AI Act and fine-tuning: when modifying an open model makes you a GPAI model provider

When fine-tuning makes your company a GPAI model provider

Fine-tuning an open-weight model on your own server does not, in the normal case, make your company the provider of a general-purpose AI (GPAI) model under the EU AI Act. The European Commission's guidelines for GPAI providers treat a downstream modifier as the provider of a new model only when the modification uses more than one third of the compute that trained the original model, and even then the obligations cover only the modification. A LoRA or full fine-tune on millions or a few billion tokens stays far below that line; continued pretraining on trillions of tokens can reach it.

This article sets out what the AI Act text and the Commission's own pages say about modified models, and how to estimate the compute of a fine-tuning run so that your legal counsel has a number to work with. It does not cover the duties of companies that use an AI system, which our guide to AI Act deployer obligations for internal LLMs sets out, or the licence of the base model, which our comparison of open LLM licences for company use covers. Sources were read on 24 October 2026: Regulation (EU) 2024/1689 as shown on the Commission's AI Act Service Desk, which marks the changes made by the Digital Omnibus on AI, Regulation (EU) 2026/1744; the Commission's policy page on the guidelines (last updated 28 April 2026); and its Q&A on them (last updated 11 November 2025). The guidelines, published on 18 July 2025, are not legally binding; the Commission's page says they reflect its interpretation and will guide its enforcement.

Who counts as the provider of a general-purpose AI model

Article 3(3) defines a provider as a person or body "that develops an AI system or a general-purpose AI model" or has one developed, and places it on the market under its own name or trademark, whether for payment or free of charge. Placing on the market is "the first making available" of an AI system or a GPAI model on the Union market (Article 3(9)). For AI systems the definition also covers putting into service, including supply "for own use in the Union"; for models it speaks only of placing on the market.

A general-purpose AI model is one that "displays significant generality and is capable of competently performing a wide range of distinct tasks" and can be integrated into a variety of downstream systems (Article 3(63)). The same definition excludes models "used for research, development or prototyping activities before they are placed on the market". The Commission's Q&A gives the indicative criterion: training compute that exceeds 10²³ FLOP, together with the ability to generate language (text or audio), text-to-image or text-to-video. It adds that this compute "corresponds to what is typically used to train models with one billion parameters on large datasets", and that the criterion is not absolute in either direction.

Article 51(2) presumes high-impact capabilities, and with them systemic risk, when the cumulative training compute is greater than 10²⁵ FLOP. The Commission can also designate a model on its own initiative or after an alert from the scientific panel. The open models most companies fine-tune on a GPU server are GPAI models by these criteria, and their developers are the providers. The question for your company is whether your changes make you the provider of a new one.

The one-third criterion for downstream modifiers

The guidelines answer this with a compute criterion. In the words of the Commission's Q&A, a downstream modifier becomes a provider only in exceptional cases, when the modification or fine-tuning "uses more than one-third of the original model's training compute". The Q&A concludes that most fine-tuning, adaptation and minor modification falls outside the provider obligations, and the policy page puts it the same way: "only those making significant modifications to AI models need to comply."

Where the line is crossed, the obligations do not extend to the whole model. The Q&A says the Commission limits them to documenting "the modification itself", meaning the changes made and the new training data used. That follows recital 109 of the AI Act: "In the case of a modification or fine-tuning of a model, the obligations for providers of general-purpose AI models should be limited to that modification or fine-tuning", for example by complementing the existing technical documentation with information on the modifications, "including new training data sources".

Two cases need the guidelines themselves. The first is a base model whose developer has not published its training compute or the data behind it, so that the denominator of the one-third test is unknown. The second is a modification of a model with systemic risk, or one that brings a model into that class. The Commission's Q&A does not set out either case, so read the guidelines document with your legal counsel before you rely on an estimate for such a model.

