GPAI: What documentation do businesses need?
4 min read
Businesses using ChatGPT, Copilot or Claude do not automatically have to create four legally prescribed blocks of GPAI documentation. The EU AI Act distinguishes between providers of general-purpose AI models, providers of AI systems and their deployers. A company’s obligations depend on its role and how it uses the system. An internal register can still help keep track of responsibilities and risks.
Key points at a glance
- GPAI rules apply to model providers. Among other things, they must prepare technical documentation and provide information to downstream system providers. Exceptions apply to certain freely licensed models.
- Obligations depend on the company’s role. Anyone using a ready-made AI system in a professional capacity is generally a deployer. Anyone who develops or commissions a system under their own name and places it on the market or puts it into service may be a provider.
- A register of AI use is a practical recommendation. It provides an overview of purposes, data and responsibilities. It does not follow that there is a general obligation to use a fixed documentation scheme.
Distinguishing models, applications and roles
What is a GPAI model? A general-purpose artificial intelligence model can perform a wide range of different tasks and be integrated into various downstream systems. An AI system is the application an organisation or its employees work with. Such a system can be based on a GPAI model.
The EU AI Act distinguishes between actors along this chain. The provider of a GPAI model has different responsibilities from the provider of an AI system. A company that uses a ready-made system in a professional capacity under its own authority is generally its deployer.
Integrating a model into a workflow does not in itself make the resulting use a high-risk system. The system’s characteristics and intended purpose are decisive. If a company develops its own application or makes substantial changes to an existing system, it should assess its role and the resulting obligations separately.
The obligations of model providers
The relevant rules have generally applied to providers of GPAI models since 2 August 2025. They include technical documentation, information for downstream providers of AI systems, a policy for compliance with EU copyright law and a published summary of the content used for training. The regulation provides exceptions for certain models released under free and open licences. Additional obligations apply to models with systemic risk.
For models placed on the market before 2 August 2025, providers must comply with their obligations by 2 August 2027. Since 2 August 2026, the Commission has been able to enforce compliance by model providers. The European Commission explains the deadlines in its guidelines.
These model provider obligations cannot be transferred to an SME simply because it buys a licence for an application built on such a model. A provider statement is nevertheless a useful starting point for understanding functions, limitations and conditions of use.
What businesses should check when using AI
For deployers, specific requirements depend on the system and its intended purpose. Transparency obligations apply to certain applications. The regulation sets out specific deployer obligations for high-risk systems. The European Commission gives 2 December 2027 as the start date for the relevant rules for high-risk systems in sensitive areas such as employment. A different timetable applies to high-risk AI in regulated products.
A system that assesses or sorts applications for selection therefore requires closer examination of its intended purpose and classification. A general legal requirement for every AI-assisted recruitment decision to be checked by a second person cannot be inferred from this. Nor does the regulation impose a blanket obligation to carry out sample checks on every AI application.
Regardless of that classification, Article 4 of the regulation requires providers and deployers to take measures to ensure a sufficient level of AI literacy among people who deal with AI systems on their behalf. Suitable measures depend, among other things, on their knowledge and the context in which the systems are used.
A register of AI use as a practical tool
For internal oversight, an overview of the applications in use is recommended. It can record what a system is used for, who is responsible, what types of data are entered and which provider requirements apply. It can also address who checks results before they are used and when a specialist or legal review is needed.
For applications that may affect employees or job applicants, the company should examine the specific purpose and the role of the software with particular care. The overview can also refer to relevant provider information and internal decisions. It is a practical organisational tool and does not replace an assessment of the applicable obligations.
Frequently asked questions
Does a ChatGPT or Copilot licence make a company a GPAI model provider?
Simply obtaining and using such an application does not automatically make the company the provider of the underlying model. Its legal role depends on its specific activities.
Must every use of AI be documented in four fixed blocks?
The AI Act does not lay down a general obligation to use a fixed scheme. Specific obligations may apply depending on the role, system and intended purpose. An internal register is also useful as an organisational tool.
When do the GPAI obligations apply to model providers?
They have generally applied since 2 August 2025. For models placed on the market before that date, providers must comply by 2 August 2027. The Commission’s enforcement powers have applied since 2 August 2026.
Read more on MyBusinessFuture
MyBusinessFutureWhoever Takes Three Days Has Already Lost the LeadMyBusinessFutureProcess optimization fails at the handover, not at the toolMyBusinessFutureWhen AI tools start eating the marginMore from the MBF Media Network
cloudmagazinGoogle Gemini in business: what the AI Act requiresDigital ChiefsTech mandates on supervisory boards: NIS2, the EU AI Act and the skills gapSecurityTodayAdaptive MFA: default settings are not enoughImage source: AI-generated (November 2026)
Translated from the German original using artificial intelligence. The German version is authoritative.
