The EU AI Act distinguishes between general-purpose AI models — GPAI — and AI systems that use such models for a specific purpose. For developers who build a large language model into their product via an API, this distinction is central. Most GPAI obligations do not apply to them but to the model providers. Their own obligations follow from the system they build.
Who is a GPAI provider
The provider of a GPAI model is whoever develops such a model and places it on the market under their own name — typically the large model developers. Their obligations have applied since 2 August 2025: technical documentation of the model, information for downstream providers integrating it, a policy for complying with copyright law, and a publicly available summary of training content following a Commission template. Models with systemic risk add evaluations, risk mitigation, reporting of serious incidents and cybersecurity. The Commission supervises these obligations through the AI Office and has been able to enforce them since 2 August 2026; models already on the market before August 2025 have until 2 August 2027.
A voluntary code of practice for GPAI providers, published in summer 2025, describes how these obligations can be met. Many large providers have signed it.
Who integrates a GPAI model
Anyone who builds a language model into their own application via an API and offers it under their own name is the provider of an AI system, not of a GPAI model. The obligations depend on the system's purpose. An assistant that summarises texts has different obligations than a system that pre-sorts job applications. If the system falls under one of the high-risk categories in Annex III, the high-risk obligations apply from 2 December 2027 under the Digital Omnibus.
The model providers' information duties are useful for integrators: they receive details on the model's capabilities, limitations and known risks, which they can use for their own classification and documentation. It is worth actively requesting and filing these documents.
Fine-tuning and modifying models
Adapting a GPAI model does not automatically make you a GPAI provider. According to the Commission's guidelines this only happens with a substantial modification involving corresponding compute, and even then the obligations are limited to the modification made. With the usual fine-tuning for a business task you remain the provider of your own AI system. This should be documented, because customers increasingly ask.
Transparency obligations for everyone
Regardless of risk, the transparency obligations of Article 50 have applied since 2 August 2026. People must be able to recognise that they are interacting with an AI system unless that is obvious from the circumstances. Providers of systems that generate synthetic text, images, audio or video must mark this content in a machine-readable way from 2 December 2026. Anyone using deepfakes must disclose them. For developers of chatbots and content features these are the obligations with the most immediate effect.
AI literacy in your own team
Since 2 February 2025 the AI literacy obligation of Article 4 has also applied: people who develop, operate or use AI systems must be sufficiently trained. For development teams this concretely means knowing the limits of the models in use — hallucinations, prompt injection, bias — and knowing which obligations follow from their own product.
What integrators should do now
- For every product with an LLM feature, record which model from which provider is used.
- Request and file the model provider's documentation.
- Describe the purpose of each AI feature and check it against Annex III.
- Implement transparency obligations in the product: labelling of AI interaction and synthetic content.
- For fine-tuning, document why you remain the system provider.
- Run role-based training for the team and record it.
Where this leaves you
For most SaaS companies using language models, the direct GPAI obligations matter less than the obligations from their own system: transparency, AI literacy and, where applicable, high-risk requirements. Innopulse supports classification and technical implementation; for legally contested distinctions we recommend specialised counsel.