Who Is a GPAI Provider Under the EU AI Act? Definition and Borderline Cases

Why the Definition Matters

Every obligation in Chapter V of Regulation (EU) 2024/1689 — technical documentation, downstream information, the copyright policy, the training data summary, and the systemic-risk duties of Article 55 — attaches to one legal role: the provider of a general-purpose AI model. Getting the definition right is therefore the first compliance question for any organisation that trains, adapts, hosts or republishes models. Two definitions interlock: what counts as a GPAI model, and who counts as its provider.

The Model Definition: Article 3(63)

Article 3(63) defines a general-purpose AI model as an AI model, including where trained with a large amount of data using self-supervision at scale, that displays significant generality and is capable of competently performing a wide range of distinct tasks, regardless of how it is placed on the market, and that can be integrated into a variety of downstream systems or applications. The definition expressly excludes models used for research, development or prototyping activities before they are placed on the market.

Three features deserve attention. Generality is the core test: a model that competently performs many distinct tasks — language understanding, generation, reasoning, coding — is general-purpose; a model trained for one narrow function, such as defect detection on a production line, is not, however large it is. Distribution mode is irrelevant: API access, downloadable weights, libraries and embedded distribution all count. And the research exclusion ends at the market: internal experimental checkpoints are out of scope until someone places them on the market or puts them into service.

The Commission's Indicative Criterion

Because significant generality is qualitative, the Commission's July 2025 guidelines on GPAI obligations added an indicative quantitative criterion: a model whose training compute exceeds 10^23 FLOPs and which can generate language (text or audio), text-to-image or text-to-video output is indicatively a GPAI model. The figure corresponds roughly to the compute of models around a billion parameters trained on large corpora. It is indicative in both directions — a model above the line trained for a genuinely narrow task can fall outside the definition, while an unusually capable smaller model can fall inside — but it gives engineering teams a screening number, and it sits two orders of magnitude below the separate 10^25 FLOPs presumption for systemic risk, which only a handful of frontier models meet.

The Provider Definition: Article 3(3)

The provider is defined in Article 3(3) as a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model — or has one developed — and places it on the market or puts the system into service under its own name or trademark, whether for payment or free of charge. Applied to models, the test has three limbs: development (or commissioned development), placing on the EU market, and acting under one's own name or trademark. Payment is irrelevant; free release still creates a provider.

Placing on the market means the first making available on the Union market — supplying the model for distribution or use in the course of a commercial activity. Recital 97 and the Commission guidelines confirm the breadth: making weights downloadable from a public repository, offering API access, bundling the model inside an application, or integrating it into services offered to EU users can all constitute placing on the market.

Borderline Cases

The commissioning company

A business that has a model developed by a contractor and releases it under its own brand is the provider — has developed is enough. The contractor is not, unless it also distributes the model itself.

The fine-tuner

A downstream modifier becomes the provider of a new GPAI model only when the modification is significant; the guidelines use a yardstick of roughly one third of the original model's training compute. Light fine-tuning leaves the original provider's status untouched and creates no new model provider.

The hosting platform

A repository or cloud platform that merely hosts and redistributes someone else's model under the original developer's name is not the provider. Rebranding changes the analysis: redistributing weights under your own name or trademark points toward provider status.

The non-EU developer

The regulation applies to providers placing models on the EU market wherever they are established. Article 54 requires providers established outside the Union to appoint, by written mandate, an authorised representative in the EU before placing a GPAI model on the market — a duty waived for qualifying open-source models without systemic risk.

The internal-use developer

A company that trains a model purely for internal tooling has not placed it on the market in the classic distribution sense, but putting into service for own use in the Union is caught for AI systems, and the guidelines address integration of own models into products offered to others: shipping a product whose functionality is delivered by your model to EU customers brings the model along with it.

Model Versus System: One Letter, Two Regimes

Article 3(66) separately defines a general-purpose AI system as an AI system based on a GPAI model which has the capability to serve a variety of purposes. The distinction carries the regulation's structure: Chapter V binds model providers; system-level rules — Article 50 transparency, the high-risk regime, deployer duties — bind whoever provides or deploys systems. One organisation frequently holds both roles: a laboratory offering a chat product on its own model is the GPAI model provider for Chapter V and the provider of a GPAI system for everything else. Compliance programmes should map obligations role by role, not company by company.

A Concrete Example

A Japanese developer trains a 30-billion-parameter multilingual model — training compute well above 10^23 FLOPs — and launches a paid API available to European customers, plus a free open-weights release of a smaller variant under its brand. For both models it is a GPAI provider placing models on the EU market: it appoints an authorised representative under Article 54 for the commercial model, prepares Annex XI and XII documentation, adopts a copyright policy, and publishes training data summaries for each. The open variant qualifies for the Article 53(2) documentation exemption only if its licence is genuinely free, weights and usage information are public, and the release is not monetised. Meanwhile a Berlin start-up that fine-tunes the open variant on customer-service data with a few thousand GPU-hours does not become a model provider — but as the provider of the resulting support chatbot it owes Article 50 disclosure and, depending on use, more.

Common Pitfalls

Recurring mistakes include: assuming free release avoids provider status — payment is expressly irrelevant; treating the research exclusion as covering public beta releases — making a checkpoint publicly available is placing on the market; ignoring the commissioned-development limb and assuming the contractor carries the duties; multinational groups overlooking which legal entity actually places the model on the EU market, leaving the obligations attached to an entity with no compliance function; and conflating the 10^23 FLOPs indicative criterion for being a GPAI model with the 10^25 FLOPs presumption for systemic risk — two thresholds, two orders of magnitude apart, with entirely different consequences.

Action Plan

Run the classification once per model and record it: does the model meet Article 3(63) generality, who develops or commissions it, which entity places it on the EU market under its name, and does any release channel reach EU users? Then assign the Chapter V duties to that entity, appoint the authorised representative if it sits outside the Union, and re-run the analysis whenever distribution, branding or modification changes. The definitional questions are the cheapest part of EU AI Act compliance to get right — and the most expensive to get wrong, because every downstream obligation inherits the answer.

Two timing notes complete the picture. Provider obligations under Chapter V have applied since August 2, 2025, and the Commission's fining powers over GPAI providers under Article 101 — up to 3 percent of worldwide annual turnover or 15 million euros — apply from August 2, 2026. Models placed on the market before August 2, 2025 enjoy the Article 111(3) transition until August 2, 2027, but a new release, a significant modification or a new market channel resets that comfort. Classification is therefore not an annual review item: it belongs in the release checklist of every model that could touch the EU market. Make the record short — a page per model is enough — but make it exist, signed and dated, before the release ships rather than after the first regulator or enterprise customer asks who the provider is.

This article is for informational purposes only and does not constitute legal advice. Regulatory requirements change frequently — verify current rules with official sources. Built by Sawai Gyoseishoshi Office, Hiroshima, Japan.