General-Purpose AI Registration

The computational and capability-based criteria that trigger registration obligations. A general-purpose AI model is classified based on the cumulative compute used for training, measured in floating-point operations (FLOPs). 10^25 FLOPs is the initial threshold established by the EU AI Act, presuming models trained above this limit possess high-impact capabilities. Providers must self-assess and document their compute usage, as this metric serves as the primary gateway for determining whether streamlined or enhanced registration requirements apply.

The comprehensive dossier required for GPAI registration, distinct from narrow AI documentation. Providers must submit detailed information including: a general description of the model's intended tasks and integration modalities; the architecture and number of parameters; the modalities and format of inputs and outputs; the license for the model; and a description of the model's training process, including data sources and compute resources used. This documentation must be updated continuously to reflect substantial modifications.

The mandatory requirement for GPAI providers to draft and make publicly available a sufficiently detailed summary of the content used for training the model. This obligation, enforced under Article 53 of the EU AI Act, requires providers to publish a template that lists the main data collections or sets used, such as large private or public databases, and provides a narrative explanation about other data sources used. This enables downstream deployers to understand the model's provenance and potential biases.

The legal requirement for non-EU providers to designate a natural or legal person established within the Union to act as the point of contact for registration and compliance. Before placing a general-purpose AI model on the Union market, a provider established outside the EU must, by written mandate, appoint an authorized representative. This entity verifies the technical documentation, maintains records of conformity, and cooperates with competent authorities on all matters relating to the model's compliance.

The ongoing obligation to conduct state-of-the-art evaluations to detect and mitigate systemic risks. Providers must perform and document adversarial testing—including red-teaming—to identify vulnerabilities to misuse, such as generating illegal content, facilitating cyberattacks, or propagating systemic biases. These evaluations must be conducted both pre-deployment and iteratively throughout the model's lifecycle, with findings reported to the AI Office as part of the post-market monitoring system.

A regulatory classification applied to general-purpose AI models with high-impact capabilities, such as those exceeding 10^25 FLOPs in training compute. This designation triggers additional registration obligations beyond standard high-risk requirements, including mandatory adversarial testing, cybersecurity hardening, and incident reporting. Providers must submit detailed technical documentation to the AI Office demonstrating mitigation measures against large-scale misuse, chemical, biological, radiological, and nuclear (CBRN) threats, and systemic discrimination.

The formal process of filing a structured transparency artifact as part of the technical documentation for registration. A model card details:

• Intended use and out-of-scope applications
• Evaluation results on bias, robustness, and fairness benchmarks
• Training data provenance and composition
• Known limitations and failure modes For general-purpose AI, this submission must be sufficiently comprehensive to enable downstream providers to fulfill their own compliance obligations.

A documented lineage of all datasets used to train a general-purpose AI model, required in the registration file. This record must demonstrate compliance with EU copyright law and the text and data mining opt-out provisions of the Digital Single Market Directive. Providers must disclose the sources, scale, and nature of training data, including whether copyrighted works were used. This transparency obligation is central to the EU's strategy for enforcing intellectual property rights in foundation model development.

The legal requirement for non-EU providers of general-purpose AI to designate a natural or legal person established within the Union. This representative acts as the formal point of contact for registration submissions, compliance inquiries, and enforcement actions. Without a duly appointed authorized representative, a foreign foundation model cannot lawfully be placed on the EU market. The mandate ensures jurisdictional accountability regardless of where the model was developed.

The technical mechanism connecting a registered general-purpose AI system's unique identification number to a mandatory incident reporting portal. Providers must report serious incidents—including model failures, discriminatory outputs, or security breaches—within specified timelines. For systemic risk models, this obligation is heightened, requiring immediate notification of any event that could lead to mass-scale harm. The linkage ensures traceability from registration to post-market surveillance.

A European technical specification adopted by a recognized standards body—such as CEN or CENELEC—that provides a presumption of conformity with the essential requirements of the EU AI Act. For general-purpose AI providers, adhering to harmonized standards for model evaluation, documentation, and risk management simplifies the registration process. These standards translate high-level regulatory obligations into actionable engineering benchmarks, reducing legal uncertainty for foundation model developers.