From 2 August 2026, any organisation that places a general-purpose AI model on the EU market must comply with Article 53 of the AI Act — maintaining technical documentation, a copyright compliance policy, and information-sharing arrangements with downstream providers. For cloud teams running model workloads on managed infrastructure, the first step is classification: whether you are a provider or a deployer determines the entire obligation set now enforceable under Regulation (EU) 2024/1689.
Provider or Deployer: Decide First
The AI Act draws a hard boundary between GPAI model providers and deployers. A provider places a model on the market under its own name or trademark — for instance, a team that fine-tunes Llama or Mistral and exposes it through a branded API endpoint, or an organisation that repackages a base model for a vertical market. A deployer uses an AI system under its own authority; most SaaS developers calling GPT-4o, Claude, or Gemini through managed cloud endpoints fall into the deployer category, not the provider category.
Misclassification carries direct risk. A deployer who assumes their vendor’s compliance covers everything misses the transparency duties in Article 50 — chatbot disclosure, synthetic-content labelling, and emotional-recognition disclosure — which apply to all deployers. A provider who believes they are merely a consumer skips the model documentation and copyright obligations under Article 53, exposing the organisation to administrative fines under Article 101.
What Article 53 Demands
Article 53 of Regulation (EU) 2024/1689 imposes baseline obligations on every general-purpose AI model provider. The provider must draw up and keep up to date technical documentation of the model, including training-data summaries, the computational resources used, and the model’s known capabilities and limitations. This documentation must be sufficient for downstream providers and the AI Office to understand the model’s behaviour. Second, the provider must establish a policy to comply with EU copyright law — particularly the text-and-data-mining opt-out regime — and publish a sufficiently detailed summary of training-data content so rights holders can exercise their rights.
Beyond documentation and copyright, providers must share information with entities that integrate the model into downstream systems, enabling those parties to demonstrate compliance with their own obligations. Providers of general-purpose AI models may rely on an approved code of practice under Article 56 to demonstrate compliance with the obligations set out in paragraph 1 of this Article, until a harmonised standard is published. Compliance with a European harmonised standard grants the presumption of conformity to the extent that those standards cover those obligations.
The Open-Source Carve-Out
Paragraph 2 of Article 53 exempts providers of AI models released under a free and open-source licence from the technical-documentation and copyright obligations — but only when all parameters, including the weights, the information on the model architecture, and the information on model usage, are made publicly available. Teams that self-host open-weight models purely for internal use without redistributing them may not even qualify as providers, but those who fine-tune and re-release need to check their licence terms carefully before relying on this exemption.
This exception shall not apply to general-purpose AI models with systemic risks. Models that cross the 10^25 FLOPs training threshold, or are otherwise designated systemic-risk GPAI by the Commission under Article 51, face additional Article 55 obligations: adversarial testing, model evaluations, serious-incident reporting, and cybersecurity protections. Self-hosted inference workloads running such models cannot rely on the open-source exemption regardless of licence.
A Cloud Compliance Checklist
For cloud-hosted workloads, the practical workflow after the August 2026 applicability date is ordered as follows:
- Classify every model endpoint in your stack as provider, deployer, or downstream distributor.
- For each provider-classified model, assemble the Article 53 documentation set: model card, training-data summary, and copyright policy with opt-out compliance evidence.
- Implement Article 50 transparency controls: disclose when users interact with a chatbot, and apply machine-readable labels to AI-generated content.
- For systemic-risk models above the FLOPs threshold, add Article 55 evaluations, adversarial-testing procedures, and incident-reporting channels.
- Confirm your cloud region’s data-residency boundary matches your compliance scope, and verify that logging and telemetry inherit the same boundary.
Teams running multiple model endpoints across managed services should treat classification as an inventory problem first. Until every API call, fine-tuned checkpoint, and self-hosted container is mapped, the compliance surface cannot be assessed accurately. The classification step is not a one-time exercise — every new model integration, vendor change, or fine-tuning run reopens it, and documentation must track each iteration. Providers that depend on a code of practice rather than a harmonised standard should monitor updates from the AI Office, since the code can be withdrawn once a standard is available.
| Obligation | Provider | Deployer | Article |
|---|---|---|---|
| Technical documentation | Required | Not required | Art. 53(1)(a) |
| Copyright policy | Required | Not required | Art. 53(1)(b) |
| Downstream information sharing | Required | Not required | Art. 53(1)(c) |
| Chatbot disclosure | Not required | Required | Art. 50(a) |
| Prohibited-practice screening | Required | Required | Art. 5 |