Estimating the compute of a fine-tuning run

A widely used approximation for training a dense transformer is about 6 floating-point operations per parameter and training token: the scaling-laws paper from OpenAI and Johns Hopkins University (arXiv 2001.08361, January 2020) defines the training compute as "C ≈ 6N floating point operators per training token", where the factor 6 covers the forward and the backward pass. For a base model, N is the parameter count and the tokens are the pretraining tokens its card states. For a fine-tune, the tokens are the tokens processed in training, that is the dataset size times the number of epochs.

Take Llama 3.3 70B. Hugging Face lists 70.55 billion parameters, and Meta's model card says the model "was pretrained on ~15 trillion tokens". By our estimate that is 6 × 70.55 × 10⁹ × 15 × 10¹² ≈ 6.3 × 10²⁴ FLOP, below the systemic-risk presumption, and one third of it is about 2.1 × 10²⁴ FLOP.

Our arithmetic with C ≈ 6 × N × tokens (arXiv 2001.08361), N = 70.55 billion (Hugging Face) and about 15 trillion pretraining tokens (Llama 3.3 70B model card), read on 24 October 2026. The base figure leaves out post-training, which the card describes separately. For LoRA the full 6 FLOP per parameter and token overstate the compute, as no weight gradients are computed for the frozen weights.

Hardware puts these numbers in proportion. NVIDIA lists the H200 NVL at 1,671 BF16 Tensor TFLOPS "with sparsity", 835.5 dense. On a server with eight H200 NVL at an assumed 40 per cent of that dense peak, about 2.7 × 10¹⁵ FLOP per second, the 100-million-token run takes about four and a half hours. The one-third line for Llama 3.3 70B would take about 25 years on the same server, and even 10²³ FLOP, the indicative criterion for a GPAI model, more than a year. Both are our estimates; the 40 per cent utilisation is an assumption for the illustration, not a measured figure.

The arithmetic is short, but it depends on two inputs your team has to document: the base model's published training data or compute, and the number of tokens processed in your run. We supply fine-tuning servers from four RTX PRO 6000 Server Edition cards to eight H200 NVL with NVLink bridges; send us the base model, the method and the dataset size, and our team replies with a configuration.

Internal use, research and placing on the market

Recital 97 addresses models that a company uses itself. When a model provider integrates its own model into its own AI system that is made available on the market or put into service, the model "should be considered to be placed on the market". The recital continues that the obligations for models "should in any case not apply when an own model is used for purely internal processes that are not essential for providing a product or a service to third parties and the rights of natural persons are not affected."

The Commission's Q&A reads placing on the market broadly: it covers availability through APIs, downloads, cloud services and integration into applications, and also models used for internal processes that are essential for providing a product or service to third parties or that affect the rights of natural persons in the Union. An internal assistant that drafts documents for staff and a fine-tuned model that scores customer claims are therefore different cases, even on the same server.

The research exception in Article 3(63) is narrower than it may sound. It excludes models used for research, development or prototyping "before they are placed on the market". Experiments on a training server are covered by it; the model that leaves the lab, as a download, an API or part of a product, is placed on the market from then on.

Even where your company is not a model provider, it can be the provider or deployer of an AI system built on the model, with duties under Article 50 or, for Annex III uses, the high-risk rules. A company that changes the purpose of a general-purpose AI system so that it becomes high-risk is considered the provider of a high-risk AI system under Article 25(1)(c). Our deployer guide covers these roles.

What a provider of a modified model has to do

If the compute criterion is met, Article 53(1) sets four obligations for a GPAI model provider, which the guidelines limit to the modification:

1. Technical documentation of the model, including its training and testing process and evaluation results, with the minimum content of Annex XI, for the AI Office and national authorities on request (point a).
2. Information for downstream providers that integrate the model into their AI systems, with at least the elements of Annex XII (point b).
3. A copyright policy to comply with Union law on copyright and related rights, including the identification of rights reservations under Article 4(3) of Directive (EU) 2019/790 (point c).
4. A public summary of the training content, following the AI Office's template (point d); the Commission's policy page links an explanatory notice and the template.

