EU AI Act GPAI Model Penalties: Compliance Obligations for General-Purpose AI Providers

Regulatory Authority: Regulation (EU) 2024/1689, Article 51 (Classification of GPAI models with systemic risk), Article 52 (Obligations for all GPAI providers), Article 53 (GPAI provider technical documentation and copyright obligations), Article 54 (Systemic risk obligations — adversarial testing), Article 55 (Systemic risk obligations — cybersecurity and incident reporting), Article 56 (GPAI Code of Practice), Article 74(5) (EU AI Office enforcement authority over GPAI), Article 99(4) (Administrative fines for GPAI violations), Article 101(4)(b) (Direct EU AI Office enforcement), Directive (EU) 2019/790 Articles 3–4 (TDM exceptions relevant to Article 53(1)(c))

Applies to GPAI model providers who fail to: maintain and provide technical documentation to the EU AI Office on request, publish training data summaries, implement copyright compliance policies, make model cards publicly available, or cooperate with EU AI Office investigations. The EU AI Office — not national NCAs — is the primary enforcement authority for GPAI violations under Article 74(5).

GPAI models designated as posing 'systemic risk' under Article 51 (those trained with compute exceeding 10^25 FLOPs, or designated by Commission decision) face additional mandatory obligations: adversarial testing (red teaming), cybersecurity incident reporting, serious incident notification within 24 hours, and maintaining a cybersecurity risk assessment. Failure to meet these heightened obligations carries the same penalty tier but is treated as a more severe violation by the EU AI Office.

GPAI models released under free and open-source licenses with weights publicly available are partially exempt from documentation obligations — but copyright compliance requirements and systemic risk obligations still apply if the model meets the compute threshold. SME GPAI providers receive proportionate penalty treatment, but the EU AI Office has indicated smaller-compute models from well-resourced companies will not receive SME protection solely on headcount.

Understand Your EU AI Act Penalty Exposure

Use ComplianceStack's free tools to identify gaps before regulators do.

Take the Quiz →   Gap Analyzer →

Which AI models count as general-purpose AI (GPAI) under the EU AI Act?

Article 3(63) of Regulation (EU) 2024/1689 defines a general-purpose AI model as an AI model that is trained on large amounts of data using self-supervision at scale, displays significant generality, and is capable of competently performing a wide range of distinct tasks — regardless of how it is placed on the market. In practice, this captures transformer-based large language models (GPT-4, Claude, Gemini, Llama, Mistral), large multimodal models, and large-scale image/audio/video generation models. The definition does not require the model to be commercially available — models used internally by companies as components of their own products also qualify if they meet the generality criteria. Narrow, task-specific models (a spam filter, a product recommendation engine, an OCR model) do not qualify. Models that were specifically trained for a narrow downstream purpose from the ground up — without fine-tuning a general base model — generally do not qualify, though this determination can be contested. The EU AI Office published clarifying guidance in 2025 on edge cases.

What is the compute threshold for 'systemic risk' GPAI, and which models currently qualify?

Article 51(1)(a) of Regulation (EU) 2024/1689 designates a GPAI model as having systemic risk if it was trained using a cumulative amount of compute greater than 10^25 floating-point operations (FLOPs). This threshold was calibrated against training compute for GPT-4-class models at the time of the Act's finalization. As of Q1 2026, models that met or exceeded this threshold include: GPT-4, GPT-4o, Claude 3 Opus, Claude 3.5 Sonnet (training), Gemini Ultra/1.5 Pro, Llama 3 405B, and Mistral Large (2024 training run). Models trained below 10^25 FLOPs — including many capable 7B–70B open-source models — do not automatically qualify, though the European Commission retains authority under Article 51(2) to designate models as having systemic risk based on their actual capabilities or market impact, regardless of compute. The threshold is expected to decrease as the Commission updates it under Article 51(3) to track compute scaling trends.

Does the EU AI Act apply to open-source GPAI models like Llama?

Yes, with important modifications. Article 53(2) provides that GPAI models released under free and open-source licenses have reduced documentation obligations: they are exempt from many of the Article 52 technical documentation requirements because the model weights, architecture, and training information are already publicly available. However, open-source GPAI providers are NOT exempt from: (1) copyright compliance requirements under Article 53(1)(c) — the TDM copyright obligation applies regardless of license; (2) systemic risk obligations under Articles 54–55 if the model meets the compute threshold; and (3) any applicable transparency obligations under Article 50. The open-source exception does not extend to companies that provide open-source models as the basis for a commercial API or hosted service — in that case, the commercial entity is treated as a GPAI provider with full obligations. Meta (Llama), Mistral, and other open-weight model providers have engaged directly with the EU AI Office on compliance frameworks for open-source models.