EU AI Act for GPAI Model Providers
For providers of general-purpose AI (GPAI) models: the four Article 53 duties, extra systemic-risk duties and what Scanara supports.
GPAI duties have applied since 2 August 2025
Providers of general-purpose AI (GPAI) models must meet the four duties of Article 53 for models placed on the EU market since 2 August 2025. The Commission can fine breaches from 2 August 2026: up to 3% of worldwide annual turnover or EUR 15 million, whichever is higher (Article 101). Models placed on the market before 2 August 2025 must comply by 2 August 2027 (Article 111(3)). Next step: draft your Article 53 documentation.
What GPAI providers must do
Four duties for every GPAI model provider
Document the model, inform downstream providers, keep a copyright policy and publish a training-data summary (Article 53(1)). Free and open-source models are exempt from the first two duties, unless they present systemic risk (Article 53(2)).
Systemic-risk models carry four more duties
These providers also evaluate and test the model, assess and mitigate systemic risks, report serious incidents and secure the model (Article 55(1)). They notify the Commission within two weeks of meeting the threshold (Article 52(1)). The Act presumes systemic risk above a training-compute threshold (Article 51(2)).
Builders on top of a model are downstream providers
A downstream provider provides an AI system that integrates a GPAI model (Article 3(68)). Ask the model provider for the Article 53(1)(b) information. Your own system is classified separately.
What Scanara supports for GPAI providers
Guided GPAI assessment
A guided assessment follows Articles 53 to 55 and stores your answers as evidence. For the systemic-risk duties, Scanara documents the activities; your team performs the evaluation and testing.
Annex XI and XII drafts
Scanara generates drafts of the Annex XI technical documentation and the Annex XII information for downstream providers from your inputs. Your team completes and verifies them.
Document check
A document scan checks your Article 53 documentation for required content. It does not verify that the content is true.
What stays with you
Scanara does not train, evaluate or red-team a model. It does not publish your training-data summary or act as your authorised representative (Article 54).
Questions GPAI providers ask
Are the GPAI duties in force?
Yes. The duties of Articles 53 to 55 apply to models placed on the EU market since 2 August 2025. The Commission can fine breaches from 2 August 2026 (Article 101). For models placed on the market before 2 August 2025, the necessary steps are due by 2 August 2027 (Article 111(3)). For those models, an Article 101(1)(a) infringement cannot arise before 2 August 2027; fines under points (b) to (d) can.
What are the four Article 53 duties?
Keep technical documentation of the model (Annex XI) for the AI Office and national authorities. Give downstream providers information on the model’s capabilities and limits (Annex XII). Keep a policy to comply with EU copyright law. Publish a sufficiently detailed training-data summary, using the AI Office template (Article 53(1)).
What is systemic risk and how is it assessed?
A model has systemic risk if it has high-impact capabilities (Article 51(1)(a)). The Act presumes this above a training-compute threshold (Article 51(2)). The Commission can also designate a model using the criteria in Annex XIII (Article 51(1)(b)).
What does the training-data summary contain?
Article 53(1)(d) requires a sufficiently detailed summary of the content used to train the model, made public using the template of the AI Office. Scanara does not publish it for you.
Are open-weight models exempt?
Partly. Models under a free and open-source licence, with public weights, architecture and usage information, are exempt from the documentation and downstream-information duties. The copyright policy and the training-data summary still apply (Article 53(2)). The exemption does not cover models with systemic risk.
Read next
Start with the Article 53 documentation
The demo shows a real, anonymised compliance report and the product walkthrough.
Scanara prepares evidence from your repositories
Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.