EU AI Act · Article 53 · GPAI
If your company builds, fine-tunes, or places a general-purpose AI model on the market, you are a GPAI provider under the EU AI Act — and Article 53 sets your duties. These have been in force since 2 August 2025. Here is each one, and what it takes to actually satisfy it.
Scope
The Act splits obligations by role. A provider is the entity that develops a model and places it on the market under its name — or that substantially modifies or fine-tunes it. A deployer is the entity that uses an AI system under its authority. Most companies that use models via API or fine-tune modestly are deployers of the downstream system; the heavy GPAI provider duties fall on the model maker. But if you fine-tune, rebrand, or distribute a model, the provider duties can land on you.
Not sure which role you occupy? That classification is itself step one of the compliance work — and it drives everything that follows.
The duties
Maintain technical documentation of the model, per Annex XI, and keep it up to date.
What it actually takes: The documentation must be available to the AI Office and national authorities on request. "We can generate it if asked" is not sufficient — it must be maintained.
Provide downstream providers with the information they need to understand the model and comply with their own obligations.
What it actually takes: If you fine-tune or build on a third-party model, you are the downstream provider and the upstream must give you this. Document what you received.
Put in place a policy to comply with EU copyright law, including honouring text-and-data-mining opt-outs under Article 4(3) of the DSM Directive.
What it actually takes: This is a copyright and training-data provenance obligation. It is one of the first things an authority looks for, and the one most providers are least ready for.
Publish a sufficiently detailed summary of the training data, using the AI Office template.
What it actually takes: A public, template-formatted summary of the training corpus. "We trained on X" in a blog post does not count.
The documentation and downstream-information duties in Article 53 are, at their core, a provenance and audit problem: you must be able to show what the model did, on what, and under which controls. TramAI is built for exactly that — structured execution logging, model versioning, provider routing, and an approval chain that produces the evidence automatically. It does not replace the legal documentation you owe the AI Office, but it removes the manual reconstruction that makes those four duties so expensive.
FAQ
A provider is the entity that develops a general-purpose AI model and places it on the market under its name, or that substantially modifies or fine-tunes it. Most companies that use models via API, or fine-tune modestly, are deployers of the downstream system — the heavy Article 53 duties fall on the model maker. But if you fine-tune, rebrand, or distribute a model, the provider duties can land on you.
Maintain Annex XI technical documentation and keep it current (53(1)(a)); give downstream providers the information they need to comply (53(1)(b)); put in place a policy to comply with EU copyright law, honouring text-and-data-mining opt-outs (53(1)(c)); and publish a sufficiently detailed training-data summary using the AI Office template (53(1)(d)).
They have been in force since 2 August 2025 — ahead of the high-risk timeline, and unaffected by the Digital Omnibus deferral of the high-risk system duties.
No. Article 53 is a provenance-and-audit problem, and TramAI removes the manual reconstruction — structured execution logging, model versioning, provider routing, and an approval chain that produce the evidence automatically. But it does not replace the legal documentation you owe the AI Office; it makes maintaining that evidence far cheaper.