General-Purpose AI Under the AI Act: Infrastructure for GPAI Model Compliance

Chapter V of the AI Act creates specific obligations for general-purpose AI (GPAI) models — what the industry calls foundation models or large language models. If you develop, fine-tune, or deploy GPAI models, you have infrastructure obligations effective August 2025.

GPAI Provider Obligations (All GPAI)

• Technical documentation — Training methodology, data sources, compute used, evaluation results
• Information for downstream providers — Capabilities, limitations, intended use, integration guidance
• Copyright compliance policy — Machine-readable opt-out mechanism (robots.txt/TDM reservation)
• Training data summary — Detailed enough to identify sources, not necessarily full dataset disclosure

Systemic Risk GPAI (Additional Obligations)

GPAI models with systemic risk (trained with >10^25 FLOPs, or designated by Commission) face additional requirements:

• Model evaluation — Standardized benchmarks including adversarial testing
• Systemic risk assessment and mitigation — Infrastructure for identifying and addressing risks at scale
• Incident monitoring and reporting — Track and report serious incidents to the AI Office
• Cybersecurity protection — Adequate security for the model and its infrastructure

Infrastructure for GPAI Compliance

Training Documentation Pipeline

Automated capture during training: hyperparameters, hardware configuration, training duration, dataset composition, evaluation benchmarks, known failure modes. This should flow from your training pipeline, not be compiled manually.

Copyright Compliance Infrastructure

Web crawling for training data must respect TDM opt-outs. Infrastructure: robots.txt parser, TDM reservation header detection, automated filtering of opted-out content, audit trail of crawling decisions.

Downstream Provider Interface

If you serve GPAI models to other businesses (API or self-hosted), provide infrastructure for: model cards with capabilities and limitations, acceptable use policies enforced at the API level, safety evaluation results accessible to downstream integrators.

Fine-Tuning and Deployment

If you fine-tune a GPAI model and deploy it as a high-risk AI system, you inherit both GPAI and high-risk obligations. Your infrastructure must cover the full stack: GPAI transparency + high-risk governance. Build once, comply with both.