General-Purpose AI Models
What is General-Purpose AI Models?
General-purpose AI (GPAI) models are AI models, such as large language models, that can perform many different tasks and be built into many systems, and that face specific EU AI Act obligations.
Updated November 2026 · 5 min read
Most AI systems are built for a specific purpose, such as detecting fraud or recommending products. General-purpose AI models are different. A large language model or multimodal model can write, summarize, translate, code, analyze images and answer questions, and it can be built into thousands of different applications by other companies. That flexibility makes these models powerful, but it also means their providers cannot foresee every use. The EU AI Act addresses this by placing obligations on providers of general-purpose AI models themselves, in addition to the rules that apply to the AI systems built on them.
The obligations for general-purpose AI models have applied since August 2, 2025, with models already on the market before then given until August 2, 2027 to comply. The European Commission's AI Office supervises these providers, and its powers to impose fines took effect in August 2026. A General-Purpose AI Code of Practice, published in July 2025, offers providers a way to demonstrate compliance. For organizations that build on these models, as well as those that provide them, understanding these rules is important for contracts, documentation and risk management.
Definition of General-Purpose AI Models
Under the EU AI Act, a general-purpose AI model is an AI model, typically trained on large amounts of data using self-supervision at scale, that displays significant generality, can competently perform a wide range of distinct tasks and can be integrated into a variety of downstream systems or applications.
These models are regulated separately from the EU AI Act risk categories for AI systems, are governed under the wider EU AI Act and are a key part of AI model governance for organizations that use them.
Obligations for All GPAI Providers
Providers must prepare and maintain technical documentation about the model, including its training and testing, for the AI Office and national authorities on request.
They must give downstream providers information and documentation that helps them understand the model's capabilities and limitations and meet their own obligations.
They must have a policy to comply with EU copyright law, including respecting rights holders' opt-outs from text and data mining.
They must publish a sufficiently detailed summary of the content used to train the model, using a template from the AI Office.
Providers of certain open-source models are exempt from some of these duties, unless their models pose systemic risk.
Models With Systemic Risk
Some general-purpose AI models are classified as posing systemic risk because of their high-impact capabilities. A model is presumed to have such capabilities when the computing power used to train it exceeds 10 to the power of 25 floating-point operations, and the Commission can also designate models.
Providers of these models must evaluate them, including through adversarial testing, and assess and mitigate systemic risks.
They must track and report serious incidents to the AI Office and national authorities. Reporting allows authorities to spot risks that affect many downstream users.
They must ensure an adequate level of cybersecurity for the model and its infrastructure.
Importance of General-Purpose AI Models in AI Governance
GPAI rules shape the AI supply chain. Most organizations build on models from a small number of providers, so the documentation and safeguards those providers supply affect everyone downstream.
They support downstream compliance. Information from GPAI providers helps organizations building AI systems on these models meet their own obligations, including for high-risk uses.
They also highlight concentration risk. Dependence on a few powerful models makes their reliability, security and governance a concern for regulators and customers alike.
General-Purpose AI Models and Financial Management
Providers face significant compliance costs, which may be reflected in pricing for model access.
Fines for GPAI providers can reach 15 million euros or 3% of worldwide annual turnover, whichever is higher. The AI Office enforces these rules directly.
Organizations building on GPAI models should budget for reviewing provider documentation, testing models for their own uses and adapting contracts.
Choosing providers with strong documentation and safeguards can reduce downstream compliance work and risk, a factor alongside inference cost.
Common Challenges
The line between a general-purpose model and a system built on it can be unclear, especially when organizations fine-tune models. Guidance from the Commission helps clarify where the line falls.
Organizations that substantially modify a model may take on provider obligations themselves. Fine-tuning plans should therefore include a legal review.
Training data summaries and copyright policies are new requirements, and practice is still developing. Rights holders and providers continue to debate what level of detail is sufficient.
How to Manage General-Purpose AI Models
Managing general-purpose AI models involves knowing which models the organization uses or provides, understanding the obligations that apply, reviewing provider documentation and governing downstream uses.
Organizations should treat the choice of model provider as a governance decision as well as a technical and commercial one. Provider transparency affects how easily the organization can meet its own obligations.
For Organizations Using GPAI Models
Record every general-purpose model in use in the AI inventory, including the provider, version and the systems built on it.
Request and review the provider's documentation, such as model cards, usage policies and training data summaries, and check whether the provider has signed the Code of Practice.
Test models for the organization's own uses, and check whether fine-tuning or modification could make the organization a provider with its own obligations.
For Organizations Providing GPAI Models
Prepare technical documentation, downstream information, a copyright policy and a public training data summary.
Assess whether the model meets the systemic risk threshold and, if so, put evaluation, risk mitigation, incident reporting and cybersecurity measures in place.
Consider adhering to the Code of Practice as a way to demonstrate compliance, and engage with the AI Office.
Examples of General-Purpose AI Models in Practice
The examples below show how organizations handle general-purpose AI models.
Both use illustrative figures. The first reviews provider documentation, and the second assesses fine-tuning.
In each, understanding GPAI rules shaped decisions.
Reviewing Provider Documentation
A European bank builds a customer service assistant on a commercial language model.
Its review of the provider's documentation shows clear information on capabilities, limitations and acceptable use, and confirms that the provider has signed the Code of Practice.
The bank uses this information in its own risk assessment and transparency notices, and records the model and version in its AI inventory.
Assessing Fine-Tuning
A software company fine-tunes an open-weight model on its own data and offers it to customers through an API.
Legal review concludes that the company may be considered a provider of a general-purpose AI model for the modified version.
The company prepares technical documentation, a training data summary and a copyright policy for the fine-tuned model before expanding its offering in the EU.
Conclusion
General-purpose AI models are AI models, such as large language models, that perform a wide range of tasks and can be built into many systems. Under the EU AI Act, their providers must supply documentation, downstream information, a copyright policy and a training data summary, with extra duties for models posing systemic risk.
In AI governance, GPAI rules shape the AI supply chain, support downstream compliance and highlight concentration risk. Recording models in the inventory, reviewing provider documentation, testing for the organization's own uses and checking whether modifications create provider obligations help organizations manage general-purpose AI models.
Related terms
EU AI Act Risk Categories
The tiers the EU AI Act uses, from prohibited to minimal risk.
EU AI Act
The EU's risk-based law that bans some AI uses and regulates others.
AI Model Governance
Managing models from development or purchase through approval and retirement.
AI Inventory
A central register of every AI system and tool in use, with owners and risks.