Módulo 4: EU AI Act Deep Dive

6. Minimal Risk y General Purpose AI

Descripción de la cápsula

Esta cápsula cubre dos categorías:

Minimal Risk: la majority de AI systems. Voluntary codes only.
General Purpose AI (GPAI): foundation models con specific obligations independent del risk classification.

GPAI es importante porque si usás OpenAI, Anthropic, Google APIs, sus models están bajo GPAI rules. Tu sistema integra esos models — by transitive, GPAI rules afectan tu compliance.

Minimal Risk

Definition

Sistemas que no caen en Unacceptable, High, o Limited risk → Minimal.

Examples:

Spam filters.
Video games con AI.
Inventory management AI.
Recommendation engines (no esential services).
Customer analytics (aggregated).
Most internal business AI tools.

Obligations

Legalmente: ninguna.

Encouraged: voluntary codes of conduct. Best practices.

Voluntary best practices

EU AI Office encourages adoption of voluntary codes. Common best practices:

## Voluntary Best Practices Checklist (Minimal Risk)

- [ ] Document AI system purpose y scope
- [ ] Maintain basic technical documentation
- [ ] Test for accuracy y robustness
- [ ] Monitor for bias (especially si user-facing)
- [ ] Provide user-facing transparency where appropriate
- [ ] Have incident response plan
- [ ] Periodic review (annual)

Adoptar estas practices voluntariamente:

Forward-compatible: regulation may extend en future.
Builds trust con users y partners.
Demonstrates good faith if questioned.
Reduces real risk independently of regulation.

General Purpose AI Models

Definition

Foundation models con broad capabilities que pueden be used for multiple purposes.

Examples:

Large language models (GPT, Claude, Llama, Gemini, Mistral).
Image generation models (DALL-E, Stable Diffusion, Midjourney).
Multimodal models.
Speech recognition models with general capabilities.

Two tiers

Tier 1: All GPAI models:

Obligations (Art. 53):

Technical documentation: model details, training data summary, computational resources used.
Transparency: information for downstream providers.
Copyright respect: policy for respecting copyright in training data.
Summary of training data: publicly available summary.

Tier 2: GPAI con systemic risk:

Models con high-impact capabilities (currently defined as >10^25 FLOPs in training, but threshold may evolve):

Additional obligations (Art. 55):

Model evaluation including adversarial testing.
Risk assessment y mitigation.
Cybersecurity protections.
Reporting of serious incidents to AI Office.
Energy efficiency considerations.

Implications for downstream users

If you USE a GPAI model (you're a "deployer" or build on top):

You're not the GPAI provider — they have direct obligations. But:

Provider must give you info: documentation, capabilities, limitations.
You inherit some risks: if base model has issues, your downstream system may too.
Your end-system classification: still depends on use case (high-risk, limited, etc.).

Practical implications

Para tu sistema construido sobre GPAI API:

## GPAI Dependency Documentation

### Provider
- Vendor: OpenAI
- Model: GPT-4 Turbo
- API endpoint: api.openai.com
- Contract: Enterprise agreement

### Provider's Compliance (verified)
- Technical documentation: published
- Training data summary: published
- Copyright policy: published
- Systemic risk: classified as systemic (over threshold)

### Implications for our system
- Our system inherits GPT-4's capabilities y limitations.
- Documentation references provider's docs where applicable.
- We add our own classification (high-risk medical use case).

### Contract considerations
- Enterprise SLA includes compliance commitments.
- Provider commits to no training on our data.
- Provider liability allocation per contract.

Foundation model providers compliance status (May 2026)

Provider	Tier 2 Status	Compliance Status
OpenAI (GPT-4, GPT-5)	Yes	Documentation published
Anthropic (Claude 3, 4)	Yes	Documentation published
Google (Gemini 1.5, 2)	Yes	Documentation published
Meta (Llama 3, 4)	Yes (open)	Open licensed con docs
Mistral	Variable	Documentation published

Verify status when integrating; changes regularly.

