# Commission GPAI model guidelines: Commission Guidelines on the scope of the obligations for general-purpose AI models established by Regulation (EU) 2024/1689 (AI Act)

Source: https://www.bankingnewsai.com/ai-regulation/documents/eu-commission-guidelines-gpai-obligations-2025
Last updated: Oct 5, 2026

The European Commission published its Guidelines on the scope of the obligations for providers of general-purpose AI models on 18 July 2025 (Communication C(2025) 5045), two weeks before the GPAI obligations of Chapter V of the AI Act began to apply on 2 August 2025. They set an indicative criterion that a model is a general-purpose AI model if its training compute exceeds 10^23 FLOP and it can generate language, text-to-image or text-to-video; a model trained with more than 10^25 FLOP is presumed to carry systemic risk under Article 51(2). A downstream modifier, such as a bank that fine-tunes an open model, is presumed to become a provider only if the compute used for the modification exceeds one third of the original model's training compute. The Commission can enforce with fines of up to 3% of global annual turnover or EUR 15 million from 2 August 2026, and models placed on the market before 2 August 2025 have until 2 August 2027 to comply.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [EU AI Act](https://www.bankingnewsai.com/ai-regulation/eu-ai-act) |
| Type | Guidance |
| Status | In force |
| Published | Jul 18, 2025 |
| Applies to | Providers of general-purpose AI (GPAI) models placed on the EU market, including downstream actors who modify a model enough to become its provider; banks are mostly downstream deployers or system providers, and become model providers only if they modify or train a model above the Guidelines' compute thresholds. Non-binding |
| Official text | https://digital-strategy.ec.europa.eu/en/library/guidelines-scope-obligations-providers-general-purpose-ai-models-under-ai-act |

## Key points

- Date and status: published 18 July 2025 as Communication C(2025) 5045; non-binding, setting out the Commission's interpretation on which it will base enforcement. The GPAI Code of Practice (see eu-gpai-code-of-practice-2025) is the voluntary route to demonstrating compliance.
- When a model is general-purpose (paragraph 17): indicative criterion of training compute above 10^23 FLOP and the ability to generate language (text or audio), text-to-image or text-to-video; roughly the compute of a one-billion-parameter model trained on a large amount of data (paragraph 18).
- Systemic risk (paragraph 5 and Section 2.3): training compute above 10^25 FLOP triggers the Article 51(2) presumption of high-impact capabilities; the Commission can also designate models under Annex XIII, and providers must notify the Commission when a model meets the threshold (Article 52(1)).
- Who is a provider (Section 3.1): the upstream actor that develops a model and makes it available to a downstream actor on the Union market is its provider (paragraph 57); a model integrated into an AI system placed on the Union market is treated as placed on the market (paragraphs 56-58).
- Downstream modifiers (Section 3.2, paragraph 63): a modifier becomes the provider of the modified model only if the compute used for the modification is greater than a third of the original model's training compute; if that is unknown, a third of 10^25 FLOP for systemic-risk models or a third of 10^23 FLOP otherwise.
- Open-source exemptions (Section 4): certain Article 53 obligations are lifted for free and open-source models without monetisation, but never for models with systemic risk.
- Enforcement (paragraphs 106 and 115): Commission powers to request information, evaluate models, request measures and fine (Articles 91-93 and 101) apply from 2 August 2026; the obligations themselves apply from 2 August 2025.
- Transition (paragraph 109): under Article 111(3), providers of models placed on the market before 2 August 2025 must comply by 2 August 2027, and are not required to retrain or unlearn where that is impossible or disproportionate (paragraph 111).

## What changed for banks

The AI Act's GPAI chapter applies to model providers, not to the banks that use their models, but the Guidelines decide where that line sits. They give banks two concrete tests: whether an in-house or fine-tuned model could itself be a GPAI model, and whether heavy fine-tuning of a third-party model could make the bank a provider. For most banks, who prompt, retrieve from or lightly adapt vendor models, the answer is that the provider obligations stay with the vendor, which makes the vendor's code-of-practice adherence and documentation a due-diligence item.

