How General-Purpose AI Systems Are Classified Downstream

A general-purpose AI model and a general-purpose AI system built on top of it are two different regulatory objects, governed by two different parts of the EU AI Act. Confusing them is the single most common GPAI mistake. The short answer: the model sits in Chapter V; the system is classified by its use, exactly like any other AI system — minimal, Article 50 limited-risk, or Annex III high-risk. There is no separate "GPAI high-risk" tier for the system you ship.

Under Regulation (EU) 2024/1689, the obligations that bind the model provider (the lab) stay upstream; the obligations that bind you, the downstream integrator, follow from what your system actually does.

Model versus system: the line that decides everything

• A general-purpose AI model (Article 3(63)) is the trained model itself — capable across many tasks, designed to be integrated into downstream systems. Its provider owes the Chapter V duties (Articles 51–55): technical documentation, downstream information, a copyright policy, and a training-data summary under Article 53, plus the systemic-risk duties (Article 55) if it crosses the Article 51 threshold.
• A general-purpose AI system (Article 3(66)) is a system based on a GPAI model that can serve a variety of purposes. When you build a product on a foundation model's API, you are putting a GPAI system into use — and that system is classified like any AI system: by its intended purpose under Articles 5 and 6.

The model provider's Article 53 duties do not transfer to you, and your system's classification does not reach back up to re-classify the model. Two objects, two regimes.

---

Classify the system you ship by its use

Run your GPAI system through the same sequence as any other system:

A customer-support assistant built on a foundation model is limited-risk — an Article 50(1) disclosure that the user is talking to AI. A marketing-copy generator is typically minimal. The same model wired into a CV-ranking feature is high-risk by use (Annex III point 4), because the use is in Annex III — not because the model is general-purpose. Classification is by use, every time.

When a GPAI system "may be used as" a high-risk system

Some GPAI systems can be used directly as a high-risk system, or be integrated as a high-risk component, without modification. The Act treats this seriously: where a general-purpose AI system can be used as a high-risk system or as one of its components, the obligations for high-risk systems attach to that use. The practical test is your intended purpose statement and your instructions for use. If you market or instruct the system for an Annex III use — or you know it will be used that way — you cannot shelter behind "it's just general-purpose." Scope and document the intended purpose honestly, because that statement is what classification runs on.

Article 25 duties for downstream integrators

Building on a GPAI model usually makes you the provider (Article 16) of the system you place on the market under your own name — and Article 25 governs the value chain. If your system is high-risk, you owe the full stack for it; the model provider must give you, under Article 53(1) and Annex XII, the information and documentation you need to meet your own obligations. If you only use a third party's GPAI system as supplied, you are a deployer (Article 26) with the lighter duties. And the Article 25(1)(b)/(c) flip still applies: substantially modify a high-risk system, or repurpose a system into a high-risk use, and you become its provider. When that happens, Article 25(2) — rewritten by the Digital Omnibus — obliges the original provider to cooperate: hand over its technical documentation, known limitations and failure modes, and targeted technical access for testing, unless it clearly specified that the system was not to be changed into a high-risk system.

A breach of these provider or deployer duties sits in the €15,000,000 or 3% of worldwide annual turnover tier (Article 99(4)); for SMEs and start-ups the fine is the lower of the two (Article 99(6)). GPAI model-provider fines are a separate regime (Article 101, imposed by the Commission) — not your exposure as an integrator.

Worked example: Tindra AB, ~32 employees, ~€5.1M turnover

Tindra, a Stockholm SaaS firm, builds two features on a foundation-model API. (1) An in-app writing assistant for its own users: not prohibited, not Annex III → limited-risk, owes an Article 50(1) AI-interaction disclosure; Tindra ships it under its own name, so it is the provider of that system. (2) A "candidate fit score" it sells to recruiters: the intended purpose is Annex III point 4 employment, it profiles natural persons, no Article 6(3) escape → high-risk; Tindra is its provider and owes the full Article 16 stack. The model lab keeps its own Article 53 duties throughout; nothing about Tindra's classification changes the model's. Tindra documents both intended purposes, ships feature 1, and stages feature 2 against the high-risk timeline.

How Confir helps

Confir classifies the GPAI system you build — by its intended purpose — and keeps the model layer where it belongs: it runs the Article 5, Article 6, Article 6(3) and Article 50 logic on your use, derives your Article 16 or Article 26 role with the Article 25 flip, and records that the upstream Article 53 model duties are the lab's, not yours. The engine is deterministic and rule-based, so the same intended purpose always returns the same tier and obligation list, with the rule that fired shown in plain English.

Related guides

• How AI risk classification works
• How to classify your AI system
• GPAI and risk classification
• Classifying LLM-based systems
• Provider vs deployer
• General-purpose AI model (definition)
• General-purpose AI system (definition)