Purpose
General-purpose AI models ( GPAI) are subject to their own regime of obligations under Art. 53 AI Act (Regulation (EU) 2024/1689); models with systemic risk are additionally subject to the stricter obligations under Art. 55 AI Act. The rules have applied to new models since 2 August 2025. This skill determines the provider obligations and assesses the classification as systemic risk.
⚠️ Enforcement from 02.08.2026 (as of 2026-07): Although the GPAI obligations have already bound providers since 02.08.2025, the Commission's enforcement and fine powers only apply from 02.08.2026 (Art. 113). The one-year grace period thus ends. Framework: up to EUR 15 million or 3% of worldwide annual turnover (Art. 101).
The Digital Omnibus on AI has NOT postponed the GPAI obligations. Only the high-risk obligations were postponed (Annex III → 02.12.2027, Annex I → 02.08.2028). The GPAI timetable remains unchanged.
Legacy models: GPAI models that were placed on the market before 02.08.2025 must comply with Chapter V only by 02.08.2027 (Art. 111(3)).
Inputs
- Model type and training scale (computing power in FLOP, data volume, modalities)
- Role of the client (provider of the model, downstream provider, open-source distributor)
- Distribution channel (proprietary, freely licensed/open source)
- Training data used (copyright-protected content? TDM reservations?)
- Adherence to a code of practice?
Sub-agent architecture
Three conceptual roles structure the analysis. A classification reviewer clarifies whether a GPAI model exists and whether it qualifies as a model with systemic risk under Art. 51 in conjunction with Art. 55 AI Act (threshold > 10^25 FLOP training compute). A documentation architect compiles the information, documentation and copyright obligations under Art. 53 AI Act and Annex XI/XII. A risk analyst adds, in the case of systemic risk, the additional obligations under Art. 55 AI Act. The classification reviewer decides first on the model category before the other two roles apply their catalogues.
Procedure
1. Classification as a GPAI model
A GPAI model exhibits significant general-purpose capability and can perform a broad spectrum of downstream tasks. Pure research/prototype models prior to market placement are exempt.
2. Basic obligations of all GPAI providers (Art. 53 AI Act)
a) Technical documentation of the model and keep it up to date (training/testing procedures, evaluation results) — at least content pursuant to Annex XI, upon request to the AI Office/authorities b) Information for downstream providers that integrate the model (capabilities and limitations) — content pursuant to Annex XII c) Copyright strategy: written strategy for compliance with Union law, in particular for observance of the rights reservation (TDM opt-out) under the DSM Directive d) Summary of training content make publicly available — the AI Office template of 24.07.2025 must be used (together with the Explanatory Notice). Required are: type of content, essential data sources (including named large public datasets and, above a size threshold, the most important crawled domains), licensed/user/synthetic data as well as collection and processing methods including the measures for observing the TDM opt-out. The summary must be updated every 6 months or upon substantial change.
For free and open-source GPAI models, the obligations in points (a) and (b) do not apply pursuant to Art. 53(2) , provided the model is made available under a licence that permits access, modification and redistribution and the parameters are publicly available. Points (c) and (d) continue to apply without restriction. In the case of systemic risk, the exemption does not apply at all.
3. Models with systemic risk (Art. 55 AI Act)
Classification at training compute > 10^25 FLOP (Art. 51(2) — rebuttable presumption of high impact capabilities) or by designation by the Commission ex officio or upon a qualified warning from the scientific panel (Art. 51(1)(b), criteria Annex XIII).
Notification obligation Art. 52(1): The provider must notify the Commission within two weeks as soon as it reaches the threshold or knows that it will reach it. With the notification, it may assert that despite exceeding the threshold, no systemic risk exists.
Additional obligations:
- Model evaluation incl. adversarial testing (red teaming)
- Assessment and mitigation of systemic risks at Union level
- Reporting of serious incidents to the AI Office and national authorities
- appropriate level of cybersecurity for the model and physical infrastructure
4. Codes of Practice (Art. 56 AI Act)
Until harmonised standards are available, providers can demonstrate compliance via codes of practice . The GPAI Code of Practice was issued by the AI Office on 10.07.2025 published in its final version; the first list of signatories followed on 01.08.2025. It is divided into three chapters: Transparency and Copyright (all GPAI providers) as well as Safety and Security (only providers of models with systemic risk).
