Procuring an AI model (GPAI): what duties do you have as a deployer?

Short answer: Procuring a general-purpose AI model (GPAI) makes you a deployer, not the provider. The heaviest GPAI obligations in Chapter V of the AI Act rest on the model provider. Your duties as a deployer depend mainly on how you use the model: AI literacy always applies, transparency applies when you direct it at people or the public, and the heavier deployer duties apply as soon as the use is high-risk.

Who is who: provider versus deployer

The AI Act (Regulation (EU) 2024/1689) distinguishes roles. A provider develops an AI system or model and places it on the market under its own name; a deployer uses it under its own authority in a professional context (Article 3). An organisation that procures and applies an existing GPAI model is, as a rule, a deployer.

That distinction is decisive, because Chapter V — the obligations for general-purpose AI models — addresses the provider of the model. These include technical documentation, information for downstream parties, a copyright policy and, for models with systemic risk, additional requirements. They have applied since 2 August 2025. As a purchaser you do not inherit them; you may, however, rely on them, because the provider is obliged to supply downstream users with information.

Watch one tipping point: if you substantially modify the model, or place it on the market under your own name, you may be treated as a provider yourself, and the provider obligations then apply to you.

Your duties as a deployer, by use

AI literacy (Article 4). This duty has applied since 2 February 2025 and is role-independent: both providers and deployers must ensure a sufficient level of AI literacy among their staff and others who operate the system on their behalf. It is the first duty relevant to almost every GPAI purchaser.

Transparency (Article 50). If you deploy the model in a chatbot or assistant that interacts directly with people, or generate content that appears authentic, transparency obligations apply: people must know they are dealing with AI, and synthetic content must be detectable. Under the Digital Omnibus agreement of 7 May 2026, Article 50 is expected to apply from 2 December 2026; until publication in the Official Journal, 2 August 2026 formally still stands.

High-risk use (Article 26). If you build the GPAI model into an application with a high-risk purpose (Annex III), you become the deployer of a high-risk system, and the heavier duties of Article 26 apply: use according to the instructions, human oversight, monitoring, log keeping and informing affected persons. The application dates for the high-risk regime are expected to shift via the Digital Omnibus; consult the timeline for these.

What this means at procurement

Three sober steps. First, determine your role — do you remain a deployer, or does modification or relabelling turn you into a provider? Second, request the provider information that Chapter V entitles you to, and stipulate in the contract that the provider meets its GPAI obligations and supplies the documentation you need. Third, classify your own use (general, transparency-bound, or high-risk), because that — not the model itself — is where your obligations sit. The definitive dates are only fixed on publication in the Official Journal; account contractually for both timelines.

Read more: AI Act: timeline of obligations.

Take the scan.