When you become GPAI provider

If you train a foundation model yourself (not just fine-tune), you're a GPAI provider.

Threshold for "GPAI": broad capabilities + multiple use cases.

Fine-tuning a foundation model typically does NOT make you GPAI provider — you're using GPAI to build downstream system.

If you ARE GPAI provider, you have full Art. 53 (and possibly Art. 55) obligations.

This applies to:

Companies training proprietary foundation models.
Open-source projects releasing capable models.
Research organizations with capable models.

Trampas comunes

1. "Minimal risk = no work needed"

Voluntary best practices reduce real risk + future-proof. Don't skip.

2. Ignoring GPAI provider compliance

If your provider is non-compliant, that's not safe for you. Your liability may be affected. Verify before integration.

3. Treating fine-tuning as becoming GPAI provider

Generally not. Fine-tuning a model = using GPAI. Making the original = providing GPAI.

But: if your fine-tuning is so substantial it creates new general-purpose capabilities, may be debatable.

4. Assuming open-source = no GPAI obligations

Open-source GPAI providers still have obligations under EU AI Act, with some specific exceptions. Check carefully if releasing models.

5. Not tracking capability thresholds

10^25 FLOPs is current threshold for systemic risk. May change. Track regulatory updates.

Auto-verificación

1. ¿Cuándo soy "GPAI provider" vs "GPAI deployer"?

GPAI Provider: you train and release a GPAI model. Examples:

OpenAI (provides GPT models).
Anthropic (provides Claude).
Meta (provides Llama).

GPAI Deployer (or Downstream user): you use someone else's GPAI in your system. Examples:

Building chatbot using OpenAI API.
Fine-tuning Llama for specific use.
Using Claude in your enterprise app.

Differences in obligations:

Aspect	Provider	Deployer
Technical docs	Required	Use provider's
Risk assessment	Required (esp. systemic risk)	Per use case
Copyright policy	Required	Inherit + your own
Training data summary	Required	N/A
Cybersecurity	Required (Tier 2)	Per system

Most engineers are deployers, not providers. Focus on use case-specific obligations + verifying provider compliance.

Edge case: substantial modifications. If you fine-tune so substantially que you create new general-purpose capabilities, may be considered provider. Currently rare.

2. ¿Por qué importa el GPAI status del provider que uso?

Razones:

Liability allocation: contracts typically address responsibility. If provider is non-compliant, exposure may shift.
Documentation reuse: provider's compliance documentation supports yours. Need it to reference.
Capabilities y limitations: provider documents what model can/cannot do. Critical for your use case classification.
Risk mitigations: if provider implements protections, they apply to your system too. Saves duplicate work.
Future updates: provider may change models/capabilities. Affects your compliance.

Practical:

Choose providers que están compliant.
Verify status before integration.
Document the dependency.
Monitor status quarterly.
Have contingency if provider becomes non-compliant.

Vendor risk extends to compliance now, not just technical.

Resumen y siguiente paso

Minimal Risk: la majority. Voluntary codes encouraged but not required legally.
GPAI: foundation models con specific obligations.
Tier 1 GPAI: all foundation models — documentation, transparency, copyright respect.
Tier 2 GPAI: systemic risk (> 10^25 FLOPs) — additional obligations.
Downstream users: not direct providers, but inherit some risk + verify provider compliance.

Puente: cápsula 07 cubre timelines y penalties — when each obligation kicks in y costo de non-compliance.

Recursos

EU AI Act Art. 53-55 — GPAI — texto.
GPAI Model Documentation Templates — templates.

Siguiente: 07-timelines-penalties.md — Compliance timelines y penalties.

Cápsula 06 de 08 — Módulo 4 — AI Ethics & Compliance Guide

← Anterior5. Limited Risk: Transparency Obligations Siguiente →7. Timelines y Penalties