Practical notes on signing:
- Joining is voluntary; it does not establish a legal presumption of conformity within the meaning of Art. 40, but facilitates the demonstration of compliance vis-à-vis the AI Office.
- Meta has not signed — proof there must be provided by other means.
- xAI has signed only the chapter Safety and Security and must demonstrate transparency and copyright by "alternative adequate means".
- A partial signing of individual chapters is possible and must be expressly addressed in advisory services.
- The Commission has established a Signatory Taskforce to coordinate the compliance exchange.
Harmonised standards: As of 07/2026, no harmonised standard on the AI Act is cited in the Official Journal. Only prEN 18286 (quality management system, Art. 17) reached the public enquiry on 30.10.2025. An ISO/IEC 42001 certification therefore does NOT establish a presumption of conformity — under Art. 40, this arises solely from standards cited in the Official Journal. ISO/IEC 42001 is reusable preparatory work (prEN 18286 Annex D contains a mapping), not a substitute.
5. Sanctions (Art. 101 AI Act)
The AI Office may impose fines on GPAI providers of up to EUR 15 million or 3% of worldwide annual turnover .
Risks
- Misclassification — exceeding the 10^25 FLOP threshold without recognising the systemic risk violates Art. 55 AI Act.
- Two-week deadline under Art. 52(1) missed — the notification to the Commission is subject to a deadline and is regularly overlooked because it comes before the actual fulfilment of obligations.
- Grace period confused with start of applicability — the obligations have applied since 02.08.2025; only enforcement began later. Anyone who only starts implementation on 02.08.2026 has already been in breach of obligations for a year.
- Open-source exemption overstretched — Art. 53(2) exempts only from lit. a and b. The copyright strategy and training data summary remain; in the case of systemic risk, the exemption does not apply at all.
- Training data summary without the official template — the template is binding, free versions are not sufficient; the 6-month update is likewise overlooked.
- ISO/IEC 42001 misunderstood as proof of conformity — in the absence of citation in the Official Journal, it does not establish a presumption effect under Art. 40.
- Copyright — missing strategy for observing the TDM reservation violates Art. 53 AI Act; litigation risk from rights holders.
- Documentation gap — incomplete technical documentation pursuant to Annex XI/XII vis-à-vis downstream providers and authorities.
- Fine risk — up to EUR 15 million / 3% pursuant to Art. 101 AI Act; enforcement from 02.08.2026.
- ⚠️ Do not assume an official list of systemic models — Art. 52(6) obliges the Commission to publish a list of GPAI models with systemic risk. As of 07/2026, such a list is not findable as a primary source. Enumerations of specific models circulating in secondary sources are not substantiated and must not be adopted into client-facing editions.
[unverifiziert - prüfen]
Output format
GPAI-PFLICHTEN — PRÜFUNG — <Modell> — <Datum>
I. GPAI-Modell? [ja / nein — Begründung]
II. Rolle [Anbieter / nachgelagert / Open Source]
III. Grundpflichten (Art. 53 KI-VO)
Technische Dokumentation (Anhang XI) [Status <…>]
Info nachgelagerte Anbieter (Anhang XII) [Status <…>]
Urheberrechtsstrategie / TDM [Status <…>]
Trainingsdaten-Zusammenfassung [Status <…>]
IV. Systemisches Risiko (Art. 55 KI-VO) [> 10^25 FLOP? / benannt?]
Zusatzpflichten [Red-Teaming / Vorfallmeldung / Cybersicherheit]
V. Code of Practice (Art. 56 KI-VO) [beigetreten? <…>]
VI. Bußgeldrisiko (Art. 101 KI-VO) [bis 15 Mio. EUR / 3 %]
Empfehlung: <…>
Nächste Schritte: <…>
Sources
Statutes
- Regulation (EU) 2024/1689 (AI Act / EU AI Act) — full text with annexes
- Art. 51 AI Act (classification of systemic risk), Art. 53 AI Act (GPAI obligations), Art. 55 AI Act (systemic risk), Art. 56 AI Act (codes of practice), Art. 101 AI Act (fines GPAI), Annex XI, Annex XII AI Act
Guidelines
- European Commission AI Office, GPAI Code of Practice (July 2025)
- AI Office, template for the summary of training content
Secondary literature
- Hilgendorf/Roth-Isigkeit, KI-VO, 1st ed. 2024
- BeckOK KI-VO (online)