General-Purpose AI Models: Provider Duties

Who counts as a provider of general purpose AI models

Providers of general purpose AI models have been subject to specific obligations under Chapter V of the AI Act (Regulation (EU) 2024/1689) since 2 August 2025. A general purpose AI model (GPAI model) is an AI model that displays significant generality, can competently perform a wide range of distinct tasks and can be integrated into a variety of downstream systems or applications (Article 3(63)). Large language models and image, audio and video generation models are the typical examples. Models used only for research, development or prototyping before being placed on the market are excluded.

The Commission's guidelines for providers of general purpose AI models of 18 July 2025 give an indicative criterion: a model trained with computational resources exceeding 10^23 floating point operations that can generate language (text or audio), text-to-image or text-to-video. The guidelines also explain who is a provider and what counts as placing on the market. For German companies, the key question is often whether they are merely users of a model, downstream providers integrating it into their own systems, or providers in their own right — for example because they place a model on the market under their own name or substantially modify an existing model.

Obligations of all GPAI providers

Article 53(1) requires every provider of a GPAI model to:

• draw up and keep up to date technical documentation of the model, including training, testing and evaluation results, containing at least the information in Annex XI, for the AI Office and national authorities on request;
• draw up and make available information and documentation to downstream providers who intend to integrate the model, enabling them to understand its capabilities and limitations and to comply with their own obligations (Annex XII);
• put in place a policy to comply with EU copyright law, in particular to identify and respect reservations of rights for text and data mining under Article 4(3) of the Copyright in the Digital Single Market Directive (EU) 2019/790;
• draw up and publish a sufficiently detailed summary of the content used for training, according to a template provided by the AI Office.

Providers established outside the EU must appoint an authorised representative in the Union by written mandate before placing a model on the EU market (Article 54).

Open-source models

Providers of models released under a free and open-source licence that allows access, use, modification and distribution, and whose parameters, including weights, architecture information and usage information, are publicly available, are exempt from the documentation duties in Article 53(1)(a) and (b). They must still comply with the copyright policy and training summary obligations. The exemption does not apply to models with systemic risk (Article 53(2)).

General purpose AI models with systemic risk

A GPAI model is classified as having systemic risk if it has high-impact capabilities or if the Commission designates it on the basis of the criteria in Annex XIII (Article 51(1)). High-impact capabilities are presumed where the cumulative training compute exceeds 10^25 floating point operations (Article 51(2)). The provider must notify the Commission without delay and in any event within two weeks after the threshold is met or it becomes known that it will be met, and may argue that the model exceptionally does not present systemic risks (Article 52).

Providers of such models must additionally perform state-of-the-art model evaluations, including adversarial testing; assess and mitigate systemic risks at EU level; track, document and report serious incidents to the AI Office without undue delay; and ensure adequate cybersecurity for the model and its physical infrastructure (Article 55). Only a small number of very large models are likely to fall into this category, but the obligations matter for German companies that work with such models, since downstream information and incident reporting flow through the value chain.

The Code of Practice and compliance options

Providers may rely on codes of practice under Article 56 to demonstrate compliance until harmonised standards are published. The General Purpose AI Code of Practice, published in July 2025, contains chapters on transparency, copyright and safety and security. Signing the code is voluntary, but providers that do not adhere to an approved code or a harmonised standard must demonstrate alternative adequate means of compliance (Article 55(2) and the corresponding rule in Article 53(4)). According to Article 101(1), commitments made in codes of practice are taken into account when fines are set.

Copyright policy and the training summary in Germany

The copyright obligations are where general purpose AI regulation meets German copyright law. The text and data mining exception for commercial purposes in § 44b of the German Copyright Act (Urheberrechtsgesetz, UrhG) implements Article 4 of Directive (EU) 2019/790: reproductions for text and data mining are permitted unless the rightholder has reserved its rights, and for works available online the reservation must be in machine-readable form. A GPAI provider's copyright policy must ensure that such reservations are identified and respected.

