Chapter V: obligations for providers of general-purpose AI models, the extra duties for models with systemic risk, and the code of practice that providers can use to show compliance, all supervised by the AI Office.
When a general-purpose AI model is classified as having systemic risk: the 10^25 FLOP presumption, Commission designation under Annex XIII, the two-week notification duty, rebuttal arguments and reassessment.
The two documentation duties of every general-purpose AI model provider: Annex XI technical documentation for the AI Office and Annex XII information for downstream providers, the open-source exemption, and the Commission's thresholds for who counts as a provider.
The duty on every general-purpose AI model provider, open source included, to adopt a policy to comply with EU copyright law and honor machine-readable text and data mining opt-outs, and the code of practice chapter that supports it.
The duty to publish a sufficiently detailed summary of the content used to train a general-purpose AI model, using the AI Office template of 24 July 2025, which applies to open-source models too.
The EU-based representative that non-EU general-purpose AI model providers must appoint before placing a model on the EU market, its mandate and retention duties, and the open-source exemption.
The extra duties for the most capable models: state-of-the-art evaluation with adversarial testing, Union-level systemic risk assessment and mitigation, serious incident reporting to the AI Office, and cybersecurity for the model and its infrastructure.
How codes of practice let general-purpose AI providers demonstrate compliance, and the status of the General-Purpose AI Code of Practice: publication, adequacy assessment, chapters and signatories.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.