Article 53(2) exempts models released under a free and open-source licence that allows access, use, modification and distribution, with the weights, architecture and usage information made public, from points (a) and (b). The Q&A adds that the licence must allow these "without monetisation". The exemption does not cover the copyright policy or the training summary, and it does not apply to models with systemic risk. Article 54(6) exempts the same open-source providers from appointing a representative in the Union by written mandate, which Article 54(1) requires of providers established outside the EU.

For a company that publishes a heavily modified model on Hugging Face under Apache 2.0, this means the copyright policy and the training summary remain, for the new training data. Article 53(4) lets providers show compliance through a code of practice under Article 56 until a harmonised standard is published; the Commission's page links the General-Purpose AI Code of Practice.

AI Act dates for general-purpose AI models

Regulation (EU) 2024/1689 on the Commission's AI Act Service Desk, which marks Articles 53, 101, 111(3) and 113(b) with no change by Regulation (EU) 2026/1744; Commission policy page on the GPAI guidelines (28 April 2026) and Q&A (11 November 2025), read on 24 October 2026.

Article 113(b) applies Chapter V from 2 August 2025 together with the penalty chapter, "with the exception of Article 101". Under Article 101(1) the Commission may fine providers of GPAI models up to 3 per cent of their annual total worldwide turnover in the preceding financial year or a fixed amount set in that article, whichever is higher, where it finds that a provider intentionally or negligently infringed the Regulation, failed to answer a request for documents or information, did not comply with a measure requested under Article 93, or refused access to a model for evaluation. The Q&A says that until 2 August 2026 the AI Office would collaborate closely with providers, in particular the signatories of the code of practice, and that from then "the Commission will enforce full compliance with all obligations".

Records to keep for every fine-tuning run

The one-third test is easy to pass with a margin, but only if someone can show the numbers later. A short record per run lets your legal counsel make the assessment and answers a request from the AI Office or a customer without reconstruction.

• Base model. Repository, exact revision or commit, licence file and the training data or compute its developer published.
• Method. Full fine-tune, LoRA or QLoRA, distillation or continued pretraining, with the framework and its version.
• Data. Sources, their rights status, the number of tokens and the number of epochs.
• Compute. Your estimate by 6 × parameters × tokens trained, and the GPU-hours from the scheduler or the job log as a cross-check.
• Use. Whether the result stays internal, goes into a product or service for third parties, or is published.
• Evaluation. The test set and results, which a provider's documentation would need in any case.

Many teams keep this next to the training configuration in version control. The same record serves an AI management system such as ISO/IEC 42001, which our article on AI governance for a private LLM maps to platform controls. For methods that process far more tokens, see our articles on continued pretraining on company data and LLM distillation on-premise.

Our Private AI/ML service runs fine-tuning and serving on your own hardware, with our engineering partner Vixen.UNO. Describe the model you want to adapt and how it will be used, and we propose the server and the training set-up.

Fine-tuning on your own server

Whether a run needs two cards or eight depends on the method more than on the AI Act. Our guide to GPU memory for fine-tuning with LoRA and QLoRA gives the model states per method, and our fine-tuning server with 2, 4 or 8 GPUs turns them into configurations. Our training node on AI servers has eight H200 NVL with NVLink bridges, dual AMD EPYC processors, 2.3 TB of DDR5 ECC memory, eight NVMe drives and 400G networking; four RTX PRO 6000 Server Edition cards suit LoRA and QLoRA runs up to 70B. Each server is assembled and tested before delivery, with the manufacturer warranty on every component handled through us, and quantities and lead time are confirmed in writing with the quote.

General information on EU law as of October 2026, not legal advice for an individual case; enforcement by national authorities and the AI Office may differ in practice, and your legal counsel confirms how the rules apply to your company.

FAQ