, and therefore systemic risk, when the cumulative compute used for training exceeds 10^25 floating point operations, although the Commission can also designate models on other criteria. Providers of these models must carry out model evaluations, assess and mitigate systemic risks, report serious incidents to the AI Office and ensure adequate cybersecurity protection.

A voluntary General-Purpose AI Code of Practice, published in July 2025, gives providers a way to demonstrate compliance. Signing is not mandatory, but providers who do not sign should expect to explain to the AI Office how their alternative measures meet the same standard.

The timeline that matters

The GPAI obligations began to apply in August 2025. For models placed on the market before that date, the Act provides a longer period, until August 2027, to come into compliance. From August 2026, the Commission has had power to enforce the GPAI rules directly, including by requesting information, conducting evaluations and imposing fines on providers. For GPAI providers, fines can reach a percentage of worldwide annual turnover or a fixed amount, whichever is higher.

Other parts of the Act run on separate timelines, and the Commission has proposed adjustments to some of them, in particular the dates for high-risk system requirements. Where a compliance plan depends on one of those dates, we recommend confirming the status of the legislative proposals at the point of decision rather than relying on earlier summaries.

When a deployer becomes a provider

Most companies using foundation models in their products will not be GPAI providers. They are downstream actors. However, the Commission's guidance indicates that a downstream party who modifies a model can become the provider of the modified model, if the modification is substantial. The guidance uses the amount of compute spent on the modification, measured against the compute used to train the original model, as an indicative test. Fine-tuning with modest compute should generally not trigger provider status, but extensive retraining may.

Companies should also be aware that putting a model on the market under their own name or integrating it into a system they place on the market can create obligations as an AI system provider, regardless of whether the underlying model is covered. This is a particular issue for businesses that white-label third-party models.

What deployers should do now

First, map the models in use. Many organizations cannot say which models power which internal tools or customer-facing features, still less which version. An inventory is the precondition for every other step.

Second, review contracts with model providers. Deployers need access to the documentation the Act requires providers to maintain, notice of material changes, commitments about copyright compliance and incident notification. Indemnities for intellectual property claims arising from model outputs, and clear allocation of responsibility for fine-tuned versions, are increasingly negotiated points.

Third, check AI literacy and transparency duties. The requirement that organizations ensure sufficient AI literacy among staff operating AI systems has applied since February 2025, and transparency duties for certain AI interactions and synthetic content are approaching. Employee training and internal policies should be documented.

Fourth, align the AI program with privacy compliance. GPAI use often involves personal data, and regulators in several member states have signaled that data protection authorities will examine training data and output accuracy under GDPR alongside the AI Act.

Practical steps for the next twelve months

For boards and general counsel, the practical question is how much assurance they have that vendors will remain compliant as their own deadlines approach. We recommend a short program: inventory models, rank them by business importance, ask each provider for its compliance position and code of practice status, and update contract templates for new deals. Where a provider is relying on the transition period for a legacy model, the deployer should understand when that period ends and what migration options exist.

Corvane Ryle's AI and EU Regulatory teams advise providers and deployers on every layer of this framework and can help prepare a compliance roadmap suited to your organization's role.