General-purpose AI models: what must the provider do, and what should the customer demand?

From 2 August 2026 the European Commission may enforce the rules in the AI Act against providers of general-purpose AI models, which can perform a wide range of tasks and be integrated into many systems. The obligations in Chapter V have applied since 2 August 2025, but the Commission’s power to request information, order measures and impose fines applies only from August 2026. In a press release of 31 July 2026, the Commission stated that the AI Office can now enforce these rules and that a dedicated channel has been opened for downstream providers wishing to report infringements. For Norwegian businesses building services on such models, the questions are what the provider must do, what the supervision means and how the contract should allocate the risk.

What obligations do providers of general-purpose AI models have under Article 53?

AI Act Art. 53(1) imposes four obligations on the provider. The provider must draw up and keep up to date technical documentation of the model, including its training and testing process and the results of its evaluation, containing at least the information set out in Annex XI (point (a)). The provider must make information and documentation available to downstream providers that intend to integrate the model into their own AI systems, containing at least the elements in Annex XII (point (b)). This enables them to understand the model and meet their own obligations. The provider must put in place a policy to comply with Union law on copyright and related rights, including identifying and complying with reservations of rights against text and data mining under DSM Directive Art. 4(3) (point (c)). Finally, the provider must publish a sufficiently detailed summary of the content used for training, in accordance with a template provided by the AI Office (point (d)).

The Commission published the template on 24 July 2025. It has three parts, covering general information, a list of data sources and data processing aspects relevant to rightholders. For content scraped from the internet, the Commission’s Q&A states that the provider must list the top 10 per cent of domains by volume of content, while small and medium-sized enterprises may limit the list to 5 per cent or 1,000 domains. The summary must be public no later than when the model is placed on the EU market.

Under AI Act Art. 53(2), points (a) and (b) do not apply to models released under a free and open-source licence with publicly available weights. The exception does not cover models with systemic risk, nor does it extend to the copyright policy or the training data summary. Models placed on the market before 2 August 2025 must comply by 2 August 2027 under AI Act Art. 111(3).

What is the GPAI Code of Practice?

The GPAI Code of Practice is a voluntary code published on 10 July 2025, which the Commission and the AI Board have assessed as an adequate tool for demonstrating compliance. Under AI Act Art. 53(4), providers may rely on such a code until harmonised standards are published. The code has three chapters, on transparency, copyright, and safety and security, and the last applies only to models with systemic risk.

The copyright chapter is the most relevant for customers. Signatories commit not to circumvent paywalls and other technological protection measures when collecting training data. They must exclude websites that courts or authorities in the EU and EEA have found to infringe copyright on a commercial scale, and they must respect robots.txt and other machine-readable reservations. In addition, they must implement technical safeguards against the model reproducing protected content in an infringing manner, prohibit infringing use in their terms, and provide a point of contact and a complaints mechanism for rightholders. According to the Commission’s list, Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI and OpenAI are among the signatories, whereas xAI has signed only the safety and security chapter.

What supervisory and enforcement powers does the Commission have from 2 August 2026?

The Commission has exclusive powers to supervise and enforce Chapter V, and it has entrusted these tasks to the AI Office under AI Act Art. 88(1). The supervisory provisions in Articles 88 to 94 and the fining provision in Article 101 apply from 2 August 2026 under AI Act Art. 113. The Commission may request the technical documentation and other information under AI Act Art. 91 and conduct evaluations of the model under Article 92. Under AI Act Art. 93(1), it may require the provider to comply with Articles 53 and 54, to restrict the making available of the model, or to withdraw or recall it.

Under AI Act Art. 101(1), the Commission may fine the provider up to 3 per cent of its annual worldwide turnover or EUR 15 million, whichever is higher. Fines may be imposed for intentional or negligent infringements of the Regulation, for failing to respond to a request for information or supplying incorrect, incomplete or misleading information, and for failing to comply with a requested measure. Before adopting a decision, the Commission must communicate its preliminary findings and give the provider an opportunity to be heard (Article 101(2)). Downstream providers may lodge complaints under AI Act Art. 89(2).

On 12 October 2026 the Commission stated that the AI Office has already sent requests for information on security practices and that further requests will be sent to the companies behind models involved in loss-of-control incidents. There have also been media reports that requests have gone to a larger number of providers and concern copyright and missing training data summaries. The Commission has not confirmed these reports, and no fine on any provider has been made public.

Do the rules on general-purpose AI models apply in Norway?

The AI Act has not been incorporated into the EEA Agreement, and EEA-Lex still lists it as under scrutiny. On 4 August 2026 the Norwegian Government announced that the draft Norwegian AI Act will be sent for a new consultation following the amendments in the EU, and that work on EEA adaptations continues. The Commission therefore has no powers over providers in Norway at present. The obligations nonetheless reach Norwegian businesses indirectly, because the major providers offer the same models throughout the EEA and must comply in the EU. Norwegian businesses that place AI systems on the EU market also become downstream providers within the meaning of the Regulation.

