European Union - General-Purpose AI Guidelines

Overview

The European Commission's "Guidelines on the scope of obligations for providers of general‑purpose AI models" (published July 2025) clarify how selected provisions of the Artificial Intelligence Act apply to general‑purpose AI (GPAI). They form part of a package that also includes the independent General‑Purpose AI Code of Practice and Commission Q&As, and are intended to reduce legal uncertainty for developers, cloud providers, downstream integrators and other stakeholders. The Guidelines explain the GPAI definition (a compute threshold of 10^23 floating point operations combined with generative capabilities such as language, text‑to‑image or text‑to‑video), identify who is a ‘provider’ (developers, distributors, and in specific cases, actors who materially modify models), set out the documentation, transparency and copyright policy duties for all GPAI providers, and detail the enhanced model evaluation, systemic risk management and cybersecurity obligations for GPAI models deemed to pose systemic risks. The Commission positions the Guidelines as an interpretative tool to guide enforcement by the European AI Office and national competent authorities, while encouraging voluntary adherence to the General‑Purpose AI Code of Practice as a practical means of demonstrating compliance with Articles 53 and 55 of the AI Act.

Definitions

The Guidelines operationalise central terms from the AI Act. "General‑purpose AI model" is defined by the Commission as a model trained with compute exceeding 10^23 floating point operations and capable of generating language (text or audio), text‑to‑image or text‑to‑video. "Provider" generally refers to the actor that develops and makes the GPAI model available to others (including by API, library, download or physical media), but the Guidelines also describe when an actor that fine‑tunes, modifies or redistributes a model becomes a provider. "Placing on the market" is understood broadly to include making models available in the Union market by any technical means, whether the provider is established in the Union or in a third country.

Governance and Institutional Framework

The Guidelines explain roles and coordination mechanisms among EU institutions and national authorities. The AI Office (European Commission) is the primary EU‑level enforcement and coordination body for GPAI obligations; it will operate alongside the European Artificial Intelligence Board and national competent authorities and market surveillance authorities. The AI Office is empowered by the AI Act to request information, access models (including via APIs or access tools), carry out model evaluations, and, in coordination with Member States, impose measures and sanctions in line with Article 101. The Guidelines also discuss confidentiality protections for documentation and trade secrets and cross‑border cooperation arrangements for supervision and incident responses.

Key Focus Areas

The Guidelines concentrate on four areas: (1) how to identify GPAI models (compute threshold + generative capability); (2) who is a provider and what counts as placing on the market; (3) exemptions and special conditions for open‑source releases (public availability of parameters/weights/architecture can exempt providers from certain obligations under Article 53, but not where systemic risk is present); and (4) the enforcement approach, including the role of voluntary adherence to the General‑Purpose AI Code of Practice in the first year after entry into application. For GPAI models with systemic risk, the Guidelines stress standardised model evaluation, adversarial testing, Union‑level systemic risk assessment and mitigation, cybersecurity expectations, and robust post‑market monitoring and incident reporting to the AI Office and national authorities.

Implementation Framework

The Commission sets out practical and phased expectations. Obligations for GPAI providers (Article 53 AI Act) apply from 2 August 2025; the AI Office will prioritise cooperative engagement during the first year (2 August 2025–2 August 2026) particularly with providers who commit to the Code of Practice; and full enforcement powers (including fines) are in scope from 2 August 2026. Providers established outside the Union must appoint an authorised representative in the Union prior to placing GPAI models on the Union market. Providers can rely on approved Codes of Practice or harmonised European standards to demonstrate compliance; otherwise they must show alternative adequate means of compliance for Commission assessment.

Monitoring and Evaluation

The Guidelines describe the mechanisms for ex‑ante and ex‑post evaluation. The AI Office can request information and access to models, perform evaluations using APIs and technical tools, and use independent experts. For systemic‑risk GPAI models, providers must maintain detailed technical documentation, carry out standardised evaluations including adversarial testing, keep incident logs, and notify serious incidents without undue delay. Market surveillance authorities and national competent authorities cooperate with the AI Office to monitor compliance; confidentiality and protection of trade secrets are guaranteed under the AI Act's Article 78 provisions.

Penalties, Liability, and Appeals

While the Guidelines are interpretative and non‑binding, the AI Act contains clear enforcement mechanisms. Article 101 empowers the Commission to impose fines on GPAI providers of up to 3% of worldwide annual turnover or EUR 15,000,000 (whichever is higher) for specified infringements (intentional or negligent breaches, failures to comply with information requests or access measures, failure to provide access for evaluations). More severe or specific prohibited practices may attract higher fines under other AI Act provisions (for the most serious prohibited practices fines can reach EUR 35,000,000 or 7% of turnover). Providers have procedural safeguards and appeal routes through EU courts; the Guidelines outline expectations of cooperation during investigations and note the Commission's preference for early voluntary compliance where feasible.

Relationship to Other Instruments

The Guidelines connect to multiple EU legal instruments and initiatives: they interpret Articles 53 and 55 of the AI Act, complement the General‑Purpose AI Code of Practice, and work alongside the AI Office's tools (service desk, compliance checker) and forthcoming harmonised standards and implementing acts. They also reference other Union legislation relevant to copyright, trade secrets and data protection; providers must ensure compliance across these regulatory regimes when placing models on the Union market.

International Alignment

The Guidelines acknowledge international cooperation needs and encourage codes of practice and standards that align with global approaches. The AI Office and the AI Board will engage internationally to facilitate interoperability of oversight, share best practices, and avoid fragmentation. The Guidelines also emphasise that extraterritorial application will occur where providers place models on the EU market: non‑EU providers must appoint Union representatives and comply with EU obligations, which creates an international reach intended to protect Union fundamental rights and safety while encouraging global regulatory convergence.

Implementation Timeline

Sources and References