Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act

The guidelines are Communication from the Commission C(2025) 7719 final, dated 19 November 2025. Communication to the Commission C(2025) 5045 final, dated 18 July 2025, approved the content of the draft guidelines. The approval Communication says that the guidelines will be formally adopted by the Commission at a later date, when all language versions are available, and that it is only from that moment that they will be applicable.

Paragraph 7 says that Article 96(1) of the AI Act requires the Commission to develop guidelines on the practical implementation of the Act, and that these guidelines focus on the scope of the obligations for providers of general-purpose AI models. Paragraph 7 says that the guidelines solely concern the AI Act and are not applicable to other Union laws, including on liability.

Paragraph 9 says that the guidelines are not binding for providers of general-purpose AI models and that an authoritative interpretation of the AI Act may only be given by the Court of Justice of the European Union. Paragraph 9 also says that the guidelines set out the interpretation and application of the AI Act by the Commission, on which it will base its enforcement action.

Paragraph 9 adds that a case-by-case assessment will always be necessary to account for the specifics of each individual case. Article 101(1), point (a), of the AI Act grounds a fine on a provider of general-purpose AI models in its intentional or negligent infringement of the relevant provisions of the Regulation.

Paragraph 17 gives as an indicative criterion for a general-purpose AI model that its training compute is greater than 10^23 FLOP and that it can generate language (whether in the form of text or audio), text-to-image, or text-to-video.

Paragraph 20 says that a model that meets that criterion but, exceptionally, does not display significant generality or is not capable of competently performing a wide range of distinct tasks is not a general-purpose AI model, and that a model that does not meet the criterion but exceptionally displays both is one.

Paragraph 22 says that the Commission considers the lifecycle of a general-purpose AI model to begin at the start of the large pre-training run, and that later development by or on behalf of the provider, before or after the model is placed on the market, forms part of the same model lifecycle rather than giving rise to new models.

Paragraph 26 says that from the moment a general-purpose AI model meets either condition of Article 51(1), the model is classified as a general-purpose AI model with systemic risk and its provider must comply with the relevant obligations. Paragraph 29 says that the provider must notify the Commission without delay and in any event within two weeks after the requirement is met or it becomes known that it will be met.

Paragraph 30 says that a notification may be required before training is complete, if the provider can reasonably foresee that the requirement leading to the presumption of high-impact capabilities is reasonably likely to be met. Paragraph 33 says that the burden of adducing evidence that the presumption deriving from the quantitative thresholds should not apply is to be borne by the provider.

Paragraph 39 says that arguments that a model does not present systemic risks because of mitigations already or planned to be implemented are not suitable grounds for excluding it from classification as a general-purpose AI model with systemic risk. Paragraph 40 says that presenting arguments with the notification does not suspend the obligations of the provider of a general-purpose AI model with systemic risk.

Paragraph 43 says that the Commission may designate a model under Article 52(1) where the provider of a model meeting the condition in Article 51(1), point (a), failed to notify, and that the provider may be fined under Article 101. Paragraph 49 says that, if an actor develops a general-purpose AI model and places it on the market, that actor is the provider.

Paragraph 51 says that a general-purpose AI model made available for the first time on the Union market via an application programming interface should be considered to be placed on the market. Paragraph 51 also lists a model used for internal processes that are essential for providing a product or service to third parties or that affect the rights of natural persons in the Union.

Paragraph 54 says, quoting recital 97, that when the provider of a general-purpose AI model integrates an own model into its own AI system that is made available on the market or put into service, that model should be considered to be placed on the market.

Paragraph 56 says that, where an upstream actor makes a model available to a downstream actor outside the Union market, the model should be considered to be placed on the Union market once the system into which it is integrated is placed on the Union market or put into service in the Union.

Paragraph 56 also says that the upstream actor should then be considered the provider of the model, unless it has excluded in a clear and unequivocal way the distribution and use of the model on the Union market. Paragraph 59 says that the Commission considers a downstream modifier to become the provider of the modified general-purpose AI model only if the modification leads to a significant change in the generality, capabilities, or systemic risk of the model.

Paragraph 60 gives as an indicative criterion that the training compute used for the modification is greater than a third of the training compute of the original model. Paragraph 61 says that, where the modifier cannot be expected to know or estimate that value, the threshold becomes a third of 10^25 FLOP for an original model with systemic risk and otherwise a third of 10^23 FLOP.