The text and data mining reservation in the DSM Directive is proposed to be implemented in the Norwegian Copyright Act through Prop. 41 LS (2025–2026). The question of who owns what the models produce is addressed in the article on copyright and AI.

What does the Council’s Digital Omnibus mandate mean for personal data in training data?

On 19 November 2025 the European Commission proposed, in its Digital Omnibus, amendments to the GDPR that bear directly on the training and operation of AI models. On 21 October 2026 the Permanent Representatives Committee (Coreper) agreed the Council’s negotiating mandate, which is set out in Council document ST 14756/26. The European Parliament has not yet adopted its position, and trilogue negotiations between the institutions remain. None of the amendments has been adopted, and it has not been settled whether they will be incorporated into the EEA Agreement. The current data protection rules therefore continue to apply in full. A broader overview of the proposal is available in the article on the Digital Omnibus and the GDPR.

The Commission proposed a new GDPR Art. 88c under which processing necessary for the development and operation of an AI system or AI model could be pursued as a legitimate interest under Article 6(1)(f). The proposal contained a list of safeguards and an unconditional right for the data subject to object. In the Council’s mandate the provision is renumbered as Article 88 bis and simplified. Under paragraph 1, processing in the context of the development and operation of an AI system or AI model may be carried out for a legitimate interest of the controller or a third party in accordance with Article 6(1)(f). The Council has deleted the list of safeguards and the unconditional right to object. In return, paragraph 2 clarifies that the provision does not affect the obligation to identify the appropriate legal basis under Article 6. Paragraph 3 provides that technical and organisational measures and safeguards, including the right to object under Article 21, apply irrespective of the legal basis relied on.

In our assessment, the Council’s Article 88 bis does not create an independent legal basis. The reference to Article 6(1)(f) means that the requirements of necessity and balancing of interests must still be satisfied in each case. Nor is the right to object under GDPR Art. 21(1) unconditional, since the controller may continue processing if it demonstrates compelling legitimate grounds which override the interests of the data subject. The Council has also narrowed the Commission’s new exception from the prohibition on processing special categories of personal data in GDPR Art. 9(2)(k). In the mandate, the exception covers only incidental processing of residual data not intended by the controller in the development and technical operation of an AI system or AI model. Under a new Article 9(5), the provider must take measures to avoid collecting such data, erase it without undue delay once identified, and protect it against further processing, use in outputs and disclosure where erasure is technically impossible or requires disproportionate effort.

For customers, this means that data protection law should be covered by the same contractual requirements that address the AI Act and copyright. The warranty that training data has been lawfully obtained should extend to the GDPR, including a documented legal basis and a balancing of interests under Article 6(1)(f). The indemnity should cover claims from data subjects and decisions of data protection authorities concerning the training data, and not only rightholder claims. The right to documentation should include the provider’s procedures for handling objections under Article 21 and for detecting, erasing or restricting special categories of personal data. The notification obligation should extend to enquiries from data protection authorities, since an order to erase data or suspend processing may require the model to be modified or retrained. Where the customer uses its own personal data for fine-tuning, it is itself the controller and needs its own legal basis, whatever final form Article 88 bis takes.

What should customers of general-purpose AI models demand in the contract?

The obligations in Article 53 apply between the provider and the Commission and give the customer no independent claim. Businesses that build products on a model should therefore ensure that the contract reflects the statutory obligations and allocates the risk of non-compliance. Section K.1 of Anthropic’s Commercial Terms of Service obliges the provider to defend and indemnify the customer against claims that paid use of the services or outputs infringes third-party intellectual property rights, and this obligation is excluded from the limitation of liability. The exclusions in Section K.3 are nevertheless broad and include modifications made by the customer, combination with other services, and use that the customer should have known to be infringing. The requirements that providers impose on customer use are discussed in the article on AI vendor terms for high-risk use. In our assessment, a business building a significant service on a general-purpose AI model should seek to include the following in the contract.

1. Require a warranty that the provider complies with AI Act Art. 53 and adheres to the GPAI Code of Practice or otherwise complies by documented means.
2. Require a warranty that training data has been obtained in accordance with copyright law, including reservations under the DSM Directive.
3. Require an indemnity covering rightholder claims relating to the model, the training data and the outputs, without a monetary cap or with a separate high cap, and with narrow exclusions.
4. Require access to the Annex XII information and to current technical documentation to the extent the business needs it for its own obligations.
5. Require notice without undue delay when the provider receives requests, measures or decisions from the AI Office that may affect the model, its availability or the terms.
6. Require a right to terminate without cost, and assistance in migrating to another model, if the Commission orders the model to be restricted or withdrawn.

The customer should also verify that the provider has published a training data summary for the model and version actually in use, and keep records of which model underpinned the service. Further material on the regulatory framework is available on the topic page on artificial intelligence. A missing summary or copyright policy is an infringement that the downstream provider may report to the AI Office under Article 89(2).

Questions and answers

Next legal review: 1 December 2026