The EU Artificial Intelligence Act imposes transparency, copyright-policy and training-data-summary obligations on providers of general-purpose AI (GPAI) models, applicable from 2 August 2025. The European Commission is to facilitate a code of practice that gives these principle-based duties an operational path. For model providers, the preparation window is already open.
Who the GPAI rules apply to
The obligations target providers placing general-purpose AI models on the EU market, including providers outside the EU. The key questions are whether a model has general-purpose capability, whether it is used in the EU, and whether the company is a provider or a downstream deployer in the chain. A wrong role assessment misaligns the rest of the obligation list. Groups should also decide early which entity carries documentation and communication duties.
Three core obligations
Transparency requires providers to explain model capability, limitations and appropriate use to downstream users. A copyright policy requires a mechanism for complying with copyright law, particularly regarding protected works in training data. A training-data summary requires a sufficiently detailed description of training content. The three are connected: all point to explainability. Explaining clearly presupposes that records exist internally, so documentation work cannot be separated from data governance.
The status of the code
The code of practice is facilitated by the Commission with multiple participants. It is not legislation, but it will be an important reference for assessing compliance. Following the code generally helps demonstrate that obligations are met, but it is not an absolute safe harbour. Companies should treat the draft code as a template for designing compliance processes rather than waiting for the final text. If the code is not finalised before the obligations apply, preparation must still proceed on the basis of the statutory provisions.
The preparation window
There is still time before the obligations apply, but building training-data summaries and copyright mechanisms spans model versions. Starting now to organise data sources, licence records and copyright measures leaves more room than catching up near the deadline. Companies serving both Chinese and EU markets must also reconcile two filing and documentation systems so that the same model is not described inconsistently in different markets.
Knock-on effects for deployers
GPAI obligations mainly fall on providers, but downstream deployers are not entirely unaffected. Providers must explain model capability and limitations downstream, while deployers must meet their own transparency and risk-management duties in specific applications. If a deployer fine-tunes a general model for a specific use, its role may change. Procurement contracts should specify model documentation, use restrictions and responsibility allocation, so that upstream information can be produced during a regulatory inquiry. Companies that both develop and procure models should align the two sets of documents, so that the same product is not described at different risk levels. For companies offering model capability via API, downstream use is hard to control fully, which makes terms of use and an acceptable-use policy part of how the obligations are implemented.
For GPAI obligations and documentation, see our EU AI Act service and IP protection service; for cross-border data and training-data arrangements, see GDPR cross-border service.
This article is based on the general-purpose AI provisions of the EU Artificial Intelligence Act and public information from the European Commission in 2024. It is for reference only and does not constitute legal advice.