Transparency & general-purpose AI
Generative AI made two questions urgent: how do people know when they're dealing with AI, and what should the makers of powerful foundation models be responsible for? Article 50 and Chapter V answer them.
Learning objectives
- Describe the four Article 50 transparency duties and who they fall on
- Explain the obligations for all general-purpose AI model providers
- Define "systemic risk" and the extra duties it brings
- Describe the role of the GPAI Code of Practice
5.1 Article 50: transparency obligations
These duties apply from 2 August 2026 and sit on top of any other tier — a high-risk system can carry them too.
| Who | Duty |
|---|---|
| Providers of AI that interacts directly with people | Design the system so people are told they are interacting with AI — unless that is obvious from the context. |
| Providers of AI generating synthetic audio, images, video or text | Mark outputs in a machine-readable format so they are detectable as AI-generated (e.g. watermarks, metadata, fingerprints), as far as technically feasible. |
| Deployers of emotion recognition or biometric categorisation | Inform the people exposed to the system (where the use is not prohibited). |
| Deployers of deepfakes and certain AI-generated text | Disclose that image, audio or video content is artificially generated or manipulated. For text published to inform the public on matters of public interest, disclose that it is AI-generated — unless it has undergone human review and someone holds editorial responsibility. |
For evidently artistic, creative, satirical or fictional works, the deepfake disclosure is lighter: it only needs to be done in a way that doesn't spoil the display or enjoyment of the work.
Under the 2026 amendments, generative AI systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking duty. New systems must comply from 2 August 2026.
An online retailer adds an AI shopping assistant to its website and uses an image generator to create lifestyle photos of a "model" wearing its trainers.
Assistant: the provider must make sure users are told they're chatting with AI (e.g. "I'm an AI assistant").
Images: the image-generator provider must embed machine-readable marks. If the images realistically depict a person who appears real, the retailer, as deployer, should disclose that they are AI-generated.
5.2 General-purpose AI models
A general-purpose AI model is one trained on large amounts of data (typically with self-supervision at scale) that displays significant generality and can competently perform a wide range of distinct tasks — and can be integrated into many downstream systems. Large language models are the classic example.
GPAI obligations have applied since 2 August 2025. Models already on the market before that date have until 2 August 2027 to comply. The Commission's power to fine GPAI providers applies from 2 August 2026.
Obligations for all GPAI model providers (Article 53)
- Technical documentation about the model, its training and testing, for the AI Office and national authorities.
- Information and documentation for downstream providers who build AI systems on the model, so they understand its capabilities and limitations and can meet their own obligations.
- A copyright policy, including respecting text-and-data-mining opt-outs expressed by rights holders.
- A publicly available, sufficiently detailed summary of the content used for training, using the AI Office's template.
Open-source models released under a free and open licence with public weights are exempt from duties 1 and 2 — but not from the copyright policy or the training summary, and not if the model has systemic risk.
GPAI models with systemic risk (Articles 51 & 55)
A model has systemic risk if it has high-impact capabilities. This is presumed when the cumulative compute used to train it exceeds 1025 floating-point operations (FLOPs). The Commission can also designate models based on other criteria. Providers must notify the Commission within two weeks of meeting the threshold.
On top of Article 53, these providers must:
- perform model evaluations, including adversarial testing (red-teaming);
- assess and mitigate possible systemic risks at EU level;
- track, document and report serious incidents to the AI Office without undue delay;
- ensure an adequate level of cybersecurity for the model and its physical infrastructure.
The GPAI Code of Practice
Published in July 2025, the General-Purpose AI Code of Practice was drafted by independent experts with input from industry, academia and civil society. It has three chapters — transparency, copyright, and safety and security (the last for systemic-risk models only). Signing is voluntary, but following it is a recognised way to demonstrate compliance with Articles 53 and 55.
Chapter V regulates the model. Once a model is built into an AI system, the system is classified in its own right. A company that builds an HR screening tool on top of a third-party LLM is the provider of a high-risk system — and relies on the documentation the model provider must supply. Following the 2026 amendments, the AI Office directly supervises AI systems built on a GPAI model by the same provider or group.
Key takeaways
- From 2 August 2026, people must be told when they interact with AI, and synthetic content must be machine-detectable and — for deepfakes — disclosed.
- All GPAI model providers need documentation, downstream information, a copyright policy and a training-content summary.
- Models above 1025 FLOPs are presumed to have systemic risk and face evaluation, risk mitigation, incident reporting and cybersecurity duties.
- The GPAI Code of Practice is a voluntary route to show compliance.