What are the EU AI Act rules for general-purpose AI models?

Providers of general-purpose AI models must keep technical documentation, give downstream providers the information they need, have a policy to comply with EU copyright law, and publish a sufficiently detailed summary of the content used for training (Article 53). Models with systemic risk must also evaluate and mitigate those risks, track and report serious incidents, and ensure cybersecurity (Article 55). These obligations have applied since 2 August 2025.

How it works

1. Work out whether you provide a model or build on someone else's. Most businesses build on models, which makes them providers or deployers of AI systems, not of models.
2. If you fine-tune or modify a model substantially, check whether you have become its provider.
3. Keep the documentation your model provider gives you, as you may need it for your own system.