GPAI EU AI Act Obligations — Developer Guide • Meteora Web Agency

You've released a generative AI model or you're thinking about it. Maybe an internal chatbot, an image generator, a classification system. Then you discover the EU AI Act has an entire category dedicated to "General Purpose" models — GPAI — and you wonder: does this apply to me too? The short answer is: it depends. But the useful answer is: if you don't know, you're already late.

At Meteora Web, we work every day with tools that integrate AI models — from WordPress plugins to proprietary Laravel systems. And when a client asks "can we use GPT-4 for support?", the first thing we evaluate isn't response quality: it's compliance. Because a model that answers well but violates GPAI obligations is a cost, not a benefit.

What defines a GPAI under the EU AI Act?

A GPAI (General Purpose AI) model is an AI model trained on large amounts of data, designed to perform general tasks — not a specific one. Think of it as a Swiss Army knife: it can cut, open bottles, screw. A specialized model is a scalpel: it does one thing, but it does it extremely well.

The EU AI Act, in Regulation (EU) 2024/1689, defines GPAI in Article 3, point 63: models trained with a large amount of data, with generality of output, adaptable to a wide range of distinct tasks. Concrete examples: GPT-4, Claude, Llama, Stable Diffusion. But beware: even a smaller model, if trained on vast data and used for general tasks, can fall under the definition.

The practical threshold? The Regulation distinguishes between "normal" GPAI and "systemic risk" GPAI. Systemic risk triggers when the model has high capabilities — measured in training FLOPs (more than 10^25) or designated by the Commission. For most SMEs, we're talking about normal GPAI. But the obligations aren't trivial even for those.

How to know if your model is GPAI

Ask yourself three questions:

Was the model trained on massive, general data (not just a narrow domain)?
Can it perform different tasks without retraining (e.g., writing, translating, summarizing, classifying)?
Is it distributed as a service or as a reusable component?

If you answer "yes" to all three, you're in. Even if your model is open source. The license doesn't save you: GPAI obligations apply to the model developer, not the distributor.

Operational checklist:

Document the amount of training data (in tokens or GB).
Identify the general tasks the model can perform.
Check if you exceed the 10^25 FLOPs threshold (for systemic risk).
If you use a third-party model (e.g., OpenAI API), check if the provider is already compliant — but don't delegate entirely: integrators also have obligations.

What obligations do you have as a GPAI developer?

The EU AI Act imposes clear obligations for GPAI providers. They're not optional. Here are the main ones, explained without bureaucracy:

Detailed technical documentation

You must produce a technical document describing: model architecture, training data, validation processes, performance metrics, known limitations. You don't need to publish it, but you must have it ready for authorities.

Practical example: if you've trained a model on Italian legal texts, you must document how many documents you used, how you cleaned them, what biases you detected, and how you mitigated them. We do this for our clients: it's not an option, it's a requirement.

Information for downstream providers

Anyone integrating your model (e.g., a company building a chatbot on it) must receive sufficient information to understand capabilities and limits. This includes: usage instructions, expected behaviors, residual risks.

In practice: if you sell an image generation model, you must specify it shouldn't be used to create deepfakes of real people without consent. Seems obvious, but without documentation, you're the responsible party.

Copyright policy

This is the part many ignore. You need a policy that respects Directive 2019/790 (Copyright in the Digital Single Market). In practice: you must demonstrate you've respected copyright on training data, including the opt-out right of rights holders.

At Meteora Web, we've seen projects stall because the client used datasets downloaded from public repositories without verifying licenses. GDPR isn't the only risk: copyright is a ticking time bomb.

Training data and transparency

You must publish a sufficiently detailed summary of the data used for training. You don't need to list every single file, but you must indicate: data types, sources, languages, any personal data included.

Warning: if you've used personal data, you must comply with GDPR. This means legal basis, impact assessment, and the possibility for data subjects to object. Not a detail: it's a parallel obligation.

How to handle systemic risk if your model is large

If your model exceeds the 10^25 FLOPs threshold (or is designated by the Commission), additional obligations kick in: standardized assessments, adversarial testing, serious incident reporting, cybersecurity measures. For most SMEs, this is irrelevant — but if you use a large open-source model (e.g., Llama 3 405B), you must verify if the provider has already complied.

The practical rule: don't train giant models without a dedicated legal team. If you do, prepare a compliance budget that's at least 20% of training cost.

Example code for automatic documentation

You can automate part of the documentation with a script. Here's a Python example to extract basic metrics from your model:

import torch
from transformers import AutoModelForCausalLM, AutoTokenizer

def model_metrics(model_name):
    tokenizer = AutoTokenizer.from_pretrained(model_name)
    model = AutoModelForCausalLM.from_pretrained(model_name)
    
    # Estimate parameters
    params = sum(p.numel() for p in model.parameters())
    
    # Estimate FLOPs per forward pass (approximation)
    vocab_size = len(tokenizer)
    seq_len = 2048
    flops = 6 * params * seq_len  # approximate formula
    
    return {
        "model_name": model_name,
        "parameters": params,
        "flops_per_forward": flops,
        "vocab_size": vocab_size
    }

print(model_metrics("meta-llama/Llama-3.2-1B"))

This script gives you a base for documentation. It's not sufficient for full compliance, but it's a starting point.

What are the penalties for not respecting GPAI obligations?

Penalties for GPAI violations reach up to €15 million or 3% of global annual turnover — if you're a company. For SMEs, the amount can be reduced, but it's not a discount: it's a fine that can close a business.

Additionally, there's reputational damage. If a client discovers your model isn't compliant, you lose trust. And in the digital world, trust is your main asset.

We always say: compliance isn't a cost, it's an investment. A compliant model is easier to sell, easier to insure, easier to internationalize.

How to apply these obligations in your company

You don't need a 50-person legal team. You need a process. Here's how we do it:

Model inventory: list all GPAI models you use or develop, even those embedded in larger products.
Risk assessment: for each model, determine if it's systemic or normal risk.
Documentation: create a technical documentation template and fill it for each model.
Copyright policy: verify dataset licenses and implement a process to handle opt-out requests.
Continuous monitoring: compliance isn't a one-time event. Update documentation at every release.

For the copyright part, we recommend using tools like Copyright.eu to verify dataset licenses. For technical documentation, the official EU AI Act site offers useful resources.

What to do now

Don't wait for the authority to contact you. Act now:

Identify your GPAIs: audit the models you use or develop. If you don't know which ones, start there.
Create a documentation template: use the code above as a base and adapt it to your needs.
Verify data licenses: check every training dataset. If you don't have the license, don't use it.
Legal consultation: if your model is large or you use sensitive data, invest in specialized consultation. It costs less than a fine.
Integrate compliance into your workflow: don't treat it as an extra. Every new release must include documentation updates.

At Meteora Web, we've seen companies turn compliance into a competitive advantage: clients choosing "certified" providers over risky ones. If you want to understand how to apply all this to your project, start with our EU AI Act pillar guide and then come back here for GPAI details.

And if you need help with implementation, contact us. We work with SMEs and developers across Italy, and we know how to make compliance a manageable process.