General-Purpose AI Models Under the AI Act: What Employers Using Chatbots Should Know

If your business uses a chatbot built on a large AI model, you may wonder whether the AI Act's rules for general-purpose AI models apply to you. In short, the Commission's pages place those obligations on the providers of the models, not on every organisation that uses a chatbot. This guide explains the general-purpose AI models obligations as the European Commission describes them, and then sets out, labelled as our reading, what that tends to mean for a Dublin employer who is a user of the tools. For the wider timetable, see our guide to the EU AI Act key dates for employers in Ireland.

What is a general-purpose AI model?

According to the Commission's Q&A page on general-purpose AI models in the AI Act (last updated 9 September 2025), the Act defines a general-purpose AI model as one that "displays significant generality and is capable of competently performing a wide range of distinct tasks". Large generative models are a typical example. The page also gives the Commission's indicative test: training compute above 10^23 FLOP, together with the ability to generate language, text-to-image or text-to-video.

The Commission's fact page on general-purpose AI obligations (last updated 1 August 2025) describes these models as "the foundation for many different AI systems". A chatbot is an AI system. The model underneath it is the general-purpose AI model. That distinction matters because the rules treat the two layers differently.

Who the obligations sit with

The Q&A page says providers placing general-purpose AI models on the EU market must comply, whether they are established in the Union or in a third country. A provider is anyone who develops a model, or has one developed, and places it on the market, for payment or free.

All providers of these models must, according to the fact page:

• draw up technical documentation;
• put a copyright policy in place; and
• publish a summary of the model's training content.

Providers of the most advanced models, which the Commission calls general-purpose AI models with systemic risk, have more to do. The fact page lists notifying the Commission, assessing and mitigating risk, reporting incidents and maintaining cybersecurity protections. It says a model is presumed to pose systemic risk if trained with more than 10^25 FLOP, and that this threshold "is currently under review". The Q&A page adds that the Commission can update the threshold and designate other models using criteria such as capabilities, number of users and scalability.

What about companies that build on a model?

This is the part most employers want to know. The Commission's pages say:

• Downstream entities that fine-tune or modify a model may become its providers. The Commission's indicative test is whether the modification used more than a third of the original model's training compute, and the obligations for such modifications are generally limited to the change itself.
• The Commission's guidelines page (last updated 28 April 2026) says only those making "significant modifications" must comply with the provider obligations; minor changes do not trigger them.
• Whether or not you count as a model provider, if you build an AI system on a general-purpose model, you must meet the AI Act's requirements for AI systems where they apply.
• Model providers must cooperate with downstream system providers so that those providers can meet their own duties.

The Q&A page also says that integrating a model into the provider's own AI system that is made available or put into service counts as placing the model on the market, with exceptions (it refers to Recital 97) for models used only for internal processes that are not essential to providing products or services to third parties, where the rights of natural persons are not affected and the model is not a general-purpose AI model with systemic risk. We have not read the full legal text of the exceptions, so we do not go beyond what that page says.

What this means for an employer using a chatbot: our reading

The following is our reading of the Commission pages, not legal advice and not a statement of the law.

• Our reading: an organisation that simply uses a chatbot or assistant supplied by someone else is a user of an AI system, not the provider of the underlying model. The model-level duties in the pages above sit with the model provider.
• Our reading: an organisation that fine-tunes a model, or builds its own system on top of one, should check whether it is a provider of a system, or of a modified model, rather than assuming it is only a user.
• Our reading: other AI Act rules can still apply to users, because they attach to the use of AI systems rather than to the model. Examples covered elsewhere on our site include transparency and labelling obligations under Article 50.

The Commission's page on the Code of Practice (last updated 7 October 2026) lists the providers that have signed it. We suggest asking your suppliers directly whether they are covered, rather than assuming.

The Code of Practice and the guidelines

The General-Purpose AI Code of Practice was published on 10 July 2025. The Commission page describes it as a voluntary tool prepared by independent experts, with three chapters: Transparency and Copyright (open to all providers) and Safety and Security (for providers of models with systemic risk). The Commission and the AI Board have confirmed it is an adequate way to demonstrate compliance. The Q&A page adds that adherence does not create a presumption of conformity, and that providers who do not sign must show their alternative measures are adequate.

The Commission's guidelines, published to help providers work out whether the obligations apply to them, are described as "not legally binding" but reflecting the Commission's interpretation, and they "will guide enforcement".

Dates and enforcement

The Commission pages we opened give these dates, and the pages carry different update dates, so check the current position before relying on them:

• Provider obligations for general-purpose AI models apply from 2 August 2025 (Q&A and guidelines pages).
• The Commission's enforcement powers, including fines, take effect on 2 August 2026 (guidelines page; the enforcement page, updated 24 August 2026, says enforcement powers apply from that date).
• Providers of models placed on the market before 2 August 2025 must comply by 2 August 2027 (guidelines page).

The enforcement page (24 August 2026) says the AI Office enforces the rules for general-purpose AI model providers, with investigative and sanctioning powers, and that breaches of those obligations may bring fines of up to EUR 15 million or 3% of total worldwide annual turnover, whichever is higher. The fines on that page are for breaches of the general-purpose AI model obligations. For the wider penalty picture, see our guide to AI Act penalties and enforcement for employers in Ireland. The Commission has said the compute threshold for systemic risk is under review, and the dates on the Commission's pages differ in places, so confirm the current position on the Commission's website.

Practical steps for a Dublin employer

These are our suggestions:

• A practical approach: list the AI tools staff use and identify, for each, who the provider is and whether you only use the tool or configure or build on it.
• A practical approach: ask suppliers whether they follow the Code of Practice and how they support customers with documentation. The Q&A page says model providers must share technical documentation with downstream providers.
• A practical approach: keep a record of that supplier information alongside your data protection records.
• A practical approach: revisit the list when you add a tool, change how it is used, or when the Commission updates its guidance.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Do the general-purpose AI model rules apply to my business if we use a chatbot?

The Commission pages say the obligations apply to providers of the models. Our reading is that a business that only uses a chatbot is not the model provider, but a business that fine-tunes a model or builds its own system on one should check its position.

What must providers of these models do?

According to the Commission, all providers must prepare technical documentation, have a copyright policy and publish a summary of training content. Providers of models with systemic risk have further duties, including risk assessment and incident reporting.

Is the Code of Practice mandatory?

No. The Commission describes it as voluntary. Providers who do not sign must show that their alternative measures are adequate.

Who can be fined under these rules?

The enforcement page refers to fines for breaches of general-purpose AI obligations, which, in our reading, attach to providers of those models. Check the page and our penalties guide for the full picture.

Where can I check the current dates?

On the European Commission's digital strategy pages. AI Act application dates have been subject to change, so always check the current position.

Knowing which layer of an AI tool you are responsible for is the first step to knowing which rules matter to you.