## Use cases it governs

- [Generative & agentic AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#generative-agentic-ai)
- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)
- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)
- [Model risk management](https://www.bankingnewsai.com/ai-regulation/by-use-case#model-risk)

## What do the Commission's GPAI guidelines require, and when does a bank become a general-purpose AI model provider?

The Commission's Guidelines on general-purpose AI model obligations (C(2025) 5045, 18 July 2025) do not impose duties on banks directly; they define when a model is general-purpose (training compute above 10^23 FLOP and the ability to generate language, images or video), when it is presumed to carry systemic risk (above 10^25 FLOP) and when a downstream party becomes the provider (modification compute above a third of the original model's). Provider obligations under Chapter V have applied since 2 August 2025, Commission fining powers start on 2 August 2026, and legacy models have until 2 August 2027. A bank that fine-tunes a vendor model lightly remains a downstream actor; one that trains or heavily retrains a large model should assume it is a provider.

| Rule | Authority | What it requires | Status | Source |
| --- | --- | --- | --- | --- |
| Paragraph 17 — General-purpose AI model criterion | [EU AI Act](https://www.bankingnewsai.com/ai-regulation/eu-ai-act) | Treat a model as general-purpose if training compute exceeds 10^23 FLOP and it can generate language, text-to-image or text-to-video. | Chapter V applies since 2 Aug 2025 | [Commission GPAI model guidelines](https://www.bankingnewsai.com/ai-regulation/documents/eu-commission-guidelines-gpai-obligations-2025) |
| Paragraph 5 and Article 51(2) — Systemic-risk presumption | [EU AI Act](https://www.bankingnewsai.com/ai-regulation/eu-ai-act) | A model trained with more than 10^25 FLOP is presumed to have systemic risk; its provider must meet the additional obligations of Article 55 and notify the Commission. | Chapter V applies since 2 Aug 2025 | [Regulation (EU) 2024/1689](https://www.bankingnewsai.com/ai-regulation/documents/eu-ai-act-regulation-2024-1689) |
| Paragraphs 56-58 — Models integrated into AI systems | [EU AI Act](https://www.bankingnewsai.com/ai-regulation/eu-ai-act) | A model made available to a downstream actor on the Union market, or integrated into a system placed on that market, is placed on the market; the upstream actor is the model provider. | Chapter V applies since 2 Aug 2025 | [Commission GPAI model guidelines](https://www.bankingnewsai.com/ai-regulation/documents/eu-commission-guidelines-gpai-obligations-2025) |
| Paragraph 63 — Downstream modifiers | [EU AI Act](https://www.bankingnewsai.com/ai-regulation/eu-ai-act) | A downstream modifier is presumed to become a provider only if modification compute exceeds one third of the original model's training compute. | Chapter V applies since 2 Aug 2025 | [Commission GPAI model guidelines](https://www.bankingnewsai.com/ai-regulation/documents/eu-commission-guidelines-gpai-obligations-2025) |
| Section 5.1 — Codes of practice | [EU AI Act](https://www.bankingnewsai.com/ai-regulation/eu-ai-act) | Providers can demonstrate compliance with Articles 53 and 55 by adhering to a code of practice assessed as adequate; those who do not must show alternative adequate means. | Code in effect since 2 Aug 2025 | [General-Purpose AI Code of Practice](https://www.bankingnewsai.com/ai-regulation/documents/eu-gpai-code-of-practice-2025) |
| Paragraphs 106 and 115 — Enforcement powers | [EU AI Act](https://www.bankingnewsai.com/ai-regulation/eu-ai-act) | The Commission may request information, evaluate models, request measures and fine up to 3% of global turnover or EUR 15 million from 2 August 2026. | From 2 Aug 2026 | [Commission GPAI model guidelines](https://www.bankingnewsai.com/ai-regulation/documents/eu-commission-guidelines-gpai-obligations-2025) |
| Paragraph 109 and Article 111(3) — Legacy models | [EU AI Act](https://www.bankingnewsai.com/ai-regulation/eu-ai-act) | Providers of models placed on the market before 2 August 2025 must take the necessary steps to comply by 2 August 2027. | Deadline 2 Aug 2027 | [Commission GPAI model guidelines](https://www.bankingnewsai.com/ai-regulation/documents/eu-commission-guidelines-gpai-obligations-2025) |

The Guidelines are the interpretive companion to the GPAI Code of Practice, and both sit inside the AI Act framework. The Code is voluntary and tells providers how to meet transparency, copyright and safety-and-security duties; the Guidelines say who those providers are and when the duties bite.

For banks the practical effect runs through procurement. Because the model provider is the party subject to Chapter V, a bank's due diligence on an AI vendor can ask whether the model provider has signed the Code or documented an alternative route, and whether the bank's own customisation could move it across the downstream-modifier line. This is separate from the vendor's DORA third-party obligations, which apply to the bank regardless.