Paragraph 65 says that the documentation required by Article 53(1), points (a) and (b), is limited to information on the modification, while the copyright policy and the summary of the content used for training are limited to the data used as part of the modification. Paragraph 67 says that, if a downstream actor modifies a general-purpose AI model with systemic risk so that it becomes the provider of the modified model, the resulting model is presumed to have high-impact capabilities.

Paragraph 70 says that, for providers meeting the conditions referred to in Section 4.2, the obligations it lists do not apply unless their model is a general-purpose AI model with systemic risk. Paragraph 70 lists the obligation in Article 53(1), point (a), to draw up and keep up to date the technical documentation of the model.

Paragraph 70 lists the obligation in Article 53(1), point (b), to draw up, keep up to date and make available information and documentation to providers of AI systems who intend to integrate the model. Paragraph 70 also lists Article 54, the obligation to appoint an authorised representative for providers of general-purpose AI models established in third countries.

Paragraph 72 says that providers meeting those conditions are not exempted from the obligation in Article 53(1), point (c), to put in place a policy to comply with Union copyright law. Paragraph 72 adds that, for the same reasons, they are not exempted from the obligation in Article 53(1), point (d), to produce a summary about the content used for training.

Paragraph 75 says that, if one of the rights to access, use, modify and redistribute is missing, the licence cannot be considered free and open-source under the AI Act. Paragraph 80 gives as an example of a restriction that disqualifies a licence a usage restriction triggered by user scale thresholds, such as requiring additional licensing if monthly active users exceed a certain number.

Paragraph 83 lists as a form of monetization a model provided under a dual licensing model that allows free academic use but requires payment for commercial usage or use over a certain scale.

Paragraph 84 says that access, use, modification, or redistribution of the model requiring the collection or other processing of personal data should be treated in the same manner as monetization strategies, unless that processing is exclusively and strictly limited to the security of the model and without any commercial or financial gain.

Paragraph 91 says that providers of general-purpose AI models can demonstrate compliance with the obligations in Articles 53(1) and 55(1) by adhering to a code of practice that is assessed as adequate by the AI Office and the Board. Paragraph 91 also says that, for providers that adhere to such a code, the Commission will focus its enforcement activities on monitoring their adherence to the code of practice.

Paragraph 92 says that providers that do not adhere to such a code may be subject to a larger number of requests for information and requests for access to conduct model evaluations throughout the entire model lifecycle. Paragraph 99 says that the AI Office will take a collaborative, staged, and proportionate approach.

Paragraph 100 says that the AI Office considers the obligation to report serious incidents under Article 55(1), point (c), to cover serious cybersecurity breaches related to the model or its physical infrastructure, including the exfiltration of model parameters and cyberattacks.

Paragraph 100 also says that the AI Office considers a serious incident in the context of Chapter V as any incident or malfunctioning of a general-purpose AI model that directly or indirectly leads to any of the events listed in Article 3(49), points (a) to (d), for AI systems. Paragraph 103 says that the powers of the Commission include imposing fines of up to 3% of global annual turnover or EUR 15 million, whichever is higher, starting on 2 August 2026.

Article 111(3) of the AI Act requires providers of general-purpose AI models that have been placed on the market before 2 August 2025 to take the necessary steps in order to comply with the obligations laid down in the Regulation by 2 August 2027.

Paragraph 108 says that providers of general-purpose AI models placed on the market before 2 August 2025 are not required to conduct retraining or unlearning where that is not possible for past actions, where some information about the training data is not available, or where its retrieval would cause the provider disproportionate burden. Paragraph 108 adds that such instances must be clearly disclosed and justified in the copyright policy and in the summary of the content used for training.

Paragraph 112 says that the lack of enforcement in the first year from 2 August 2025 does not put into question the applicability of the obligations laid down in Chapter V from 2 August 2025 onwards. Paragraph 112 also says that, from 2 August 2026 onwards, the Commission will enforce with fines compliance with all obligations by providers of general-purpose AI models who are not fully compliant on that date.

The Commission page on the General-Purpose AI Code of Practice says that its Transparency and Copyright chapters offer all providers of general-purpose AI models a way to demonstrate compliance with their obligations under Article 53 of the AI Act. The same page describes the Code of Practice as a voluntary tool, prepared by independent experts in a multi-stakeholder process, designed to help industry comply with the obligations of the AI Act for providers of general-purpose AI models.