AI Act duties for organizations that use, fine-tune, build on or self-host large language models and other general-purpose AI: deployer duties, when you become a model or system provider, open-source exemptions and transparency rules.
What a company using ChatGPT-style assistants or other generative AI must do under the AI Act: AI literacy, disclosure of deepfakes and AI-generated public-interest text, when a use becomes high-risk, and when a deployer turns into a provider.
When fine-tuning or otherwise modifying a general-purpose AI model makes you its provider, the Commission's one-third compute indication, the documentation and copyright duties that follow, and when modifying an AI system makes you a high-risk provider.
What downstream companies building on model APIs or open-weight models can expect and must do: information model providers must supply, written agreements for high-risk systems, transparency duties, and AI Office oversight of systems built on a provider's own model.
What the AI Act's open-source exemptions cover and what they do not: free and open-source AI systems, open-weight general-purpose models, the duties that still apply (copyright policy, training summary, systemic risk), and open-source components in value chains.
Running open-weight models on your own infrastructure under the AI Act: provider or deployer roles, staff AI literacy, transparency for chatbots and generated content, logging and retention if a use is high-risk, and the open-source tools that produce traces and test evidence.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.