EU AI Act Article 53: GPAI Provider Obligations Explained

Updated 2 October 2026 — correction. Earlier versions put high-risk fines at €35M / 7% (they are €15M / 3%) and Articles 9–15 on deployers, cited Annex XIII for the systemic-risk duties (they are in Article 55), called 10²⁵ FLOP a definition (it is a presumption), treated the code of practice as required, made the training summary conditional on copyrighted data, omitted the duty to inform downstream providers and named models without a source. The guide now follows Articles 51, 53, 55 and 101 and the Commission’s published guidance.

Updated 31 July 2026 — correction. General-purpose AI obligations under Chapter V have applied since 2 August 2025. They are already in force, not upcoming. This article previously gave the wrong date. If you're building a general-purpose AI model (GPAI) and placing it on the EU market — through an API, a download or a product — Article 53 of the EU AI Act creates obligations that have applied since 2 August 2025. They are already in force.

Unlike Articles 9–15 (which apply to high-risk AI systems), Article 53 targets GPAI providers directly. It requires technical documentation, information for downstream providers, a copyright policy, a public summary of training content, and cooperation with the Commission and national authorities. Codes of practice are a voluntary way to show compliance.

This guide walks through what Article 53 actually requires, who it applies to, and what you need to have in place now that it applies.

---

Who Article 53 Applies To

Article 53 applies to providers of general-purpose AI models placed on the EU market, wherever the provider is established (Art. 2(1)(a)). Article 3(63) defines a GPAI model as:

an AI model, including where such an AI model is trained with a large amount of data using self-supervision at scale, that displays significant generality and is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market and that can be integrated into a variety of downstream systems or applications, except AI models that are used for research, development or prototyping activities before they are placed on the market

The Commission's guidelines for GPAI providers take as an indicative criterion training compute greater than 10²³ FLOP and the ability to generate language (text, including code, or audio), text-to-image or text-to-video; a model that can competently perform only a narrow set of tasks is not a GPAI model even above that figure.

In-Scope Examples

• Large language models offered through an API or as downloadable weights
• Multimodal and text-to-image or text-to-video models that meet the criterion above
• Code generation models trained broadly enough to perform a wide range of tasks

Out-of-Scope Examples

• A chatbot built on top of a third-party model (you're the provider of an AI system, not of the GPAI model)
• A narrow-domain model trained only for sentiment analysis
• An internal model not placed on the EU market

If you build on someone else's model (e.g., you use OpenAI's API to build a customer service bot), Article 53 does not apply to you directly. If your system is high-risk, you are its provider and Articles 9–15 set requirements it must meet (Art. 16); a deployer of a high-risk system has its own duties under Article 26.

---

Core Obligations Under Article 53

Article 53(1) sets four obligations for GPAI providers, and Article 53(3) adds a duty to cooperate. Codes of practice (Art. 53(4)) are optional.

1. Technical Documentation

You must draw up and keep up to date technical documentation of the model, containing at least the information in Annex XI (Art. 53(1)(a)), including:

• Model architecture and training methodology
• Data sources, including a description of training data and its provenance
• Compute resources used (e.g., floating-point operations, training time)
• Known or estimated energy consumption of the model
• Training and testing process and the results of evaluation
• Intended tasks and acceptable use policies
• Methods used to detect unsuitable data sources and identifiable biases

This documentation must be provided on request to the AI Office and national competent authorities.

2. Information for Downstream Providers

You must draw up, keep up to date and make available to providers of AI systems that integrate your model information and documentation that lets them understand its capabilities and limitations and meet their own obligations, containing at least the elements in Annex XII (Art. 53(1)(b)).

3. Copyright Policy and Training-Content Summary

Every GPAI provider, whatever its training data, must:

• Put in place a policy to comply with Union copyright law, in particular to identify and respect reservations of rights (text-and-data-mining opt-outs) under Article 4(3) of Directive (EU) 2019/790 (Art. 53(1)(c))
• Draw up and make publicly available a sufficiently detailed summary of the content used for training, using the AI Office's template (Art. 53(1)(d))

This is the "copyright transparency" clause — it's designed to address concerns about models trained on scraped web data, books, or code repositories without explicit licensing.

Models released under a free and open-source licence, with their weights, architecture and usage information public, are exempt from points (a) and (b), not from (c) and (d) (Art. 53(2)). The exemption does not apply to GPAI models with systemic risk.

4. Cooperation with the Commission and the AI Office

You must cooperate with the Commission — which supervises GPAI providers through the European AI Office (Art. 88) — and with national competent authorities (Art. 53(3)), including:

• Responding to requests for documentation and information (Art. 91)
• Providing access to documentation
• Giving access to the model for evaluations by the AI Office (Art. 92)

Failing to answer a request, or supplying incorrect or misleading information, can be fined under Article 101.

5. Codes of Practice

The General-Purpose AI Code of Practice was published in July 2025. Adhering to it is voluntary:

• You may rely on a code of practice to demonstrate compliance with Article 53(1) until a harmonised standard is published; a presumption of conformity comes only from harmonised standards (Art. 53(4)).
• If you don't adhere to an approved code or a harmonised standard, you must show alternative adequate means of compliance for assessment by the Commission.

