GPAI under the AI Act: Articles 53 and 55 for model providers

The EU AI Act regulates general-purpose AI at two levels that are easy to conflate: the model (Articles 53–55 — duties for whoever provides the model itself) and the systems built on top of it (the ordinary risk-tier rules). Most companies touching GPAI are downstream users of models — their duties are system-level. But if you train, substantially fine-tune, or release a general-purpose model, the model-level stack is yours.

Article 53: every GPAI provider

• Technical documentation of the model — training and testing process, evaluation results — kept for the AI Office and national authorities.
• Downstream documentation — information enabling system builders on top of your model to understand its capabilities, limitations and their own obligations.
• Copyright policy — a policy to comply with EU copyright law, including respecting text-and-data-mining opt-outs.
• Training-content summary — a sufficiently detailed public summary of training data, per the AI Office template.

Article 55: models with systemic risk

A model is presumed to carry systemic risk when its training compute exceeds 10²⁵ FLOPs, or when the Commission designates it. On top of Article 53, its provider must run state-of-the-art model evaluations including adversarial testing, assess and mitigate systemic risks at Union level, track and report serious incidents to the AI Office, and ensure adequate cybersecurity for the model and its infrastructure.

Where companies get the boundary wrong

• “We use an LLM, so we’re GPAI-regulated” — no; your application’s use context sets your tier. An LLM-powered hiring screener is Annex III high-risk because of what it does, not what powers it.
• “We fine-tuned it, but it’s the base model’s problem” — a substantial modification placed on the market can make you provider of the modified model.
• “Open weights means exempt” — the open-source carve-out is partial and vanishes at systemic-risk scale.
• Forgetting Article 50 — GPAI-powered chatbots and content generators still owe user disclosure and machine-readable marking of synthetic output, enforceable since 2 August 2026.

The GPAI chapter is where roles decide everything: the same model can put four different companies under four different obligation sets. Establish your role per system first — the checklist sequences the rest.