German courts have begun to address these questions. The Hanseatic Higher Regional Court dismissed an appeal concerning the creation of the LAION training dataset on 10 December 2025 (5 U 104/24), according to the court's press release, and admitted an appeal to the Federal Court of Justice.

In GEMA v OpenAI (judgment of 11 November 2025 – 42 O 14139/24), the Regional Court of Munich I found that song lyrics memorised in language models and reproduced in outputs infringed copyright, according to the court's press release. Both cases show that compliance with the AI Act's copyright policy duty does not settle liability under national copyright law. Providers and their customers should therefore treat AI Act compliance and copyright risk management as two separate workstreams. See our insight on text and data mining.

Data protection in model training

Where training data include personal data, the GDPR applies alongside the AI Act. Providers need a legal basis for collecting and processing training data, typically legitimate interests under Article 6(1)(f) GDPR, and must respect data subjects' rights, transparency obligations and data minimisation.

The European Data Protection Board addressed these questions in its Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models, including when a model can be considered anonymous and the consequences of unlawful processing during development for the later use of the model. German data protection authorities have also published guidance on AI.

A training content summary under Article 53(1)(d) does not replace the information duties under Articles 13 and 14 GDPR. Providers should therefore align the two documents: the public summary describes the main data sources and collections in general terms, while the data protection notices explain the processing of personal data, the legal basis and how data subjects can exercise their rights, including objection to the use of their data for training.

Enforcement and the Digital Omnibus

The Commission, through the AI Office, has exclusive competence to supervise and enforce the obligations of GPAI model providers (Article 88). Since 2 August 2026, it can impose fines of up to 3% of total worldwide annual turnover or EUR 15 million, whichever is higher, for intentional or negligent infringements, failure to provide information, non-compliance with requested measures or refusal of access for evaluations (Article 101). Models placed on the market before 2 August 2025 must comply by 2 August 2027 (Article 111(3)).

The Digital Omnibus on AI (Regulation (EU) 2026/1744) did not change the core GPAI duties but extended the AI Office's exclusive competence to AI systems based on GPAI models where the model and the system are developed by the same provider or within the same group, with exceptions for certain sensitive areas, and to AI systems that constitute or are integrated into very large online platforms or search engines. For German companies that build applications on their own models, this means the AI Office rather than the Federal Network Agency may become their supervisor. See our insight on the AI Act timeline.

Downstream providers and contracts

Most German companies are not GPAI providers but downstream providers or deployers who build AI systems on third-party models. For them, the information that GPAI providers must supply under Annex XII is essential to meet their own obligations, for example for high-risk systems or transparency duties.

Contracts with model providers should secure access to this information, address updates and model changes, allocate responsibility for copyright and data protection, and include warranties and indemnities appropriate to the use case. Where a company fine-tunes a model for its own internal use only, it is generally not placing a model on the market, but it remains a deployer of any AI system it uses.

Practical steps

1. Map all AI models the company develops, adapts or uses, and record the role it plays for each, as provider, downstream provider or deployer.
2. For models the company provides, prepare Annex XI and Annex XII documentation, a copyright policy and a training content summary.
3. Check compute thresholds and notification duties for large models.
4. Decide whether to sign the Code of Practice or document alternative means of compliance.
5. For third-party models, secure contractual access to downstream information and allocate copyright and data protection risks.
6. Monitor case law on training data and outputs, including the pending appeal to the Federal Court of Justice in the LAION case.

How TRW & Co helps with general purpose AI

We advise providers and downstream users of general purpose AI models on classification, Chapter V obligations, copyright policies and training content summaries, and the implications of the Code of Practice. We review and negotiate model licences and API terms, advise on copyright and data protection in AI training, and represent clients in proceedings before the AI Office and German courts. See our pages on the AI Act and IP and patents, or contact us.