GPAI providers and fine-tuners

The situation

The provider of a general-purpose AI model draws up and keeps up to date technical documentation with at least the Annex XI content, makes information with at least the Annex XII content available to downstream AI system providers, puts in place a copyright policy that identifies rights reservations, and publishes a training-content summary in the AI Office template, all under Art. 53. A provider established outside the Union appoints an authorised representative under Art. 54 before it places the model on the Union market. Where cumulative training compute crosses the Art. 51(2) presumption, or the Commission designates the model under Art. 51(1)(b), Art. 55 adds model evaluation with documented adversarial testing, systemic-risk assessment and mitigation, serious-incident reporting to the AI Office, and cybersecurity for the model and its infrastructure.

Two determinations decide which of those duties apply. The first is provider status: a fine-tuning or continued-training run can make the modifier the provider of a new model, and the Commission guidelines on GPAI scopePublished give an indicative compute-fraction criterion for that step, stated as rebuttable. The second is the systemic-risk gate: Art. 51(2) presumes high-impact capabilities when the cumulative training compute, measured in floating point operations, is greater than 10^25, and Art. 51(3) lets the Commission amend that figure by delegated act. Both determinations are recorded under PR-CLS v1.0 as reasoned technical assessments for discussion with counsel.

Annex XI and Annex XII content has to be assembled from research notes, training logs and model cards, and each cited evaluation result has to resolve to a stored record with its protocol name, dataset version and model version. Adversarial testing under Art. 55(1)(a) has to be a documented campaign that can be repeated at the next model version, with an attack set, elicitation methods and a success criterion per attack. The Commission's information requests and fines under Art. 101 apply from the general application date 2026-08-02In force; the duty under Art. 53(1)(a) to give the Annex XI documentation to the AI Office on request runs from the GPAI application date. The questions this hub answers:

• Whether fine-tuning or continued training makes the organisation the provider of a new model
• Whether the training compute crosses the systemic-risk presumption in Article 51 and what evaluation duties follow
• The Annex XI technical documentation and the Annex XII downstream pack have to be assembled from research notes that were never written for a regulator
• Adversarial testing has been done ad hoc, without a documented campaign that can be repeated
• The Commission's enforcement powers are live and the AI Office may request documentation

Obligations and dates

Two regulation entries carry the dates for this obligation set, and each row of the table below shows the entry that governs it.

Art. 53, Art. 54 and Art. 55 set no numeric test threshold: no evaluation score, attack success rate, incident count or documentation completeness level appears in the text, and the one figure nearby is the Art. 51(2) classification gate. Every pass criterion therefore comes from a six-level hierarchy: a harmonised standard cited in the Official Journal, of which none exists as of the anchor date, so no presumption of conformity is available; a JTC 21 draft standard named with its stage, of which none covers general-purpose AI models; an ISO/IEC standard or technical report; a Commission guideline or code of practice; NIST AI RMF or a sector framework; and the provider's justified state of the art. The level in use for this obligation set is the code-of-practice level: the GPAI Code of PracticePublished supplies the Model Documentation Form for the Annex XI and Annex XII content, the copyright measures, and the Safety and Security Framework in which the provider sets its own systemic-risk acceptance criteria. Art. 15 sits in the set because the Annex XII information under Art. 53(1)(b) has to enable a downstream provider to meet its own accuracy, robustness and cybersecurity duties, and because PR-15-ROB v1.0 covers both the Art. 15 elements and the Art. 55(1)(a) evaluation and adversarial testing elements; the standards page shows the stage of each JTC 21 draft at the Art. 15 level. Where no published threshold exists, the target-justification step of the protocol records the provider's target, its source level and the reason it fits the model's release context.

Where the model is placed on the market inside an AI system that generates synthetic content, the marking duty in Art. 50(2) falls on the provider of that system, and the adequacy of the marking technique is an unsettled point with two readings.

