EUAICheck is an independent self-assessment tool. We are not a law firm and have no link with any official authority.
EUAICheck is an independent self-assessment tool published by Vival Solutions (EI). This content is informational, is not legal advice and may change: always check the official text on EUR-Lex.
ChatGPT, Claude, Gemini, Mistral: the EU AI Act when your product uses a general-purpose AI model
Updated 30 September 2026 · Articles 25, 50 and 51 to 56 of Regulation (EU) 2024/1689
Obligations specific to general-purpose AI ("GPAI") models fall on their providers (OpenAI, Anthropic, Google, Mistral…) since 2 August 2025. If you integrate such a model into your product, your obligations depend mainly on what your system does: transparency, and possibly high risk.
1. What is a general-purpose AI model?
A model trained on large amounts of data, displaying significant generality and able to competently perform a wide range of distinct tasks: writing, code, analysis, conversation, images. Large language models from OpenAI, Anthropic, Google, Meta or Mistral are typical examples. The Regulation distinguishes the model (the technical building block) from the AI system that uses it (your chatbot, tool or application).
2. Obligations of model providers (Article 53)
- Keep technical documentation of the model, provided on request to the AI Office and national authorities.
- Give companies integrating the model the information needed to understand its capabilities and limitations and meet their own obligations.
- Put in place a copyright compliance policy.
- Publish a sufficiently detailed summary of the content used for training.
Models released under a free and open-source licence benefit from exemptions, unless they present systemic risk. These obligations are supervised by the European Commission's AI Office.
3. Your role when you integrate a model
Using a model through an API does not make you a "model provider". However:
- If you build an AI system on that model (chatbot, assistant, analysis tool) and place it on the market or put it into service under your name, you are in principle the provider of that system.
- If you use that system in your business, you are also its deployer.
- If you substantially modify a high-risk system, or change its purpose so that it becomes high-risk, you may become the provider of that high-risk system (Article 25).
4. Your obligations in practice
- Transparency (Article 50), since 2 August 2026: tell people they are interacting with AI; mark generated content; disclose deepfakes. See our Article 50 guide.
- High risk, if your system is used for an Annex III purpose (recruitment, credit, education…): high-risk obligations apply from 2 December 2027, whether or not the system relies on a third-party model.
- AI literacy (Article 4): take measures to support AI literacy of the people using these tools.
- GDPR: if personal data is sent to the model, check the legal basis, information to individuals and transfers outside the EU.
A compliant model does not make your system compliant. A model provider meeting Article 53 does not answer for the use you make of it.
5. Models with systemic risk (Articles 51 and 55)
A model is presumed to present systemic risk when the compute used for its training exceeds 1025 floating-point operations (Article 51(2)), or following a Commission decision. Its providers have additional obligations: model evaluation including adversarial testing, risk mitigation, serious incident reporting, cybersecurity. These obligations sit with the model provider and do not directly add to yours.