Must-Read for Engineers! Explaining the New Guidelines for General-Purpose AI Models under the EU AI Act

On July 18, 2025, the European Commission published a draft of important guidelines regarding General-Purpose AI (GPAI) models under the EU AI Act. This is content that we engineers who develop and use AI cannot afford to overlook. These guidelines clarify the definition of GPAI models, obligations throughout their lifecycle, criteria for systemic risks, and more.

In this article, we will break down this page.

What is a "General-Purpose AI Model"?

First, it is important to determine whether the model you are developing falls under this "General-Purpose AI model" category. The guidelines provide the following criteria:

• Computational power threshold: Models are subject to this if they use more than 10²³ FLOPS (floating-point operations per second) of computational power for training and are capable of generating language (text/audio), text-to-image, or text-to-video.

◦ A model with approximately 1 billion parameters may correspond to this, based on a calculation combining model size (number of parameters) and training dataset size.

• Functional versatility requirement: However, even if a model exceeds the computational power threshold mentioned above, it is excluded if it is specialized for specific tasks such as transcription, image upscaling, weather forecasting, or gaming, and does not possess general-purpose capabilities across a wide range of tasks.

Once a model is certified as a GPAI model, obligations under the AI Act apply throughout its entire lifecycle, from the pre-training stage through all subsequent development phases, and even to changes made after market entry.

Key Obligations and GPAI Models with "Systemic Risk"

Providers of GPAI models are subject to basic obligations such as the following:

• Documentation: Must be kept up to date and provided upon request to downstream providers or the AI Office.

• Training data summary: A summary must be published using a template issued by the AI Office. The "AI Office" is the body responsible for the enforcement and monitoring of the EU AI Act.

• Copyright policy: Must have a policy regarding copyright compliance.

Furthermore, models trained with computational power of 10²⁵ FLOPS or more may be treated as "GPAI models with systemic risk." Stricter obligations are added for these models.

• Comprehensive risk assessment and mitigation measures, and model evaluation throughout the entire lifecycle.

• Robust cybersecurity measures.

• Tracking and reporting of serious incidents.

Points engineers should especially know

1. Identifying the provider: The entity that develops the model and places it on the EU market becomes the "provider." If developed by a consortium, the coordinator or the consortium itself may become the provider.

2. Downstream modifiers: If you make changes to a model downstream and the computing power used for those changes exceeds one-third of the computing power used to train the original model, you become a new GPAI provider and assume the associated obligations.

3. Exceptions and Cautions for Open-Source Models:

◦ GPAI models provided under an open-source license are exempt from certain obligations, such as the documentation provision requirement.

◦ However, compliance with training data summaries and copyright policies is still required.

◦ If designated as a GPAI model with systemic risk, all obligations must be fully met, even if it is open-source.

The open-source exception is lost if there is monetization. Dual licensing with commercial licenses, paid support, fees for access to specific features, hosted access involving advertising revenue, and processing of user data (excluding non-commercial security purposes) may be considered monetization.

Future Developments

The obligations of the AI Act apply from August 2, 2025, but the AI Office will have full enforcement authority starting August 2, 2026. Transition periods are also provided, such as the requirement for models placed on the market before that date to be compliant by August 2, 2027. These guidelines may be updated in the future in response to market and technological developments. We as engineers must keep a close watch on these movements and ensure that the AI models we develop meet the legal requirements.