The AI Act (Regulation (EU) 2024/1689) is the world’s first comprehensive legal framework on artificial intelligence.  

The Act introduces risk-based rules for various stakeholders in the AI value chain from providers to deployers, importers and distributors. Most importantly, the AI Act also differentiates between two different types of providers depending on their product, which can be: 

• An AI system
• A general-purpose AI model 

The general-purpose AI (GPAI) model is the infrastructure layer or, in AI terms, the foundational model. A model does not have an interface or an application and therefore needs an AI system to be made available on the market. A GPAI model may be embedded in a customer service chatbot, legal assistant, or creative writing tool. 

AI systems are application, nowadays often referred to as agents. They may build on a GPAI model but not necessarily.  

The AI Act treats GPAI models and AI Systems differently and has separate sections with diverging obligations for each of them, as well as different implementation timelines. While the rules for GPAI models take effect August 2, 2025, providers for AI systems have an additional year to prepare until they need to comply with the AI Act by August 2, 2026.  

For both, AI systems and GPAI models the AI Act provides for a staggered approach with tighter rules for high-risk AI systems and GPAI models with systemic risk.  

Like other regulation on the digital economy also the AI Act has extra-territorial scope and applies to companies outside of the EU. However, the extraterritorial scope of the AI Act is not limited to targeting or monitoring, but all companies fall under the regulation if the output produced by the AI system is used in the EU.  

Providers of AI systems and GPAI models are both required to appoint an Authorised Representative in the EU, if they have no establishment in the Union. The role and the obligations of this Authorised Representative are different depending on the classification of the client as system or model.