What is a GPAI model under the EU AI Act?

A general-purpose AI model is one trained on broad data that can perform a wide range of tasks and be integrated into many downstream systems - for example large language models.

When do GPAI obligations apply?

GPAI provider obligations (Articles 53-55) have applied since 2 August 2025 for new models; the AI Office's enforcement (penalty) powers became exercisable on 2 August 2026, and models placed on the market before 2 August 2025 must comply by 2 August 2027.

What makes a GPAI model systemic-risk?

A model is presumed to carry systemic risk when the compute used for training exceeds 10^25 floating-point operations, triggering additional evaluation, incident-reporting, and cybersecurity duties.

CSOAI - GPAI obligations

If you ship a model, this is your 2 Aug 2026 list

General-purpose AI provider obligations have applied since 2 August 2025 - and since 2 August 2026 the AI Office can enforce them with penalties. Here is exactly what every model provider owes - and the extra duties if your model carries systemic risk.

You are interacting with an AI system.

The embedded 'Ask your Council assistant' panel (SovereignSpot) sends questions to the configured /api/chat model endpoint, where a single model writes the answer; no Council review, vote, or signature is implied. The Art 50(1) notice for this surface is registered here and being wired; until the component ships, this registry entry is the disclosure.

Disclosed under EU AI Act Article 50(1). Every surface and its classification

Every GPAI provider

Technical documentation

Keep up-to-date docs on the model's design, training, and evaluation for regulators and downstream providers.

Training-data summary

Publish a sufficiently detailed public summary of the content used to train the model.

Put a policy in place to comply with EU copyright law and honour text-and-data-mining opt-outs.

Downstream information

Give downstream deployers what they need to understand capabilities and limitations.

Systemic-risk trigger: if training compute exceeds 10^25 FLOP, your model is presumed systemic and the four duties below apply on top of the base list.

Systemic-risk models (additional)

Model evaluation

Adversarial testing / red-teaming to find and mitigate systemic risks.

Serious-incident reporting

Track and report serious incidents and corrective actions to the AI Office.

Cybersecurity

Protect the model and its physical infrastructure to an adequate level.

Systemic-risk assessment

Assess and mitigate risks at the Union level on an ongoing basis.

The full readiness checklist ->Scan my readiness ->The penalties ->

Council OS — GPAI / foundation-model provider obligations

Answers from published measurement, or it refuses. Your question is typed into the lobby — nothing sends until you press Ask.

Open Council OS

Deterministic pane commands · grounded /api/chat lane · consent checkpoint on consequential steps