General Purpose AI (GPAI)

Under the EU AI Act, all GPAI providers must publicly disclose a sufficiently detailed summary of the content used for training, respecting trade secrets. Providers of GPAI models with systemic risk face additional obligations:

• Model evaluation: Conducting and documenting adversarial testing
• Incident reporting: Notifying the AI Office of serious incidents
• Cybersecurity: Ensuring adequate protection against misuse

A risk classification for general-purpose AI models possessing high-impact capabilities that could cause large-scale harm. Models trained using cumulative compute exceeding 10^25 FLOPs are presumptively classified as having systemic risk. This designation triggers mandatory adversarial testing, model evaluation, serious incident reporting, and cybersecurity obligations. Providers must assess and mitigate systemic risks at the Union level, including risks stemming from downstream misuse or harmful model modifications.

The structured technical disclosures required for all GPAI models under Article 53 of the EU AI Act. Providers must publicly disclose:

• A detailed technical description of the model architecture
• Training methodologies and data sources
• Compute resources used during training
• Known limitations and biases
• Results of internal evaluation and red-teaming This documentation enables downstream deployers to understand capabilities and integrate the model responsibly into high-risk systems.

The legal duties placed on professional users who integrate GPAI models into high-risk AI systems. Deployers must:

• Conduct Fundamental Rights Impact Assessments
• Implement meaningful human oversight mechanisms
• Monitor system operation for drift and adverse effects
• Report serious incidents to market surveillance authorities GPAI providers must furnish sufficient technical information to enable deployers to fulfill these obligations, creating a shared compliance chain between model developers and system integrators.

The mandatory verification process by which a provider demonstrates that a high-risk AI system—including those integrating GPAI models—meets all applicable regulatory requirements. For systems using GPAI as a component, the assessment must verify:

• Adequate risk management for the integrated model
• Sufficient transparency documentation from the GPAI provider
• Compliance with data governance criteria for fine-tuning datasets
• Robustness against adversarial manipulation Third-party Notified Bodies may be required for certain high-risk categories.

A change to a GPAI model's intended purpose or a significant alteration to its performance characteristics that triggers a new conformity assessment. Examples include:

• Fine-tuning a general-purpose model for medical diagnosis
• Modifying model architecture to enable biometric categorization
• Integrating the model into a safety-critical control system When a downstream deployer substantially modifies a GPAI model, they assume the legal status of provider and bear full regulatory responsibility for the modified system.

A controlled environment established by competent authorities allowing providers to develop, test, and validate innovative GPAI systems under direct regulatory supervision. Sandboxes provide:

• Legal certainty during experimental development
• Guidance on compliance with AI Act requirements
• Supervised access to real-world data for testing
• Accelerated pathways to conformity assessment Participation is particularly valuable for GPAI providers exploring novel architectures or deployment modalities where regulatory interpretation remains uncertain.