# GPAI provider obligations under the EU AI Act: checklist with dates

Source documents: Commission Communication C(2025) 8311 final (Explanatory Notice and Template, 5 December 2025); Commission "General-Purpose AI Models in the AI Act: Questions and Answers"; GPAI Code of Practice (published 10 July 2025), Transparency and Copyright chapters. Checked 23 October 2026. This is not legal advice.

## Key dates

- [ ] 1 August 2024: AI Act (Regulation (EU) 2024/1689) in force.
- [ ] 10 July 2025: GPAI Code of Practice published.
- [ ] 2 August 2025: GPAI provider obligations apply to models placed on the EU market from this date.
- [ ] 2 August 2026: AI Office supervision and enforcement for GPAI providers starts.
- [ ] 2 August 2027: deadline for training content summaries of models placed on the market before 2 August 2025.

## All GPAI providers (Article 53)

- [ ] (a) Technical documentation (Annex XI), kept up to date, provided to the AI Office and national competent authorities on request. Open source exemption under Art. 53(2) unless systemic risk.
- [ ] (b) Information and documentation for downstream providers (Annex XII). Same open source exemption.
- [ ] (c) Copyright policy, including identifying and respecting text and data mining reservations under Art. 4(3) of Directive (EU) 2019/790.
- [ ] (d) Public summary of training content using the Commission template. No open source exemption.
- [ ] Authorised representative in the EU if established outside the Union (Art. 54).

## Training content summary (Art. 53(1)(d), C(2025) 8311)

- [ ] Published at the latest when the model is placed on the EU market.
- [ ] On the provider's official website, clearly visible, and with the model on all public distribution channels.
- [ ] States which model(s) and version(s) it covers.
- [ ] Sections completed: 1 General information; 2 List of data sources (2.1 to 2.6); 3 Data processing aspects (3.1 TDM opt-outs, 3.2 illegal content).
- [ ] Updated every six months when the model is further trained on new data, or sooner for a materially significant change, with the update date.
- [ ] For a modified or fine-tuned model: covers only the added training data and names and links the original model.
- [ ] Possible fine for non-compliance: up to 3% of worldwide annual turnover or EUR 15 million, whichever is higher.

## Code of Practice signatories (Transparency chapter)

- [ ] Measure 1.1: model documentation drawn up (Model Documentation Form), updated, previous versions kept for 10 years after placing on the market.
- [ ] Measure 1.2: public contact point for AI Office and downstream provider requests; downstream requests answered within 14 days save exceptional circumstances.
- [ ] Measure 1.3: documented information protected for quality, integrity and security.

## Systemic risk models (Article 55; threshold 10^25 FLOP under Art. 51)

- [ ] Model evaluations.
- [ ] Assessment and mitigation of systemic risks.
- [ ] Tracking, documenting and reporting serious incidents.
- [ ] Adequate cybersecurity protection for the model and its physical infrastructure.

## Deployer and buyer checklist

- [ ] Exact model version strings recorded for every model you call.
- [ ] Training content summary (or system card) located, saved and SHA-256 hashed for each version.
- [ ] Model recorded in your own AIBOM (CycloneDX or SPDX) with the summary as an external reference and unknowns written as "not published by provider".
- [ ] Downstream documentation requested via the provider's contact point; request and reply dates logged.
- [ ] Re-review on new model versions, summary updates and at least every six months.
- [ ] Risk acceptance recorded for each unknown (licences, personal data, poisoning controls).