GPAI provider assessment: Articles 53 to 55
Providers of general-purpose AI models: the duties of Articles 53 to 55 and Scanara’s guided assessment.
Providers of general-purpose AI (GPAI) models must document the model, inform downstream providers, publish a training-data summary and keep a copyright policy (Article 53).
The duties apply to models placed on the EU market from 2 August 2025. The Commission can fine breaches from 2 August 2026: up to 3% of worldwide turnover or EUR 15 million, whichever is higher (Article 101). For earlier models, duty breaches cannot arise before 2 August 2027 (Article 111(3)). Non-EU providers need an authorised representative, with an open-source exception (Article 54). Next step: providers draft documentation; downstream providers (system builders) request model information.
Article 53 sets four duties for GPAI providers
Document the model
Draw up and keep up to date the technical documentation of the model, including its training, testing and evaluation results. Give it to the AI Office (the Commission’s function for supervising GPAI models) and to national authorities on request (Article 53(1)(a)).
Inform downstream providers
Draw up and make available information on the model’s capabilities and limits, so that providers building AI systems on it can meet their own obligations. This does not affect the need to observe and protect intellectual property rights and confidential business information or trade secrets under Union and national law (Article 53(1)(b)).
Keep a copyright policy
Put in place a policy to comply with EU copyright law. It must identify and respect rights holders’ reservations against text and data mining (automated analysis of content to find patterns) (Article 53(1)(c); Directive (EU) 2019/790, Article 4(3)).
Publish a training-data summary
Publish a sufficiently detailed summary of the content used to train the model, using the template of the AI Office (Article 53(1)(d)).
Providers of models released under a free and open-source licence are exempt from the first two duties, documentation and information, if weights, architecture and usage information are public. They still need the copyright policy and the summary. The exemption does not cover models with systemic risk (Article 53(2)).
Systemic-risk models carry four more duties
A model has systemic risk if it has high-impact capabilities (Article 51(1)(a)). These are capabilities that match or exceed those of the most advanced GPAI models (Article 3(64)). The Act presumes this when training used more than 1025 floating-point operations (FLOPs) (Article 51(2)). The Commission can also designate a model. These providers must meet the duties of Article 55 as well.
Evaluate and test the model
Evaluate the model with standardised protocols and state-of-the-art tools. This includes adversarial testing (attacking the model on purpose to find weaknesses) (Article 55(1)(a)).
Assess and mitigate systemic risks
Assess and mitigate possible systemic risks at Union level, including their sources (Article 55(1)(b)).
Report serious incidents
Keep track of serious incidents, document them with possible corrective measures, and report them without undue delay to the AI Office and, as appropriate, to national competent authorities (Article 55(1)(c)).
Protect against cyberattacks
Ensure an adequate level of cybersecurity protection for the model and its physical infrastructure (Article 55(1)(d)).
Providers of GPAI models with systemic risk must meet these duties in addition to Articles 53 and 54 (Article 55(1)). They must also notify the Commission within two weeks after the model meets the high-impact-capabilities condition, or after it becomes known that it will (Article 52(1)).
Dates: duties since 2 August 2025, earlier models until 2 August 2027
In our reading, for models placed on the market before 2 August 2025, an infringement of the Article 53 duties cannot arise before 2 August 2027, because Article 111(3) gives them until then. Fines under Article 101(1), points (b) to (d), for failing to answer an information request, follow a requested measure or give access for an evaluation, apply from 2 August 2026.
What Scanara does for GPAI providers
Scanara does not decide which duties apply to your model. You decide, with counsel where the stakes warrant.
A guided GPAI provider assessment
Scanara walks you through the duties of Articles 53 to 55 for your model and records your answers. You decide which duties apply, with counsel where the stakes warrant.
Annex XI and XII documents
Scanara generates Annex XI and XII documentation from templates, partly pre-filled from your answers. You write the model-specific content.
Rule-based checks, no model testing
Scanara checks code and documents against rules built from Articles 51 to 55. It does not test or evaluate your model; the Article 55 testing stays your work.
Read the detail behind related duties
Article 55: Systemic-Risk Duties of GPAI Providers
Covers the threshold, the notification and the four extra duties of systemic-risk model providers.
Article 53: GPAI Provider Duties
Explains the four duties of every GPAI provider in full.
EU AI Act Deadlines: Timeline From 2024 to 2030
Shows every application date of the Act, GPAI dates included.
GPAI obligations: what model providers and builders must do
Gives the overview for providers and for builders who use a GPAI model through an API.
Common questions about GPAI providers
Does using an API make me a GPAI provider?
No. Building an AI system on a GPAI model through an API makes you a downstream provider. The Article 53 duties stay with the model provider. If you modify or fine-tune the model, the answer can change: recital 109 says the provider’s duties should be limited to the modification, and the Commission’s guidelines say when a change is significant enough to make you a provider. The guidelines are not legally binding, and the Commission’s interpretation can change. If your system is high-risk, you meet the high-risk requirements as its provider.
Do open-source GPAI models have reduced duties?
Partly. Models under a free and open-source licence are exempt from two duties: documentation and downstream information (Article 53(1)(a) and (b)). The exemption requires public weights, architecture and usage information. They still need a copyright policy and a training-data summary. The exemption does not apply to models with systemic risk (Article 53(2)).
When do these duties take effect?
Since 2 August 2025 for models placed on the EU market from that date. Models placed on the market before 2 August 2025 have until 2 August 2027 (Article 111(3)). The Commission can fine providers from 2 August 2026 (Article 101).
Is a model card required?
The Act does not use the term “model card”. Article 53(1)(b) requires information and documentation for providers who integrate the model, with at least the elements of Annex XII. A model card is one common format for it.
Scanara prepares evidence from your repositories
Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.