GPAI obligations incl. Annex XI energy/compute docs
Binds Providers of general-purpose AI models. Technical documentation, training summary, energy disclosure.
Stated maximum penalty — Up to 3% turnover or €15M
Topic dossier
The rules aimed at foundation-model and frontier developers — safety frameworks, incident reporting and model documentation. 10 obligations across 4 jurisdictions — 5 in force, 1 proposed. Next dated deadline: 10 Aug 2026.
A distinct regulatory track targets the largest models rather than specific uses. It splits into model-documentation duties for general-purpose AI (GPAI) and safety-and-incident regimes for frontier developers above a capability or compute threshold. The EU AI Act covers GPAI; California’s SB 53 and New York’s RAISE Act lead on frontier safety in the US. The instruments below make up this track.
Binds Providers of general-purpose AI models. Technical documentation, training summary, energy disclosure.
Stated maximum penalty — Up to 3% turnover or €15M
Binds GPAI model providers (enforced by the Commission / AI Office). Commission may fine GPAI providers; supervision powers begin.
Stated maximum penalty — Up to 3% global turnover or €15M
Binds General-Purpose AI (GPAI) model providers whose models are placed on the EU market or whose services are used in the EU. Binding procedural rules activating Commission enforcement against GPAI model providers: (1) providers must grant Commission technical access to models on demand — including APIs, source code, weights, and infrastructure — for AI Act evaluations under Art. 92; (2) detailed proceedings rules for investigations leading to Art. 99–101 fines, including rights of defence, 21-day minimum observation period, oral hearings, and 5-year limitation period. All communications require qualified electronic signatures.
Published OJ L 2026/1755 on 21 July 2026; enters into force on the twentieth day following publication (10 August 2026), per Art. 12 of the Regulation.
Stated maximum penalty — Implementing regulation activates fines under Art. 99-101 of Reg. (EU) 2024/1689: up to 3% of global annual turnover for GPAI providers (Art. 101(3)); up to 1% for false/misleading information
Binds Frontier AI developers (>1e26 training ops); large frontier developers (>$500M revenue). Safety frameworks + critical-incident reporting to Cal OES for frontier developers.
Stated maximum penalty — Up to $1M per violation
Binds Developers of generative AI systems made available to Californians. Public dataset-summary disclosure for generative AI offered to Californians.
Stated maximum penalty — Civil enforcement
Binds Subscription AI providers, frontier developers, AI companion operators, AEDT deployers, and social media platforms serving Connecticut users. Tiered AI obligations: subscription AI disclosures (Oct 2026), companion AI safeguards (Jan 2027), AEDT pre-decision notices (Oct 2027), social media minor restrictions (Jan 2028).
Multiple tiers: subscription AI disclosures 2026-10-01; AI companion 2027-01-01; AEDT disclosures 2027-10-01; social media minor restrictions 2028-01-01.
Stated maximum penalty — CT AG enforcement (unfair/deceptive trade practices)
Binds Large frontier developers (>1e26 ops, >$500M revenue) operating in New York. Safety/security protocols + 72h critical-incident reporting to NYDFS; AG enforces civil penalties.
Stated maximum penalty — Up to $1M / $3M
Binds Large frontier AI developers (>$500M revenue, trained on massive compute) operating in Illinois. Large frontier AI developers must publish safety frameworks, annual third-party audits, and report critical incidents within 72 hours.
Signed 2026-07-06.
Stated maximum penalty — Up to $1M first offense; up to $3M subsequent violations
Binds Providers of public-facing generative AI services in mainland China. Security assessment, algorithm filing and content controls for public-facing GenAI services.
Stated maximum penalty — Rectification, suspension, criminal referral
Binds Would have bound high-impact & general-purpose AI — never enacted. Would have set high-impact / GPAI duties; died on prorogation Jan 2025 and was not reintroduced.
Abandoned — died on prorogation Jan 2025; not reintroduced.
General-purpose AI — a model that can perform a wide range of tasks and be integrated into many downstream systems. Providers must keep technical documentation, publish a training-content summary and, for models posing systemic risk, meet additional safety and reporting duties.
Published safety frameworks and mandatory reporting of critical incidents. California’s SB 53 requires frontier developers to report incidents to Cal OES; New York’s RAISE Act requires security protocols and 72-hour incident reporting.
No comprehensive one. Frontier-specific obligations are currently state-led — California’s SB 53 and New York’s RAISE Act — while federal action remains limited to executive measures and sector rules.
We currently track frontier & general-purpose ai obligations across 4 jurisdictions: European Union, United States, China and Canada. Each is dated and linked to its primary source on this page.
Not legal advice. Each obligation links to its primary source and carries the date it was last checked; verify the legal text before relying on it.