What is a general-purpose AI model (GPAI)? The EU AI Act term, defined

A general-purpose AI model (GPAI) is the EU Artificial Intelligence Act's term for an AI model that shows significant generality, can competently perform a wide range of distinct tasks and can be built into many downstream systems. Providers of such models carry their own obligations under Chapter V of the Act, which have applied since 2 August 2025.

The legal test

Article 3(63) of Regulation (EU) 2024/1689 turns on capability, not on how the model is sold. A model counts if it "displays significant generality and is capable of competently performing a wide range of distinct tasks", including models trained on large data sets with self-supervision. Models used only for research, development or prototyping before they reach the market are excluded.

The model is distinct from the product built on it. The Act calls an AI system based on such a model a general-purpose AI system. A subset of models is classed as general-purpose AI models with systemic risk: under Article 51, a model is presumed to have the necessary high-impact capabilities when the compute used to train it exceeds 10²⁵ floating-point operations, and the Commission can also designate models.

What providers must do

Article 53 requires every GPAI provider to keep technical documentation, give downstream providers the information they need to understand the model's capabilities and limitations, adopt a copyright policy and publish a summary of training content. Open-source models are spared the first two duties unless they carry systemic risk.

Article 55 adds four duties for systemic-risk models: evaluation including documented adversarial testing, assessment and mitigation of systemic risks, reporting serious incidents to the AI Office, and an adequate level of cybersecurity protection for the model and its physical infrastructure.

The European Commission's guidelines page for GPAI providers sets the timeline: obligations applied from 2 August 2025, the Commission's enforcement powers apply from 2 August 2026, and models placed on the market before 2 August 2025 must comply by 2 August 2027.

Why it matters to a CISO

For an organization that integrates a GPAI model rather than providing one, the most useful clause is Article 53(1)(b): the documentation a provider must hand to anyone integrating its model. That material belongs in AI vendor due diligence. For systemic-risk models, Article 55's cybersecurity and incident duties sit with the provider, but they shape what a buyer can ask for in contracts.

Where it appears on cisonews.ai

The regulation tracker records the date GPAI obligations started to apply, the General-Purpose AI Code of Practice and the Commission's guidelines for GPAI providers. The EU AI Act compliance calendar lists every confirmed deadline.

Related terms

High-risk AI system, AI red teaming and agentic AI.