Foundation Model

Foundation models, referred to in the EU AI Act as "general-purpose AI models" (GPAI models), are AI models trained on broad data using self-supervision at scale, displaying significant generality, and capable of competently performing a wide range of distinct tasks. Prominent examples include large language models (LLMs) such as GPT-4 and Claude, as well as multimodal models capable of processing text, images, and other data types.

The EU AI Act introduces a tiered regulatory framework for GPAI models. All GPAI model providers must comply with baseline obligations including maintaining technical documentation, providing information and documentation to downstream providers integrating the model into AI systems, establishing a policy for complying with copyright law, and publishing a sufficiently detailed summary of the training data.

GPAI models that pose "systemic risk" face additional, more stringent requirements. A model is presumed to have systemic risk when its cumulative compute used for training exceeds 10^25 FLOPs, or when the European Commission designates it as such. Providers of systemic-risk models must perform model evaluations, assess and mitigate systemic risks, track and report serious incidents, and ensure adequate cybersecurity protections.

The regulation of foundation models was one of the most debated aspects of the AI Act during legislative negotiations. It represents a novel approach to regulating AI at the model level rather than solely at the application level, reflecting the recognition that the capabilities and risks of powerful general-purpose models require upstream governance.