The Week in One Line

If your company fine-tunes or significantly modifies a third-party AI model, you may already be a provider under the Act, with obligations that have applied since 2 August 2025.

What the Act Actually Says

General-purpose AI (GPAI) model obligations under Articles 53-55 became applicable on 2 August 2025.

The recent Omnibus agreement did not change that.

Articles 51 and 52 deal with something different: the process for classifying a GPAI model as carrying systemic risk, which then triggers the additional obligations under Article 55.

In practice, the Act presumes a GPAI model to be one trained using more than 10²³ floating-point operations (FLOPs) and capable of generating language, image, or video outputs.

Models above this threshold but limited to a narrow task, such as transcription or weather forecasting, can still be excluded if they do not demonstrate general-purpose capabilities.

If your organisation is considered a GPAI provider, your responsibilities include:

  • Maintaining technical documentation
  • Publishing a summary of training data using the European Commission's template
  • Addressing copyright compliance under Article 53

Providers of GPAI models with systemic risk (generally those trained using 10²⁵ FLOPs or more) have additional obligations under Article 55, including:

  • Model evaluation, including adversarial testing
  • Systemic risk assessment and mitigation
  • Incident reporting
  • Cybersecurity measures

A detail many organisations overlook:

If your company develops a model for another organisation, but that organisation places it on the EU market under its own name, the entity placing the model on the market is considered the provider, not the developer.

Likewise, if your organisation significantly modifies an existing GPAI model, you may become the provider for the obligations related to that modification.

One important nuance:

The obligations already apply.

The European Commission's direct enforcement powers begin on 2 August 2026.

That does not mean organisations should wait until then.

Providers that placed GPAI models on the market before 2 August 2025 have until 2 August 2027 to comply.

Sources: artificialintelligenceact.eu GPAI Guidelines Overview; European Commission Guidelines on the Scope of Obligations for GPAI Models (18 July 2025).

What This Means for Your Business

If you're simply using a GPAI model through an API without modifying it, you're likely a deployer, not a provider. Different obligations apply.

If your team fine-tunes a foundation model for a specific use case, it's worth checking whether those modifications are significant enough to make your organisation a provider for that modified model.

The voluntary GPAI Code of Practice, finalised on 10 July 2025, is not mandatory.

As of mid-2026, approximately 24 providers have signed it, including Anthropic, Google, Microsoft, OpenAI, and Mistral AI. Notably, Meta has not signed.

Providers that adopt the Code benefit from smoother supervisory interactions and increased trust from the European Commission.

The Omnibus package did not change any of these obligations.

If your organisation has any GPAI provider exposure, this isn't something to postpone.

This Week's Action Point

Start by making a simple inventory of every AI model your organisation uses or modifies.

For each model, ask:

  • Are we using it as-is?
  • Have we made significant modifications?
  • Could those modifications create provider obligations?

If there's any uncertainty, it's worth getting legal advice before the Commission's enforcement powers begin on 2 August 2026.

Further Reading

  • artificialintelligenceact.eu/gpai-guidelines-overview
  • European Commission GPAI Guidelines (18 July 2025): digital-strategy.ec.europa.eu/en/policies/guidelines-gpai-providers

Next Tuesday

The Watermarking Deadline Nobody Is Talking About

Why one EU AI Act deadline just became more urgent, not less.