Module 4: EU AI Act Deep Dive

6. Minimal Risk and General Purpose AI

Capsule description

This capsule covers two categories:

Minimal Risk: the majority of AI systems. Voluntary codes only.
General Purpose AI (GPAI): foundation models with specific obligations independent of the risk classification.

GPAI matters because if you use OpenAI, Anthropic, or Google APIs, their models are under the GPAI rules. Your system integrates those models — so transitively, the GPAI rules affect your compliance.

Minimal Risk

Definition

Systems that do not fall into Unacceptable, High, or Limited risk → Minimal.

Examples:

Spam filters.
Video games with AI.
Inventory management AI.
Recommendation engines (not essential services).
Customer analytics (aggregated).
Most internal business AI tools.

Obligations

Legally: none.

Encouraged: voluntary codes of conduct. Best practices.

Voluntary best practices

The EU AI Office encourages adopting voluntary codes. Common best practices:

## Voluntary Best Practices Checklist (Minimal Risk)

- [ ] Document the AI system's purpose and scope
- [ ] Maintain basic technical documentation
- [ ] Test for accuracy and robustness
- [ ] Monitor for bias (especially if user-facing)
- [ ] Provide user-facing transparency where appropriate
- [ ] Have an incident response plan
- [ ] Periodic review (annual)

Adopting these practices voluntarily:

Is forward-compatible: regulation may extend in the future.
Builds trust with users and partners.
Demonstrates good faith if questioned.
Reduces real risk independently of regulation.

General Purpose AI Models

Definition

Foundation models with broad capabilities that can be used for multiple purposes.

Examples:

Large language models (GPT, Claude, Llama, Gemini, Mistral).
Image generation models (DALL-E, Stable Diffusion, Midjourney).
Multimodal models.
Speech recognition models with general capabilities.

Two tiers

Tier 1: All GPAI models:

Obligations (Art. 53):

Technical documentation: model details, a summary of the training data, computational resources used.
Transparency: information for downstream providers.
Copyright respect: a policy for respecting copyright in the training data.
A summary of the training data: a publicly available summary.

Tier 2: GPAI with systemic risk:

Models with high-impact capabilities (currently defined as >10^25 FLOPs in training, though the threshold may evolve):

Additional obligations (Art. 55):

Model evaluation including adversarial testing.
Risk assessment and mitigation.
Cybersecurity protections.
Reporting serious incidents to the AI Office.
Energy efficiency considerations.

Implications for downstream users

If you USE a GPAI model (you're a "deployer" or you build on top of one):

You are not the GPAI provider — they have direct obligations. But:

The provider must give you information: documentation, capabilities, limitations.
You inherit some risks: if the base model has issues, your downstream system may too.
Your end-system's classification: still depends on the use case (high-risk, limited, etc.).

Practical implications

For your system built on a GPAI API:

## GPAI Dependency Documentation

### Provider
- Vendor: OpenAI
- Model: GPT-4 Turbo
- API endpoint: api.openai.com
- Contract: Enterprise agreement

### Provider's Compliance (verified)
- Technical documentation: published
- Training data summary: published
- Copyright policy: published
- Systemic risk: classified as systemic (over threshold)

### Implications for our system
- Our system inherits GPT-4's capabilities and limitations.
- Documentation references the provider's docs where applicable.
- We add our own classification (high-risk medical use case).

### Contract considerations
- Enterprise SLA includes compliance commitments.
- Provider commits to no training on our data.
- Provider liability allocation per contract.

Foundation model provider compliance status (May 2026)

Provider	Tier 2 Status	Compliance Status
OpenAI (GPT-4, GPT-5)	Yes	Documentation published
Anthropic (Claude 3, 4)	Yes	Documentation published
Google (Gemini 1.5, 2)	Yes	Documentation published
Meta (Llama 3, 4)	Yes (open)	Open licensed with docs
Mistral	Variable	Documentation published

Verify the status when integrating; it changes regularly.