The Digital Omnibus (Regulation (EU) 2026/1744) changed other parts of the AI Act, including the timetable for high-risk obligations; the compute thresholds and provider tests in these Guidelines are the Commission's reading of Chapter V and remain the reference text.

### What this means in practice

- Inventory every foundation model in use and record the provider, where it is placed on the EU market, and whether the provider has signed the GPAI Code of Practice.
- Before fine-tuning or retraining a third-party model, estimate the training compute used for the change against the one-third test in paragraph 63; the Guidelines' annex explains how to estimate compute.
- Keep in-house models well documented: a bank that trains its own language model above 10^23 FLOP and places it on the market should expect to be treated as a provider.
- Ask vendors for the technical documentation and downstream information that Article 53 requires them to make available.
- Track the 2 August 2026 and 2 August 2027 dates for vendor readiness in the third-party risk register.

## FAQ

### Does the GPAI guidance apply to banks?

Mainly through their vendors. The obligations in Chapter V of the AI Act fall on providers of general-purpose AI models. A bank that only uses a model through an API or application is a downstream deployer or system provider, and becomes a model provider only if it modifies a model using more than about one third of the original training compute or trains its own model above the general-purpose threshold.

### What is the compute threshold for a general-purpose AI model?

The Guidelines' indicative criterion is training compute greater than 10^23 FLOP together with the ability to generate language, text-to-image or text-to-video. Models trained with more than 10^25 FLOP are presumed to have high-impact capabilities and so to pose systemic risk under Article 51(2) of the AI Act.

### When can the Commission fine GPAI providers?

The obligations have applied since 2 August 2025, but the Commission's enforcement powers, including fines of up to 3% of global annual turnover or EUR 15 million, whichever is higher, apply from 2 August 2026. Providers of models placed on the market before 2 August 2025 have until 2 August 2027 to comply.

### Are the Commission's GPAI guidelines binding?

No, they are non-binding interpretation. They set out how the Commission will apply Chapter V when it enforces it, and adherence to an adequate code of practice such as the GPAI Code of Practice is a recognised way to demonstrate compliance with Articles 53 and 55.

## Related documents

- [Regulation (EU) 2026/1744 (Digital Omnibus on AI)](https://www.bankingnewsai.com/ai-regulation/documents/eu-digital-omnibus-ai-regulation-2026-1744) — Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (Jul 24, 2026)
- [Commission guidelines on AI Act Article 50 transparency](https://www.bankingnewsai.com/ai-regulation/documents/eu-commission-guidelines-ai-act-article-50-transparency-2026) — Commission Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of Regulation (EU) 2024/1689 (AI Act) (Jul 20, 2026)
- [Draft Commission guidelines on high-risk classification](https://www.bankingnewsai.com/ai-regulation/documents/eu-commission-draft-guidelines-high-risk-classification-2026) — Draft Commission Guidelines on the classification of high-risk AI systems under Article 6 of the AI Act (May 19, 2026)
- [EBA factsheet on the AI Act](https://www.bankingnewsai.com/ai-regulation/documents/eba-ai-act-factsheet-banking-payments-2025) — AI Act: implications for the EU banking and payments sector (EBA factsheet) (Nov 21, 2025)
- [General-Purpose AI Code of Practice](https://www.bankingnewsai.com/ai-regulation/documents/eu-gpai-code-of-practice-2025) — General-Purpose AI Code of Practice under the AI Act (Transparency, Copyright, and Safety and Security chapters) (Jul 10, 2025)
- [Commission guidelines on the AI system definition](https://www.bankingnewsai.com/ai-regulation/documents/eu-commission-guidelines-ai-system-definition-2025) — Commission Guidelines on the definition of an artificial intelligence system established by Regulation (EU) 2024/1689 (AI Act) (Feb 6, 2025)
- [Commission guidelines on prohibited AI practices](https://www.bankingnewsai.com/ai-regulation/documents/eu-commission-guidelines-prohibited-ai-practices-2025) — Commission Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689 (AI Act) (Feb 4, 2025)
- [Regulation (EU) 2024/1689](https://www.bankingnewsai.com/ai-regulation/documents/eu-ai-act-regulation-2024-1689) — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) (Jul 12, 2024)

Last reviewed Oct 5, 2026. Cite the official text (https://digital-strategy.ec.europa.eu/en/library/guidelines-scope-obligations-providers-general-purpose-ai-models-under-ai-act) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/eu-commission-guidelines-gpai-obligations-2025
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (41 authorities, 237 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.