EU GPAI guidelines separated model-provider scope from the July code of practice
The European Commission published GPAI-provider guidelines on July 18, 2025, clarifying scope ahead of August obligations and distinct from the July 10 voluntary code.
Historical reporting: the Commission published guidelines on the scope of obligations for providers of general-purpose AI models on July 18, 2025. The guidelines record the Commission’s interpretation and application approach; this article does not give legal advice or determine provider status.
Key takeaways
- The July 18 guidelines were distinct from the voluntary GPAI Code of Practice published July 10.
- Provider and placing-on-the-market questions need evidence about control, branding and distribution.
- Model documentation should support downstream integration decisions, not only regulator requests.
The July 18 event was guidance about scope[source 1][source 2]
The European Commission published its guidelines on the scope of obligations for providers of general-purpose AI models on July 18, 2025. The publication said the guidance focused on obligations whose application was imminent on August 2, 2025. It addressed what counts as a general-purpose AI model, who may be a provider, placing on the market and certain exemptions. The Commission described the purpose as greater legal certainty across the value chain.
This was not the July 10 General-Purpose AI Code of Practice article. The Commission’s July 18 materials say the guidelines complement that code, while its code page describes the code as a voluntary tool prepared through a multi-stakeholder process. A historical record should preserve the difference between explanatory guidance, a voluntary compliance instrument and the underlying legal obligations.
Scope questions are records questions[source 1][source 2]
A provider-scope review starts with evidence: which entity developed or had the model developed, whose name or trademark is used, where the model is offered and how a downstream actor can obtain it. The guidelines discuss modifications and placing on the market because those facts can change the analysis. A generic statement that a model is open, hosted, adapted or available through an API does not settle every role question.
Keep a versioned release record with model identifier, entity names, licence or terms reference, distribution channel, intended use, access location and modification history. Include a named owner for disputed facts. That record helps an organisation ask better questions of counsel or regulators without claiming that a spreadsheet determines the Act’s application.
Analysis: turn model documentation into an integration brief[source 1][source 2]
The Commission described documentation and information for downstream AI-system providers as core GPAI-provider obligations. In engineering terms, a useful handoff answers more than model size and benchmark scores. It states supported inputs and outputs, known limits, evaluation conditions, safety-relevant behaviour, integration requirements, version changes and an incident contact. Downstream teams need those facts to design their own controls and tests.
Separate supplied claims from locally observed behaviour. A vendor model card can establish what a provider says it tested; it cannot prove the result in another prompt, language, tool environment or data setting. Run fixed fixtures before a model change, include expected refusals and failures, then retain outcomes with the exact model and configuration. This is independent editorial analysis.
Analysis: do not convert guidance into a status claim[source 1][source 2]
The July guidance offers a dated account of the Commission’s view and of the then-upcoming August application point. It does not establish an organisation’s current legal position, the legal effect of signing a code, a national authority’s enforcement choice or the facts of a later model release. Those need current primary material and professional advice when a legal answer is required.
A resilient programme records role assumptions, evidence sources, decisions and review triggers. Reopen the file when distribution, branding, model capability, training information or EU-market route changes. That turns a 2025 publication into a controlled operating input rather than a one-time compliance slogan.
Sources
Continue reading
Related reading
News analysisThe AI Act’s first February 2025 rules made inventory and literacy operational work3 min read
News analysisUK’s third-party AI assurance roadmap mapped professionalization, information access and a planned innovation fund3 min read
News analysisUK’s AI Playbook expanded government guidance to ten principles across selection, deployment and assurance3 min read