What an assessor or authority will ask for

The AI Office, a national competent authority or a downstream provider's due-diligence function asks for the following records, in the order an Art. 53 to Art. 55 review takes them.

1. Capability and misuse-potential evaluation report aligned to the GPAI Code of Practice
2. Adversarial testing and jailbreak-resistance documentation with the campaign design and the results
3. Annex XI technical documentation contribution and Annex XII downstream information pack
4. Training-content summary in the Commission template and the copyright policy
5. Serious-incident tracking template and the reporting path
6. Provider determination memo for fine-tuned or modified models, presented as a reasoned technical assessment for discussion with counsel

Each item on the list maps to an artifact family specified with a synthetic sample on the deliverables page. The evaluation report and the adversarial testing documentation follow the test report specification and are produced under PR-15-ROB v1.0. The Annex XI contribution and the Annex XII pack follow the evidence pack specification, with the completeness and consistency report from PR-11-DOC v1.0 as its findings register. The provider determination memo and the training compute determination record follow the assessment memo specification as PR-CLS v1.0 outputs. The serious-incident tracking template follows the register or checklist specification. The training-content summary and the copyright policy are the provider's own documents; the review checks their structure against the AI Office template and the copyright measures of the Code and records the gaps.

Scenarios

Scenario pages tagged for this group describe the situation that triggers a review, the evidence to assemble and the consequence of inaction with its article reference.

• Are we a GPAI provider after fine-tuning
• Model evaluation to the AI Act Code of Practice
• Our model version changed: what re-testing does the AI Act require
• When is a GPAI model a model with systemic risk: the compute threshold

Guides

Guide pages tagged for this group give a command, a configuration or a synthetic example for one step of the evidence work, with a threshold or pitfall and its source.

• Formal robustness verification with ISO/IEC 24029-2:2023
• GPAI Code of Practice: the Commission's assessment and the Article 53 evidence it expects
• AI red teaming: running a jailbreak-resistance campaign

Services

The services below test against the obligation set on this page and prepare the evidence, within the limits stated on what we cannot do: no statement of adherence to the Code of Practice, no assessment of alternative adequate means, and no legal opinion on provider status or systemic-risk classification.

• GPAI evaluation supportnow2025-08-02In force
• Robustness and adversarial testingnow, toward the Annex III date2027-12-02Deferred
• Data governance and dataset quality testingtoward the Annex III date2027-12-02Deferred
• Regression testing after substantial modificationongoing2027-12-02Deferred

Protocols

Each protocol is published in full on the methodology page with its scope, inputs, numbered steps with a citation per step, outputs and version.

• PR-15-ROB v1.0Robustness and adversarial testing protocol
• PR-CLS v1.0Classification and role determination protocol

Tools and templates

The tools run in the browser, send nothing to a server, and publish their logic on the tool methodology page; the document templates are on the templates page.

• Risk and role classifier
• Obligation tracker

Questions

+−Who are GPAI providers under the AI Act?

A provider of a general-purpose AI model is the natural or legal person that develops the model, or has it developed, and places it on the Union market under its own name or trademark, under Art. 3(3) read with Art. 3(63). A downstream organisation that fine-tunes or modifies a model can become the provider of a new model; the published Commission guidelines on GPAI scope give an indicative compute-fraction criterion for that step. PR-CLS records the provider determination as a reasoned technical assessment for discussion with counsel.

+−What do the GPAI Code of Practice and the Commission guidelines cover?

The published GPAI Code of Practice, drawn up under Art. 56, has three chapters: Transparency, with the Model Documentation Form for Annex XI and XII content; Copyright, with the measures behind the Art. 53(1)(c) policy; and Safety and Security, with the framework, evaluations, adversarial testing and incident reporting for Art. 55. The published Commission guidelines on GPAI scope give the criteria for model status, provider status after modification and the open-source exception. No harmonised standard for general-purpose AI models is cited in the Official Journal as of the anchor date.

Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.

Ask about scopehello@aiassurancelabs.com