GPAI obligations under the EU AI Act: Articles 53–55 explained

Since 2 August 2026 the European Commission can enforce the general-purpose AI (GPAI) chapter of the EU AI Act (Regulation (EU) 2024/1689) — with fines of up to 3% of worldwide turnover or EUR 15 million for model providers. The obligations themselves have applied since 2 August 2025, but the past year was a soft-launch period without Commission fining powers. That period is over. Here is what Articles 53–55 actually require, who they catch (including fine-tuners), and how the 10^25 FLOPs systemic-risk threshold works.

Who is a GPAI provider?

Article 3(63) defines a GPAI model as one that “displays significant generality” and can “competently perform a wide range of distinct tasks” — think large language models, image and audio generators. You are a providerif you develop such a model (or have it developed) and place it on the EU market under your name, whether paid or free. The Commission's GPAI guidelines add two practical clarifications:

• Fine-tuners can become providers.If your modification of an existing model uses significant compute — the guidelines' indicative threshold is more than one third of the original training compute — you become the provider of a new GPAI model with your own Article 53 duties for the modification.
• An indicative entry threshold. Models trained with more than 10²³ FLOPs that can generate language, text-to-image or text-to-video are indicatively presumed to be GPAI models.

If you only deploysomeone else's model through an API, Articles 53–55 do not bind you — but the Article 50 transparency duties may, and those carry their own 2 December 2026 marking deadline. Run the free 3-minute check to see which paragraphs apply to you.

Article 53: the four duties of every GPAI provider

1. Technical documentation for the AI Office (Article 53(1)(a), Annex XI): training and testing process, evaluation results, compute, energy consumption — kept up to date and provided to the AI Office or national authorities on request.
2. Documentation for downstream providers(Article 53(1)(b), Annex XII): what integrators need to understand the model's capabilities and limitations and to meet their own AI Act duties.
3. A copyright policy (Article 53(1)(c)): a policy to comply with EU copyright law, including honouring text-and-data-mining opt-outs under Article 4(3) of Directive (EU) 2019/790.
4. A public training-content summary(Article 53(1)(d)): a sufficiently detailed summary of the content used for training, using the Commission's official template.

Open-source partial exemption: models released under a free and open-source licence with publicly available weights, architecture and usage information are exempt from duties (a) and (b) — but never from the copyright policy or the training-data summary, and never if the model has systemic risk (Article 53(2)).

Article 54 adds that providers established outside the EU must appoint an authorised representative in the Union before placing their model on the EU market.

Article 55: systemic risk and the 10^25 FLOPs threshold

A GPAI model is presumed to have systemic risk when its cumulative training compute exceeds 10²⁵ FLOPs (Article 51(2)) — roughly the scale of today's frontier models — or when the Commission designates it under the Annex XIII criteria. Providers must notify the Commission within two weeks of meeting the threshold (Article 52). On top of Article 53, these providers must:

• perform state-of-the-art model evaluations, including adversarial testing;
• assess and mitigate possible systemic risks at Union level;
• track and report serious incidents to the AI Office without undue delay;
• ensure adequate cybersecurity for the model and its physical infrastructure.

The GPAI Code of Practice: the practical compliance route

The GPAI Code of Practice (chapters on transparency, copyright, and safety & security) is the voluntary tool the Commission points providers to for demonstrating compliance with Articles 53 and 55. Signatories — including most major model providers — get a recognised, streamlined pathway; non-signatories must demonstrate compliance by other adequate means and can expect more scrutiny. This mirrors the transparency-side Code of Practice on AI-generated content.

Enforcement and fines since 2 August 2026

Enforcement of Articles 53–55 is centralised at the Commission (AI Office), not national authorities (Article 88). Since 2 August 2026 the Commission can request information and model access, order corrective measures, and fine GPAI providers up to 3% of worldwide annual turnover or EUR 15 million, whichever is higher (Article 101). Two dates to keep straight:

• Models placed on the market on or after 2 August 2025: obligations apply now, enforcement powers are live.
• Models already on the market before 2 August 2025: providers have until 2 August 2027 to comply (Article 111(3)).

For the full penalty landscape — including the separate Article 99 tiers for prohibited practices and transparency breaches — see the fines calculator and our penalties guide.

What to do this quarter

1. Determine whether you are a GPAI provider (including via significant fine-tuning) or only a deployer — the checker maps your Article 50 duties either way.
2. If provider: assemble Annex XI/XII documentation, publish your copyright policy and training-content summary on the official template, and appoint an EU authorised representative if you are established outside the Union.
3. Estimate cumulative training compute; if you are near 10²⁵ FLOPs, prepare the two-week Commission notification.
4. Decide on the GPAI Code of Practice — signing is the lowest-friction way to evidence compliance.

This guide is general information, not legal advice. Sources: the AI Act on EUR-Lex, the Commission's AI Office pages and the GPAI guidelines.