The Code has three chapters:

• Transparency, with a model documentation form
• Copyright
• Safety and Security, for providers of GPAI models with systemic risk only

---

Article 53 vs. High-Risk AI System Requirements

Requirement	Article 53 (GPAI Providers)	Articles 9–15 (High-Risk AI Systems)
Who it applies to	Providers of GPAI models	Providers of high-risk AI systems (Art. 16); deployers have separate duties (Art. 26)
Documentation scope	Model training, data, architecture	System-level risk management, data governance
Conformity assessment	None; supervision by the Commission through the AI Office (Art. 88)	Internal control (Annex VI) for most Annex III systems; a notified body (Annex VII) in some biometric cases (Art. 43)
Ongoing obligations	Up-to-date documentation, cooperation; a code of practice is optional	Monitoring, logging, human oversight, incident reporting
Statutory maximum fine	€15M or 3% of global annual turnover, whichever is higher, imposed by the Commission (Art. 101), from 2 August 2026	€15M or 3% of global annual turnover, whichever is higher (Art. 99(4)); for SMEs, whichever is lower (Art. 99(6))

Key takeaway: If your model is integrated into a high-risk system, that system's provider must meet Articles 9–15, and Article 53(1)(b) requires you to give it the information it needs. If you build the high-risk system yourself, you are its provider and face both Article 53 obligations (as the model provider) and Articles 9–15 (as the system provider).

---

What "Systemic Risk" GPAI Models Must Do (Articles 51 and 55)

A GPAI model has systemic risk if it has high-impact capabilities, or if the Commission designates it having regard to the criteria in Annex XIII (Art. 51(1)). High-impact capabilities are presumed when the cumulative compute used for training exceeds 10²⁵ FLOPs (Art. 51(2)). The provider must notify the Commission within two weeks of meeting that threshold, or of knowing it will (Art. 52(1)). Such providers face additional obligations under Article 55:

• Model evaluation (including adversarial testing)
• Assessment and mitigation of systemic risks (e.g., misuse for cyberattacks, CBRN threats)
• Tracking and reporting of serious incidents
• Cybersecurity protections for model weights and infrastructure

The Commission publishes and keeps up to date a list of GPAI models with systemic risk (Art. 52(6)).

Models below the threshold that the Commission has not designated are subject to Article 53 but not the systemic risk obligations.

---

Practical Compliance Checklist for Article 53

Here's what you need in place now that these obligations are live (models already on the market before 2 August 2025 have a transition period under Article 111(3)):

Task	Owner	Basis
Draft technical documentation (architecture, training data, compute, energy)	ML Engineering	Art. 53(1)(a), Annex XI
Prepare documentation for downstream providers	ML Engineering + Product	Art. 53(1)(b), Annex XII
Adopt a copyright policy and publish the training-content summary	Legal + Data	Art. 53(1)(c)–(d)
Decide whether to sign the Code of Practice and map adherence	Compliance Lead	Art. 53(4) (voluntary)
Establish a contact for Commission and AI Office requests	Compliance Lead	Art. 53(3), Art. 91
(If systemic risk) Conduct adversarial testing, set up incident reporting	ML Engineering + Security	Art. 55(1)(a), (c)
(If systemic risk) Implement model weight access controls	Security	Art. 55(1)(d)

---

Example: A Startup Building a Code Generation Model

Scenario: You're building a code completion model trained on 3 trillion tokens of open-source code and natural language from GitHub, Stack Overflow, and public documentation.

First check that it is a GPAI model at all: under the Commission’s indicative criterion it should use more than 10²³ FLOP of training compute and be able to perform a wide range of tasks, not only one narrow one.

Article 53 obligations:

1. Technical documentation: Document your model architecture (e.g., transformer-based, 7B parameters), training data sources (GitHub repos, Stack Overflow posts), compute used (e.g., about 1.3 × 10²³ FLOPs) and energy consumption.

2. Copyright transparency: Publish the training-content summary using the AI Office template, and apply a copyright policy that identifies and respects machine-readable text-and-data-mining opt-outs (Art. 4(3) of Directive 2019/790). Licence terms such as the GPL are a separate question under copyright law.

3. Cooperation: Designate a compliance contact who can answer Commission requests within the period each request sets (Art. 91(4)).

4. Code of practice: Decide whether to sign the GPAI Code of Practice and map your documentation and copyright practices to its Transparency and Copyright chapters.

What you DON'T need to do under Article 53:

• Conformity assessment (that's for high-risk systems, not GPAI models)
• Automatic logging (Article 12 requires high-risk systems to allow it; deployers keep the logs under Article 26(6))
• Human oversight (again, Article 14 for high-risk systems)

However, if a customer builds your model into a high-risk system (e.g., an AI system that screens job candidates — Annex III, point 4), the provider of that system must meet Articles 9–15, and Article 53(1)(b) already requires you to give it the documentation it needs.

---

Common Mistakes GPAI Providers Make

Mistake 1: Assuming Article 53 Only Applies to "Big Tech"

Reality: Article 53 applies to any GPAI provider placing a model on the EU market, regardless of company size. Fine-tuning someone else's model does not always make you a provider, though: the Commission's guidelines treat a downstream modifier as the provider of the modified model when the modification uses more than a third of the original model's training compute.

Mistake 2: Confusing GPAI Obligations with High-Risk System Obligations

Reality: Article 53 is about the model. Articles 9–15 are about the system. If you provide a model API, you're subject to Article 53. If you build a high-risk system on that model, you are that system's provider and Articles 9–15 apply to it as well.

Mistake 3: Treating the Code of Practice as the Obligation

Reality: The GPAI Code of Practice was published in July 2025. Signing it is voluntary (Art. 53(4)); the documentation, copyright policy and training-content summary are required whether or not you sign.

Mistake 4: Treating Documentation as a One-Time Exercise

Reality: Article 53 requires up-to-date documentation. If you retrain your model, change your training data mix, or discover new limitations, you must update your documentation.

---

---

This article is for informational purposes only and does not constitute legal advice. Consult a qualified EU AI Act attorney for guidance on your specific situation.