When you become a GPAI provider

If you train a foundation model yourself (not just fine-tune one), you're a GPAI provider.

The threshold for "GPAI": broad capabilities + multiple use cases.

Fine-tuning a foundation model typically does NOT make you a GPAI provider — you're using GPAI to build a downstream system.

If you ARE a GPAI provider, you have the full Art. 53 (and possibly Art. 55) obligations.

This applies to:

Companies training proprietary foundation models.
Open-source projects releasing capable models.
Research organizations with capable models.

Common traps

1. "Minimal risk = no work needed"

Voluntary best practices reduce real risk + future-proof you. Don't skip them.

2. Ignoring the GPAI provider's compliance

If your provider is non-compliant, that isn't safe for you. Your liability may be affected. Verify before integrating.

3. Treating fine-tuning as becoming a GPAI provider

Generally it isn't. Fine-tuning a model = using GPAI. Making the original = providing GPAI.

But: if your fine-tuning is so substantial that it creates new general-purpose capabilities, it's debatable.

4. Assuming open source = no GPAI obligations

Open-source GPAI providers still have obligations under the EU AI Act, with some specific exceptions. Check carefully if you're releasing models.

5. Not tracking the capability thresholds

10^25 FLOPs is the current threshold for systemic risk. It may change. Track the regulatory updates.

Self-check

1. When am I a "GPAI provider" vs. a "GPAI deployer"?

GPAI Provider: you train and release a GPAI model. Examples:

OpenAI (provides the GPT models).
Anthropic (provides Claude).
Meta (provides Llama).

GPAI Deployer (or downstream user): you use someone else's GPAI in your system. Examples:

Building a chatbot using the OpenAI API.
Fine-tuning Llama for a specific use.
Using Claude in your enterprise app.

Differences in obligations:

Aspect	Provider	Deployer
Technical docs	Required	Use the provider's
Risk assessment	Required (esp. systemic risk)	Per use case
Copyright policy	Required	Inherit + your own
Training data summary	Required	N/A
Cybersecurity	Required (Tier 2)	Per system

Most engineers are deployers, not providers. Focus on use-case-specific obligations + verifying the provider's compliance.

An edge case: substantial modifications. If you fine-tune so substantially that you create new general-purpose capabilities, you may be considered a provider. Currently rare.

2. Why does the GPAI status of the provider I use matter?

Reasons:

Liability allocation: contracts typically address responsibility. If the provider is non-compliant, the exposure may shift.
Documentation reuse: the provider's compliance documentation supports yours. You need it to reference.
Capabilities and limitations: the provider documents what the model can/can't do. Critical for classifying your use case.
Risk mitigations: if the provider implements protections, they apply to your system too. It saves duplicate work.
Future updates: the provider may change models/capabilities. That affects your compliance.

Practical:

Choose providers who are compliant.
Verify the status before integrating.
Document the dependency.
Monitor the status quarterly.
Have a contingency plan if the provider becomes non-compliant.

Vendor risk now extends to compliance, not just technical matters.

Summary and next step

Minimal Risk: the majority. Voluntary codes encouraged but not legally required.
GPAI: foundation models with specific obligations.
Tier 1 GPAI: all foundation models — documentation, transparency, copyright respect.
Tier 2 GPAI: systemic risk (> 10^25 FLOPs) — additional obligations.
Downstream users: not direct providers, but they inherit some risk + must verify provider compliance.

Bridge: capsule 07 covers timelines and penalties — when each obligation kicks in and the cost of non-compliance.

Resources

EU AI Act Art. 53-55 — GPAI — the text.
GPAI Model Documentation Templates — templates.

Next: 07-timelines-penalties.md — Compliance timelines and penalties.

Capsule 06 of 08 — Module 4 — AI Ethics & Compliance Guide

← Previous5. Limited Risk: Transparency Obligations Next →7. Timelines and Penalties