General-purpose AI (GPAI) models: transparency, systemic risk, and downstream deployers

General-purpose AI models (GPAI) — often called foundation models in industry speech — are trained with a large amount of data using self-supervision at scale and display significant generality. The EU AI Act adds Title VIIIA obligations for providers of GPAI models, including technical documentation, transparency to downstream providers, and — for systemic-risk models — additional measures (evaluation, adversarial testing, incident reporting, cybersecurity).

What downstream deployers should demand in procurement

Even if your application is narrow, you inherit integration risk: prompts, tools, RAG corpora, and fine-tunes change behaviour. Contractual clauses should reference EU AI Act conformity for the use case, model version pinning, incident notification, and documentation handover for your own Annex IV or transparency duties.

Systemic risk and public capability

Models with high impact capabilities may be classified as posing systemic risk after designation — triggering stricter evaluation, tracking, and reporting. ML leads should monitor Commission decisions and technical standards as they stabilise.

Agent Mai in the GPAI context

Use Agent Mai to document how a GPAI is constrained in your product: guardrails, retrieval boundaries, human review gates, and logging — so your technical file tells a coherent story from base model to deployed behaviour.