The EU’s Artificial Intelligence Act is rolling out in stages, and we are now fast approaching an important milestone. As of 2 August 2025, new regulations will come into effect, impacting developers and providers of AI systems, particularly those working with General Purpose AI (GPAI) models. These foundational models underpin many AI solutions across industries, so the new rules will apply not only to their original creators but also to anyone adapting or embedding them into their own products.
But if your GPAI model qualifies as a “systemic risk” heavyweight, think massive scale and influence, you will face stricter obligations: risk assessments, independent security audits, and close monitoring of how your AI impacts fundamental rights.
No pressure, but for the first time in the history of AI, the EU is watching.
What does it fall under the GPIA model?
A GPAI model is defined under the EU AI Act as an AI model that regardless of how it is placed on the market or put into service is trained on a broad range of data using self-supervised or other learning methods and is capable of performing a wide array of distinct tasks. These models are not designed or optimized for a single, specific function but are intended to be integrated into or form part of various downstream AI systems or applications across different domains.
The Act also defines a special subcategory: GPAI models with systemic risk. This includes models that either:
- Possess exceptionally high computational power measured by a training threshold exceeding 10²⁵ floating point operations (FLOPs) used as a proxy for scale and capability; or
- Pose significant risks to public interest (e.g. safety, public health, fundamental rights, security, or democratic processes) due to their widespread use and broad applicability.
These high-impact models are subject to stricter transparency, safety, and documentation requirements under the Act, reflecting the potential scale of their societal influence.
So, Who is in the Hot Seat?
If you are building or fine-tuning the Godzilla-sized AI models of our time, the EU has you squarely in its sights. The “systemic risk” label under the AI Act comes with real obligations to get your house in order.
First in line are the big brains with even bigger GPUs, think OpenAI, Google DeepMind, Meta. If you’re training models that burn through more FLOPs than most countries use in a year, welcome to the exclusive systemic risk club.
Think you’re safe because you didn’t train a mega-model from scratch? Think again. If you fine-tune, modify, or even rebrand one of these high-impact models and release it under your own name, congratulations you may be a GPAI provider in the EU’s eyes. That chatbot you adapted from an open-weight model? If it’s powerful and general-purpose enough, you’re in the club too.
Systemic risk doesn’t just raise the pressure on companies; it also raises the bar for regulators. The new AI Office and national authorities must now act as part lawyer, part computer scientist, and part risk manager. Their responsibility? Identify which models pose systemic risk, oversee compliance, and step in when necessary.
And Everyone Else…
Even if you are on the sidelines, systemic risk rules may soon shape your day-to-day. If you are buying AI tools, you will start asking: Is this model compliant? Could this get me into trouble? If you are building apps, services, or hardware powered by GPAIs, expect the ripple effects to hit your shores too. Put simply: the EU isn’t just regulating models. It is regulating power in the AI ecosystem.
The Scale Divide: Labs vs. SMEs
For the major labs, the implications are clear. They are training enormous models from scratch using supercomputing clusters, and they clearly fall into the GPAI systemic risk category. Yes, the compliance load is heavy but these companies already have armies of lawyers, policy experts, and ethics ready to tackle it. Things get murkier for SMEs, research labs, and open-source developers. These players may not have hit the 10²⁵ FLOPs threshold, but they could still be caught in the regulatory web.
Say you fine-tune an open-weight model (like Meta’s LLaMA or Mistral) and use it in a chatbot, writing assistant, or health tech tool. If you deploy that product under your company name and it performs a variety of general-purpose tasks regulators might treat you as a GPAI provider.
The problem? SMEs don’t have in-house compliance departments. They can’t afford three-month legal reviews before each release. And without clearer carve-outs or guidance, they risk being held to standards designed for trillion-parameter giants.
Why This Matters?
The lack of clarity risks chilling innovation not at the top, but in the middle and bottom of the ecosystem. While the AI Act rightly targets frontier risks, its definitions could unintentionally rope in the very players Europe says it wants to support: its startups, open-source developers, and SMEs driving responsible experimentation.
What is needed is guidance that reflects the difference between modifying a GPAI model lightly (e.g., prompt-tuning for a narrow use case) and creating a model that genuinely warrants systemic oversight. Otherwise, we risk asking a local EdTech startup to comply like it’s OpenAI and that’s not just unfair; it’s unsustainable.
AI Act’s Code of Practice: Transparency, Copyright & a Bit of Contained Panic
To help navigate the maze, the European Commission introduced a Code of Practice. It’s technically voluntary (for now), but if you’re a major model developer eyeing compliance, regulatory goodwill, or simply a smooth relationship with the AI Office, you’re expected to treat it less like a suggestion and more like a guidelines to follow.
