EU AI Act Article 53: GPAI provider transparency obligations
Article 53 of the EU AI Act creates transparency and documentation obligations for providers of general-purpose AI (GPAI) models. The obligations apply directly to model developers (OpenAI, Anthropic, Google, Meta, Mistral, Aleph Alpha) and indirectly to downstream actors who inherit Provider status under Article 25. Article 53 took effect on 2 August 2025 for the original GPAI providers.
Four Article 53 obligations
Article 53(1) requires GPAI providers to: (a) draw up and keep technical documentation for the model, including training and testing process; (b) provide information for downstream providers integrating the model; (c) put in place a policy to comply with EU copyright law; (d) draw up and make publicly available a sufficiently detailed summary of the content used for training the model. Each obligation has specific scope requirements.
Training-data summary requirement
Article 53(1)(d) requires a sufficiently detailed summary of training data. The expected format is the Training Data Summary Template published by the European AI Office. Required elements: categories of data sources (public web, licensed data, user-generated content), language coverage, content domain coverage, and any specific datasets used. The summary is publicly available, meaning competitors can read it. For commercial reasons, balance specificity with confidentiality.
Copyright policy requirement
Article 53(1)(c) requires a policy demonstrating compliance with EU copyright law, particularly the text-and-data-mining exception in Article 4 of Directive 2019/790. The policy must address: how training data is sourced legally, how rights holders' opt-outs are respected (the rightholders' reservation system), and how the provider handles copyright claims. Public-facing copyright policies are now standard for major GPAI providers.
Article 25 inheritance
If you inherit Provider status under Article 25(4) by substantially modifying a GPAI model, Article 53 obligations attach to you. The threshold of substantial modification is unsettled (the GPAI Code of Practice consultation closed without clean resolution in March 2026). Conservative approach: assume inheritance if you fine-tune beyond LoRA-level adjustments, and prepare a training-data summary covering your fine-tuning data plus reference to the upstream model's summary.
Practical compliance for SaaS
If you fine-tune a foundation model, prepare: (1) technical documentation of your fine-tuning process, including hyperparameters, data, and validation; (2) downstream-provider information for any customer who integrates your fine-tuned model; (3) a copyright policy explaining how your training data complies with EU rules; (4) a training-data summary covering your fine-tuning data, referencing the upstream model's summary for base data. The European AI Office is publishing templates in 2026 to help with implementation.
Frequently asked questions
When did Article 53 take effect?
2 August 2025 for original GPAI model providers. Inheritance via Article 25(4) follows the same timeline for downstream actors who become Providers.
Do I inherit Article 53 by using GPT-4?
Not by using - only if you substantially modify. API consumption with prompt engineering does not inherit Article 53 obligations.
Does LoRA fine-tuning trigger Article 53 inheritance?
Unsettled. Conservative interpretation: probably not. Defensive approach: document the LoRA adapter precisely, keep training-data records, prepare a partial summary for safety.
What is the penalty for Article 53 failures?
Up to €15M or 3% of global turnover for GPAI Provider obligation failures.
Is the training-data summary really public?
Yes - 'sufficiently detailed summary of content used for training' must be made publicly available. The European AI Office template format clarifies what 'sufficiently detailed' means.
Sources
Last updated: 2026-05-28