EU AI ACT · 8 MIN READ

General-Purpose AI Rules Raise New Governance Questions.

The regulatory treatment of general-purpose AI is creating new questions about responsibilities across the AI value chain and the evidence organisations may need from model and technology providers.

INTAI Research · Published 7 July 2026

Read the Update

The Rules Already in Force

Unlike the high-risk AI system obligations, the EU AI Act’s rules for general-purpose AI, the large foundation models that sit underneath a wide range of downstream applications, were not affected by the May 2026 deferral. They took effect on 2 August 2025, and the Commission’s full enforcement powers over GPAI providers, including requests for information, model access and recall powers, activate on 2 August 2026, backed by fines of up to €35 million or 7% of global annual turnover.

All new GPAI models released from 2 August 2025 must comply. Providers of models placed on the market before that date have until 2 August 2027 to bring them into compliance, a separate, longer grace period recognising the practical difficulty of retrofitting compliance onto an already-deployed model.

What the Code of Practice Actually Covers

The European AI Office published the final version of the Code of Practice for GPAI providers on 10 July 2025, a voluntary instrument, developed with independent experts, intended to give providers a concrete way to demonstrate compliance with the Act’s obligations. It is structured around three chapters.

Transparency and Copyright apply to every GPAI model provider: transparency requires maintaining technical documentation and providing downstream deployers with the information they need to understand and use the model responsibly, while the copyright chapter addresses how providers respect EU copyright law in how models are trained. The third chapter, Safety and Security, applies only to providers of GPAI models classified as carrying systemic risk, broadly, the largest and most capable models, and sets out a full risk governance framework: identifying, assessing, mitigating and transparently reporting safety and security risks across the model’s lifecycle, built around pre-market assessment, ongoing monitoring and continuous oversight.

Central Insight

The GPAI rules create a governance question most organisations have not yet had to answer clearly: what evidence should a deployer reasonably expect from the model providers it builds on, and how does that evidence feed into the deployer’s own obligations further down the value chain? Under Article 26(9) of the Act, deployers must use the information a provider is required to supply under Article 13 to fulfil their own data protection impact assessment obligations under GDPR Article 35, making the provider's transparency documentation a direct input into the deployer's own compliance, not a separate, self-contained exercise.

What This Means for Organisations Building on Third-Party Models

Very few organisations are training their own foundation models from scratch. The overwhelming majority are deployers, building products and workflows on top of models supplied by a small number of large providers, which makes value-chain accountability the practical governance question, rather than direct compliance with the GPAI provider obligations themselves.

In practice, that means treating a model provider’s transparency documentation, Code of Practice adherence and systemic-risk disclosures as inputs the organisation should actively request and retain, not assume exist somewhere in a vendor's back office. It also means building a clear internal record of which foundation models sit underneath which internal AI systems, so that if a provider’s compliance status changes, through an enforcement action, a recall, or a material update to the model, the organisation can quickly identify everywhere that change actually matters.