EU AI Act | General-Purpose AI

A General Purpose AI Model (GPAIM) is defined under the AI Act as an AI model “trained with a large amount of data using self-supervision at scale, that displays significant generality and is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market and that can be integrated into a variety of downstream systems or applications.”

AI models used for research, development or prototyping activities before they are placed on the market are exempted from the definition.

According to the non-binding recitals to the Act, AI models with at least a billion of parameters and trained with a large amount of data using self-supervision at scale should be considered to display the generality and competence to bring them into scope of the Act.

The European Commission has also published “Guidelines on the scope of the obligations for general-purpose AI models established by AI Act” which are not legally binding but set out the Commission’s interpretation of the definition of GPAIM and the Act’s obligations.

These Guidelines state that the Commission will consider as an indicative criterion for a model to be considered a general-purpose AI model if the training compute used to train the model is greater than 10²³ FLOPs and the model can generate language (whether in the form of text or audio), text-to-image, or text-to-video.

The Guidelines also present the Commission’s view on when the downstream modification of a GPAIM will result in the modifier being considered the provider. Not all modifications will trigger the “provider” classification. Only those modifications that lead to a significant change in the model’s generality, capabilities, or systemic risk, will qualify. The indicative criterion used by the Commission for when this occurs is that the training compute used for the modification is greater than a third of the training compute of the original model.

If this information is not available, the Guidelines state that the threshold relied upon by the Commission will be the following: if the original model is a GPAIM with system risk (see below), the threshold is replaced with a third of the threshold for a model being presumed to have high-impact capabilities (i.e. currently 10²⁵ FLOPS). In other cases, the threshold is a third of 10²³ FLOPS. These thresholds are not legal presumptions.

A GPAIM meeting any of the following criteria will be classified as presenting systemic risk:

• It has high impact capabilities evaluated on the basis of appropriate technical tools and methodologies, including indicators or benchmarks (which is presumed where the cumulative amount of compute used for its training measured in floating point operations (FLOPs) is greater than 10^25); or
• The European Commission determines that model has capabilities or impact equivalent to those identified above based on the criteria listed in Annex XIII, including number of parameters of the model; quality or size of the data set (e.g., measured through tokens); the amount of compute used for training the model, measured in FLOPS or using other variables (e.g., estimated cost of training, time required for training or energy consumption); input and output modalities; benchmarks and evaluations of capabilities of the model; high impact on the internal market due to reach (presumed when it has been made available to at least 10k registered business users established in the EU); and number of registered end-users.

Providers of General-Purpose AI Models Must:

• Create and keep updated technical documentation of the model (elements set out in Annex XI), to be provided upon request to the AI Office and national competent authorities (unless the model is released under a free and open-source license meeting certain criteria)
• Create, keep updated, and make available information and documentation of the model (elements set out in Annex XII) to providers of AI systems intending to integrate the model into their AI systems (unless the model is released under a free and open-source license meeting certain criteria)
• Put in place a policy to respect EU copyright laws and in particular identify and respect reservation of rights regarding scraping in the Copyright Directive
• Create and make publicly available a summary of the data used for training the model according to a template to be provided by the AI office. The form is available here.

Providers of General-Purpose AI Models presenting systemic risk must also:

• Conduct a classification exercise and notify the AI office that the model qualifies as a general-purpose AI model with systemic risk
• Perform model evaluations in accordance with standardized protocols and tools reflecting the state of the art
• Assess and mitigate possible systemic risks that may stem from the development, the placing on the market, or the use of the model
• Track, document and report information about serious incidents and corrective measures without undue delay to the AI Office, and, as appropriate, to national competent authorities
• Ensure an adequate level of cybersecurity protection for the model and its physical infrastructure

A voluntary Code of Practice has been adopted that further elaborates the specific measures that GPAI model providers shall adopt in order to comply with the AI Act’s requirements. According to Commission, adherence to the Code offer’s providers a “simple and transparent way to demonstrate compliance with the AI Act.” Enforcement of the Act’s obligations in relation to signatories of the code will focus on monitoring their adherence to the Code.