In short
- Chapter V duties have applied since 2 August 2025, and the Commission's enforcement powers over general purpose models since 2 August 2026.
- Article 53 places 4 duties on model providers: technical documentation, information for downstream providers, a copyright policy, and a public summary of training content.
- Article 51(2) presumes systemic risk above 10^25 floating point operations of training compute, which brings the additional Article 55 duties.
- A company that only calls an API is not a provider of the model. Fine tuning it, or shipping it under its own name, is how that changes.
- The duty that matters most to a downstream user is the one owed to them: Article 53(1)(b) requires the model provider to supply the information they need to comply.
What do AI assistants say about your organisation?
Model answers are becoming a channel your communications team does not control. EntityRise audits how assistants describe your company and whose name they give instead. From $19.
The general purpose AI chapter is read by many companies who then close it, correctly, because it is not addressed to them.
It becomes addressed to them through two ordinary product decisions, and neither one feels like a regulatory event at the time.
01Who does Chapter V actually bind?
Providers of general purpose AI models, and nobody else.
| Duty | Provision | Applies from |
|---|---|---|
| Technical documentation of the model | Article 53(1)(a) | 2 Aug 2025 |
| Information for downstream providers | Article 53(1)(b) | 2 Aug 2025 |
| Copyright compliance policy | Article 53(1)(c) | 2 Aug 2025 |
| Public summary of training content | Article 53(1)(d) | 2 Aug 2025 |
| Systemic risk obligations | Article 55 | Above 10^25 FLOP |
If your relationship with a model is an API key and an invoice, none of those rows is yours. They belong to the party that trained and released the model, and the Commission gained its enforcement powers over that party on 2 August 2026.
02How does a user become a provider?
Two routes, and the second is the quiet one.
The first is naming. Ship a product built on someone else’s model under your own brand, in a configuration that constitutes placing a model on the market, and the provider analysis changes. Article 25 handles the equivalent question for high-risk systems and the logic is familiar.
The second is modification. Fine tuning a general purpose model can make you the provider of the modified model, with Chapter V duties attaching to your modification rather than to the base model. Where the line sits is still being worked out in practice, and this is a place where we describe the text rather than assert a threshold.
What follows from that uncertainty is a documentation habit, not paralysis. Record what you changed, on what data, at what scale, and why you concluded it was or was not a new model. That memo is the artefact that answers the question later.
03What should a downstream company demand?
The information the model provider owes it.
| Question to the model provider | Why you need it | Provision it rests on |
|---|---|---|
| Capabilities and limitations documentation | Feeds your own risk assessment | Article 53(1)(b) |
| Public summary of training content | Copyright and data provenance exposure | Article 53(1)(d) |
| Whether the model is designated systemic risk | Changes the provider's own duty set | Article 51, Article 55 |
| Notice period for model version changes | Your evaluations are version specific | Contractual |
The fourth row has no statutory basis and is the one most likely to hurt. A model version change can move behaviour that your evaluation evidence was built on, and nothing in Chapter V gives you notice of it. That is a contract term or it does not exist, which is why version notice sits in our vendor question set.
04Does any of this change if the model is open?
The obligations are calibrated, not removed.
The Regulation treats models released under free and open source licences differently for parts of Chapter V, subject to conditions, while the systemic risk obligations are not switched off by the licence. An organisation choosing an open model to reduce regulatory exposure should be careful about which exposure it is reducing: the model provider’s duties are not the same set as yours.
Self-hosting shifts more than paperwork. It moves the operational security of the deployment onto you, and Article 15 concerns for any high-risk system built on it are yours either way.
05What is the one thing to record this quarter?
A single line per model in your inventory: consumed, fine tuned, or self hosted.
Consumed means the provider carries Chapter V and you carry the system level duties. Fine tuned means the provider question is open for your modification and needs a documented answer. Self hosted means the deployment security is yours regardless of who trained it.
Three words per model, with a date. It is the cheapest defensible answer to a question that otherwise takes weeks to reconstruct.
06Frequently asked questions
Do the GPAI rules apply to companies that just use ChatGPT or Claude?
No. Chapter V places its obligations on providers of general purpose AI models. A company consuming a model through an API is a deployer of whatever system it builds, and the model provider carries the Chapter V duties.
Does fine tuning a model make you a GPAI provider?
It can. Modifying a general purpose model can make you the provider of the modified model, with the Chapter V duties applying to your modification. The practical question is the scale and nature of the change, and the answer should be recorded at the time.
What is the 10^25 FLOP threshold?
Article 51(2) presumes that a general purpose model has systemic risk when the cumulative compute used for its training exceeds 10^25 floating point operations. That presumption brings the additional obligations set out in Article 55.
What can a downstream company demand from its model provider?
The information required by Article 53(1)(b), which is the documentation a downstream provider needs to understand the model's capabilities and limitations and to comply with its own obligations. In practice that is the basis for the technical questions in a procurement pack.
07References and method
- Regulation (EU) 2024/1689, Chapter V, in particular Article 53 for provider obligations, Article 51(2) for the systemic risk presumption and its 10^25 FLOP threshold, and Article 55 for the additional obligations.
- Regulation (EU) 2024/1689, Article 113, for the application dates, including 2 August 2025 for Chapter V and the later date for Commission enforcement powers over general purpose models.
- Regulation (EU) 2024/1689, Article 3(3) and Article 25, for the definitions and for the circumstances in which another party takes on provider obligations.
- Where practice is still settling, in particular on when a fine tune makes a downstream party the provider of a modified model, we describe the operative text and mark the open question rather than assert a conclusion.