EU AI Act Transition Rules for Existing GPAI Models: The 2027 Deadline Explained

Why a Transition Rule Was Needed

When the GPAI obligations of Regulation (EU) 2024/1689 became applicable on August 2, 2025, the market was already full of general-purpose AI models — commercial APIs, open-weight releases, models embedded in countless products — trained years before anyone could have designed their data pipelines around an AI Office template. Applying the new duties instantly to that installed base would have been impractical; exempting it forever would have hollowed out the regime, since models remain in service for years. Article 111(3) strikes the balance: providers of general-purpose AI models that have been placed on the market before August 2, 2025 shall take the necessary steps to comply with the obligations of the regulation by August 2, 2027.

Two years of runway, then full compliance. The rule covers the Chapter V obligations — the four Article 53 duties and, for systemic-risk models, the Article 55 duties — and it is the reason many familiar model families spent 2025-2027 retrofitting documentation, copyright policies and training summaries.

Who Qualifies as a Legacy Model

The test is the placing on the market date: the first making available of the model on the Union market. A model whose API opened to EU customers in 2024, or whose weights were published in 2023, was placed on the market before the cut-off and qualifies. Three boundary situations matter in practice:

• New versions: a materially new model released after August 2, 2025 — new pre-training run, new architecture, substantially expanded capabilities — is a new placing on the market and must comply from its release date, even if it carries a legacy brand name. Version numbering does not control; substance does.
• Significant modifications by third parties: a downstream entity whose fine-tuning or continued pre-training is large enough to make it the provider of a new model (the Commission's guidelines use roughly one third of original training compute) creates a model placed on the market at its own release date — the legacy status of the base does not travel with the weights.
• Continuous availability: simply keeping a pre-2025 model available, patching it, or scaling its serving infrastructure does not restart the clock; the transition was designed precisely for this continuity.

What Legacy Providers Must Deliver by August 2027

By the deadline, legacy models must meet the same standard as new ones: Annex XI technical documentation, Annex XII downstream information packages, a copyright policy with text and data mining opt-out compliance, and a published training data summary on the AI Office template — plus, for the small set of legacy models that meet the systemic-risk criteria, evaluation, risk mitigation, incident reporting and cybersecurity duties under Article 55, and the classification interactions of Articles 51 and 52. The open-source exemption applies on the same conditions as for new models: genuinely free licences, public weights and information, no monetisation, no systemic risk.

The Retraining Question

The anxiety legacy providers voice most is about history: training corpora assembled in 2021-2024 were not logged against a 2025 template, crawlers did not record opt-out compliance, and some source records no longer exist. The regulation does not demand the impossible, and the Commission's guidance on GPAI obligations acknowledged the situation directly: providers of legacy models are not expected to retrain or unlearn models trained before the rules applied, and where information about training content is genuinely unavailable despite best efforts, the training summary should disclose the best available information and state its limitations transparently. The copyright policy obligation is likewise forward-operating in its mechanics — it governs how the provider identifies and respects reservations in its ongoing and future data collection — while the summary documents the past as faithfully as the records allow.

This concession has a sharp edge, however: it protects providers who genuinely cannot reconstruct history, not providers who prefer not to. Where pipeline manifests, dataset documentation or crawl logs exist, they must be used, and a summary thinner than the provider's actual records would support is a misrepresentation, not a permitted simplification.

Planning the Retrofit: A Realistic Sequence

• Inventory: list every model placed on the EU market before August 2, 2025 that remains available, including open-weight releases that are still downloadable — availability, not active promotion, is what counts.
• Decide the portfolio: retiring a legacy model from the market before August 2027 is a legitimate alternative to retrofitting it; many providers are pruning long tails of obsolete checkpoints for exactly this reason. Withdrawal of open weights already mirrored elsewhere is acknowledged to be imperfect, but ending distribution ends the provider's ongoing placing on the market.
• Reconstruct: assemble Annex XI documentation from what exists — papers, experiment trackers, dataset cards — and record explicitly where information is estimated or unavailable.
• Publish: complete the training summary template with best-available information and the documented limitations; adopt and publish the copyright policy governing current operations.
• Package: produce Annex XII downstream documentation for models that integrators still build on; where a legacy model is widely embedded, customers' own August 2026 high-risk deadlines make them impatient consumers of this package.
• Re-classify: check legacy frontier models against the 10^25 FLOPs presumption and Annex XIII criteria — age does not exempt a model from systemic-risk classification.

How the Transition Interacts with Other Deadlines

Article 111(3) sits inside a wider transitional architecture worth keeping straight. Article 111(2) covers high-risk AI systems placed on the market or put into service before August 2, 2026: those remain outside the high-risk regime unless they undergo significant changes in design thereafter — a far more generous rule than the GPAI one, which has a hard end date regardless of changes. Article 111(1) gives AI systems that are components of the large-scale EU IT systems listed in Annex X until the end of 2030. And the enforcement clock runs independently of the compliance clock: the Commission's fining powers over GPAI providers under Article 101 apply from August 2, 2026 — meaning a legacy provider that fails to be on a credible path to the 2027 deadline can already face supervision, information requests under Article 91 and, in egregious cases, measures, even before the transition period ends. The 2027 date is when full conformity is owed, not when scrutiny begins.

Downstream timing creates the real-world pressure ahead of the legal one: integrators whose high-risk systems faced the August 2026 deadline needed Annex XII packages from their legacy model suppliers a year before those suppliers' own deadline. Commercially significant legacy models were therefore documented early, and the long tail of the transition mostly concerns models without paying customers to hurry them.

A Concrete Example

A provider has three assets from the pre-2025 era: a 2023 open-weight 7B model still widely downloaded, a 2024 commercial API model still serving EU enterprises, and an experimental 2022 checkpoint nobody uses. It retires the 2022 checkpoint from distribution, eliminating its compliance question. For the API model, internal records are good: the retrofit yields full Annex XI documentation, a downstream package and a clean training summary by early 2027. For the open-weight model, crawl-era records are partial: the summary names the public datasets and the main crawl sources that can be reconstructed, states the volume estimates as estimates, and notes the record limitations; the copyright policy documents that current crawls honour machine-readable reservations and names the protocols. When a new flagship model ships in October 2026, the team treats it as a new placing on the market with compliance at release — no one argues the legacy umbrella covers it.

Common Pitfalls

Providers stumble in four recognisable ways. Stretching the umbrella: branding a substantially new 2026 model as version 2.1 of a 2024 model and claiming the 2027 deadline — supervisors will look at training runs, not version strings. Sleeping on the deadline: two years evaporates against data archaeology, and teams that started in mid-2026 found reconstruction the slowest workstream. Forgetting forgotten releases: old weights on public repositories remain placed on the market; the inventory step exists because organisations reliably underestimate what they have published. And wasting the concession: filing a minimal summary citing unavailable records when internal documentation plainly exists converts a transition accommodation into an enforcement ground — from August 2, 2026 the Commission's fining powers under Article 101 are live, and post-2027 the legacy excuse expires entirely.

Action Plan

Treat August 2, 2027 as a delivery date for a finite engineering and documentation project: inventory by quarter one, portfolio decisions by quarter two, reconstruction and publication across the remaining time, with the systemic-risk check run early because its consequences are largest. Legacy status is a runway, not an exemption — and the providers who use the runway are landing exactly where new entrants already stand, with the added credibility of having documented their history honestly.

This article is for informational purposes only and does not constitute legal advice. Regulatory requirements change frequently — verify current rules with official sources. Built by Sawai Gyoseishoshi Office, Hiroshima, Japan.