• GPAI model-provider obligations have been binding since 2 August 2025; the transparency and deployer duties your team owns turn binding on 2 August 2026 (s1).
• If you only call a model through an API you're a deployer — mostly transparency and record-keeping; fine-tuning or substantial modification can flip you into a regulated provider.
• The four core provider duties (technical documentation, downstream information, a training-data summary, and a copyright policy) are collected from your vendor, not authored by you, so vendor docs become a compliance dependency.
• Systemic-risk models — the Act presumes systemic risk above roughly 10^25 FLOPs — add adversarial testing, risk mitigation, and incident reporting.
• The AI-literacy duty has applied since 2 February 2025 — the cheapest obligation to be caught short on.

Verdict: binding now upstream, binding in weeks for your layer

The general-purpose-AI model rules are already live. The obligations on GPAI model providers became applicable on 2 August 2025, and the AI-literacy duty on anyone deploying AI has applied since 2 February 2025, per the European Commission's framework (s1). If you build on top of a foundation model, most of the model-layer weight sits on your provider, not you. The piece you own — transparency disclosure, plus the full deployer regime if your product is high-risk — turns binding on 2 August 2026 (s1). That is weeks out. Skip the wait. Run the classification audit now and treat 2 August as a hard date, not a soft one.

Deployer or accidental provider? Know the line

This is the line that decides your exposure, and most teams misjudge it. Call the model through an API and prompt it — you are a deployer, and your job is mostly transparency and record-keeping. Fine-tune it, or otherwise modify it substantially, and the Act's logic can flip you into a provider of a general-purpose model, inheriting the documentation and copyright duties the regulation puts on model makers (s1, s2). Retrieval, system prompts, and orchestration generally stay on the deployer side of the line. Changing the weights is what pulls you across it. Decide which side you are on before you scale, because the answer sets your paperwork for years.

What a provider owes — and what leaks onto you

The Commission states the provider duties plainly: maintain technical documentation, give downstream integrators the information they need to build safely, publish a sufficiently detailed summary of the content used for training, and run a copyright policy that respects EU text-and-data-mining opt-outs (s1). Systemic-risk models — the Act presumes systemic risk above a compute threshold near 10^25 floating-point operations — add adversarial testing, risk mitigation, and incident reporting (s1, s2). You do not author these documents; you collect them from your vendor, which makes their paperwork a dependency you can be audited on. Honest caveat: the far end of the calendar is soft. The framework now dates some high-risk categories to December 2027 and August 2028 (s1), and technical standards and codes of practice are still landing — so do not over-build for rules that are not final. The GPAI and transparency layer is fixed. Ship against that.