General-purpose AI models (like GPT, Claude, Gemini, Mistral)
What providers of general-purpose models must do, and what it means for companies that build on them.
A general-purpose AI (GPAI) model is a model that can do many different tasks, such as a large language model. Rules for GPAI model providers have applied since 2 August 2025.
What GPAI model providers must do
- Keep technical documentation about the model and give downstream developers the information they need.
- Have a policy to respect EU copyright law, including opt-outs from text and data mining.
- Publish a summary of the content used to train the model.
Models with systemic risk (by default, those trained with more than 10^25 floating-point operations, or designated by the Commission) must also evaluate and red-team the model, track and report serious incidents, and ensure strong cybersecurity. A voluntary Code of Practice published in July 2025 shows one way to comply.
If you build on a GPAI model
You're usually not the GPAI model provider: you're the provider or deployer of the AI system you build with it. Your duties depend on that system's use:
- An internal drafting assistant: minimal risk.
- A customer chatbot: transparency duties.
- A loan-decision assistant: high-risk, with you as provider.
Keep the model provider's documentation and usage policy on file for each system that uses it. V77 Trust flags systems built on a GPAI model and asks for this.
Fine-tuning
Fine-tuning or significantly modifying a GPAI model can make you a provider of the modified model. If your changes are modest, the duties are limited to what you changed. Get advice if you train on large amounts of new data.
This page explains the law to help you find your way. It isn't legal advice.