Transparency
All GPAI model providers , systemic risk or not , must now commit to a kind of radical transparency that would make most secretive AI labs shke, Under the Code, signatories must:
- Maintain detailed and up to date model documentation. This documentation must be robust, secure, and detailed enough to satisfy both downstream developers and the EU’s AI Office.
- To keep things tidy, the Code even includes a fully interactive Model Documentation Form.
- Provide relevant information to downstream providers and to the AI Office (on request, of course .
Copyright: No More ‘Oops, We Trained on That’
This is where the Code stops being polite and starts getting legal. Every GPAI provider must now adopt, maintain, and enforce a copyright compliance policy. This is already directly required under the AI Act and includes:
- Only crawling lawfully accessible content , say goodbye to the wild-west days of scraping without looking.
- Respecting robots.txt and other opt-out signals from rightsholders.
- Staying away from piracy domains.
- Minimizing the risk of producing copyright-infringing outputs. That includes fine-tuning guardrails and not parroting licensed material.
- Appointing a copyright point of contact and establishing a complaint mechanism
This is a big shift, especially for labs that previously treated copyright compliance like a backend housekeeping issue. Now, it’s front and center with documentation and potential reputational consequences to match.
Safety and Security: For the Big Kids Only
This section applies only to GPAI providers whose models pose a systemic risk a fuzzy but important threshold in the AI Act. You are signing up for:
- A full Safety and Security Framework, covering risk assessment, mitigation, and internal governance.
- Evaluating risk across the entire model lifecycle not just during training or deployment.
- Building in state-of-the-art safety mitigations including technical and security measures to prevent model weight leaks.
- Producing a Safety and Security Model Report for each high-risk model.
- Appointing internal responsibility-holders and submitting to independent third-party assessments (with narrow exceptions).
- Monitoring for “serious incidents,” adopting anti-retaliation protections, and keeping the AI Office in the loop at key milestones.
And if a systemic risk issue could meaningfully impact public understanding? You will be expected to disclose it publicly.
What will happen to models already available on the market?
The AI Act offers important relief for GPAI models that were marketed before 2 August 2025; these need to be compliant with the AI Act by 2 August 2027. These models are exempt from having to apply the new obligations retroactively; for example, you won’t need to retrain or “de-train” models based on data used before that date.
2 August 2025 marks a key milestone for the entire AI ecosystem in the EU. If your organization incorporates GPAI models into its products, this is the critical time to assess your position in the supply chain and ensure your processes align with the upcoming requirements.
So What is the Takeaway?
The Code of Practice might sound like a polite framework, but its terms are anything but soft. For GPAI providers especially those anywhere near the systemic risk zone this is rapidly becoming a de facto compliance playbook.
If you are a big lab, you are in. If you are a mid-sized developer with an LLM that’s gotten too clever for its own good, you’re probably in too. And if you’re not sure? Well, the AI Office is watching and they have a Model Documentation Form with your name on it.
If you need help understanding the EU AI Act and ensuring your company remains compliant, feel free to contact Compleye for tailored guidance and support.
Frequently Asked Questions
Does the EU AI Act apply to my SaaS company if we only use an AI model through an API?
Using a model through an API does not by itself make you a provider of a general-purpose AI (GPAI) model. The GPAI model obligations fall mainly on whoever develops the model. You may still have other responsibilities depending on how you use it, for example transparency duties or stricter rules if your use case is high-risk, and GDPR applies whenever personal data is involved. Check your specific use case with a qualified adviser.
When does fine-tuning a model make my company a GPAI provider?
Not every modification does. The Commission’s guidelines say a downstream modifier becomes a provider when the training compute used for the modification is more than one-third of the original model’s training compute. Light changes such as prompt tuning or small-scale fine-tuning usually fall well below that line. If you are unsure of the original model’s compute, the guidelines give fixed fallback thresholds, and a modifier who does become a provider is generally expected to comply only for its own modification.
When do the GPAI rules apply, and is the AI Office enforcing them yet?
GPAI provider obligations have applied since 2 August 2025. The Commission can only take enforcement action from 2 August 2026, so that power is now live. Models already on the market before August 2025 have until 2 August 2027 to comply.
What is the GPAI Code of Practice, and do we have to sign it?
The Code of Practice is a voluntary tool published by the European Commission to help GPAI providers meet their obligations. It covers transparency, copyright and, for the most capable models, safety and security. Signing it is not mandatory, but it gives providers a recognized way to show compliance and a smoother relationship with the AI Office. If you buy models, it is worth asking whether your vendor has signed.
What counts as a GPAI model with “systemic risk”?
The Act presumes systemic risk for models trained with more than 10^25 floating point operations, a proxy for scale and capability. Models can also be designated if they pose significant risks to public interest, such as safety, public health, fundamental rights or democratic processes. These models face stricter obligations, including risk assessment, security measures and incident monitoring.
