General-purpose AI models and the codes of practice

0:00 General-purpose AI models

You probably don't train foundation models. So why should you care about the EU's rules for general-purpose AI? Because those rules decide what documentation you can demand from the models under every AI tool you use. And in some cases, building on or fine-tuning a model can create obligations for you. In this lesson, you'll learn what a general-purpose AI model is, what its providers must do, what changes at the systemic-risk level, how the Code of Practice works, and how to use all of it in vendor due diligence.

0:39 Why it matters to you

Why should a marketer or small business owner care about rules for model developers? Three reasons. First, leverage: these rules create documentation, copyright policies and training summaries you can request and compare when choosing vendors. Second, risk: if your content engine sits on a model with unclear copyright practices, that uncertainty flows downstream to your client work. Third, role clarity: understanding where model duties end helps you see exactly which system-level duties are yours, like disclosure, data handling and human review.

1:14 Definitions

A general-purpose AI model is trained on large amounts of data, shows significant generality, and can competently perform a wide range of tasks. Think large language models and big image or video generators. A system built on one, like a chatbot app, is a general-purpose AI system. And a model with high-impact capabilities is a model with systemic risk. The Act presumes that when training compute exceeds ten to the power of twenty-five floating point operations, and the Commission can designate models on other criteria too.

1:51 Analogy: engine and car

Here's an analogy. A general-purpose model is like a powerful engine sold to many car makers. The engine maker must document how the engine performs, what fuel it needs, and its limits, so car makers can build safe cars. If the engine is exceptionally powerful, the maker must also stress-test it and report serious failures. But the car maker is still responsible for the brakes, the seatbelts and the dashboard warnings on their own car. In AI terms, the model provider documents the model; you, building the app, are responsible for how your app behaves with users.

2:33 Duties for all GPAI providers

Every general-purpose model provider has four core duties. Keep technical documentation for the AI Office and authorities. Give downstream providers the information they need to understand capabilities and limits. Have a policy to comply with EU copyright law, including respecting text and data mining opt-outs. And publish a public summary of the content used for training, using the AI Office template. Open-source models with public weights are exempt from the first two, unless they carry systemic risk. The copyright policy and training summary still apply.

3:10 Systemic risk and timing

Systemic-risk models carry more. Their providers must run model evaluations including adversarial testing, assess and mitigate systemic risks, report serious incidents to the AI Office, and ensure strong cybersecurity. On timing: these obligations have applied since August twenty twenty-five. Models already on the market before then have until August twenty twenty-seven. And the Commission's power to fine providers, up to fifteen million euros or three percent of worldwide turnover, applies from August twenty twenty-six.

3:42 GPAI Code of Practice (July 2025)

Now the Code of Practice. Published in July twenty twenty-five, it's a voluntary tool providers can sign to show compliance. It has three chapters. Transparency, with a model documentation form. Copyright, covering copyright policy, respecting machine-readable opt-outs like robots dot text, and handling complaints. And safety and security, for systemic-risk models. Most major developers signed, some only certain chapters, and some declined. For you, signatory status is a useful data point in due diligence, but not a guarantee. Always check the Commission's current list.

4:19 Could you become a GPAI provider?

Could you become a general-purpose model provider? If you fine-tune or modify a model and place the result on the market, possibly, for the modification. Commission guidelines published in July twenty twenty-five limit modifier duties to the modification and give an indicative compute threshold. A small adapter trained on your brand voice and used internally is unlikely to count. Far more common is building a system on top of a model, like a support chatbot. Then you're a system provider or deployer, and system-level duties like chatbot disclosure are yours, no matter how compliant the model is.

5:01 Worked example: Riyadh fintech

Here's how a fintech in Riyadh picked a model for its marketing assistant. They compared three vendors on five questions. Did they sign the Code of Practice, and which chapters? Is a public training content summary available? How good is the downstream documentation? Is training on customer data off by default? And what data residency options exist? Two vendors passed; one had minimal documentation and unclear data terms. They shortlisted the two and wrote down why they rejected the third. That record becomes evidence for clients and for their own AI policy.

5:41 Example 2: internal brand-voice adapter

A simple example. An agency in Lahore trains a small adapter on top of an open-weight model to write in a client's brand voice, and uses it only internally to draft social posts. Are they now a general-purpose model provider? Very likely not: it's a modest modification used internally, not placed on the market as a model. They document that reasoning in their inventory, keep the model version on record, and apply their normal content review and disclosure rules to the posts. Clear, proportionate, and done in an afternoon.

6:20 Common mistakes

Three mistakes are common here. Assuming open-weight models come with no documentation duties at all, when the copyright policy and training summary still apply to their providers. Treating a model's compliance as covering your whole system, when your chatbot's disclosure and your data handling are your duties. And forgetting that model versions change. Tie your due diligence to specific versions, and review it whenever a vendor upgrades or swaps the model under your tool.

6:52 Watch me do it: model due diligence tab

Watch me do it. I'm adding a tab called Model due diligence. Columns: Tool, Underlying model and version, Provider, Code of Practice status, Training summary link, Downstream documentation, Data terms, Reviewed on. Row one, our chat assistant. I open the vendor's model documentation page and copy the model name and version shown there. Provider: the model developer. I check the Commission's signatory list and note which chapters they signed. I paste the link to the public training content summary. Downstream documentation: link to the model card and usage policy. Data terms: business plan, no training on inputs by contract, thirty-day retention. Row two, the image generator. This one's harder: the vendor doesn't name the underlying model. I write unknown and add an action: email the vendor using the seven-point request from the lesson text. Row three, our internal brand-voice adapter on an open-weight base. I note: modification is small and internal, so we're very likely not a GPAI provider, with the reasoning linked. Finally, I set a review trigger: any model version change reopens the row.

8:09 Recap and next step

Recap. General-purpose model rules bind the model developers, but they give you leverage: documentation, copyright policies, training summaries and incident processes you can request. Systemic-risk models carry extra duties. The Code of Practice is a useful signal, not a guarantee. And building your own app on a model makes the system duties yours. Next step: send the seven-point request in the lesson text to your main model or platform vendor, and file the answers with the model version they apply to.