If a company deploys a solution based on a GPAI model, the first step is not choosing prompts but determining whether it uses the model as a *deployer* or becomes the model provider itself. According to materials on the AI Act, the full obligations in Chapter V apply to the entity that develops and places the GPAI model on the market, not to every company that uses a ready-made API in its business process.
In practice this distinction decides whether the company has mainly deployment and organizational duties or also documentation, copyright and reporting obligations. According to regulation-ai.eu, GPAI obligations will apply in the EU from 2 August 2025, so the question of the company's role must be asked before signing a supplier contract.
Under the documentation describing Article 53 of the AI Act, a GPAI provider must prepare technical documentation, describe the training methodology, evaluation results, energy consumption and data sources. The same set of sources also indicates an obligation to provide downstream providers with information about the model's capabilities and limitations so they can integrate it safely.
The second pillar is copyright. According to regulation-ai.eu and legal services, the provider must have a copyright compliance policy and publish a public summary of the content used to train the model, detailed enough for rights holders to exercise their rights. If the model is considered systemically risky, standardized evaluations, robustness tests, assessment and mitigation of systemic risks, reporting of serious incidents and appropriate cybersecurity measures are also required.
A deploying company does not automatically have the provider's obligations, but it must verify whether the contract and documentation provide sufficient information about the model, its limitations and terms of use. According to legal and technical sources, this means checking whether the provider supplies the data necessary for safe integration and whether the company has usage policies consistent with the producer's instructions.
In operational terms a deploying company should prepare three items:
According to AI Act materials, integrating an API alone usually does not make a company a GPAI provider. An exception occurs when a company truly modifies the model in a way that may shift it into the provider role, for example via very deep fine-tuning described in one analysis as exceeding one third of the original model's training compute.
For a deploying company the key questions are therefore not only “does the model work” but also “who is responsible for documentation, licenses, incidents and updates”. The answer determines which obligations to include in contracts, security policies and procurement procedures.
Lub System helps B2B companies implement AI, automation and IT solutions end-to-end - from strategy to deployment. See our services or get in touch to discuss your case.