For generative AI, a post-August 2025 framework.
AI Act obligations for general-purpose and generative artificial intelligence models: transparency, copyright policy, training-data summary and content marking.
Who does the GPAI regime bind?
The AI Act’s rules on general-purpose models (GPAI) have applied since August 2025. They speak directly to model providers, but a company that embeds a generative model in its product, fine-tunes one, or opens one up for use across the business joins the obligation chain in a role of its own. “We only use the API” is where the analysis starts, not where it ends.
Provider-side obligations
Providers owe technical documentation and downstream information, a policy for complying with EU copyright law, and a sufficiently detailed summary of the training data; models above the systemic-risk threshold owe further assessment and reporting on top of that. A company that fine-tunes a model can pick up part of the provider obligations itself, depending on how far the modification goes.
The deploying company’s side
Generative output has to be marked — the transparency rules bite hardest on deepfakes and public-facing content — customer-facing products need disclosure texts, and both have to line up with the copyright-data layer. An internal usage policy must define which data may be entered into which tools, and where human approval is required.
From role analysis to documentation
The work starts with a model-role matrix: for every model in use we establish the role — provider, fine-tuner or deployer. Second comes the gap analysis, comparing existing documents and procurement contracts against the relevant obligations of the AI Act (Regulation (EU) 2024/1689). Third, we produce the document set: transparency and marking texts, a copyright-compliance policy, a training-data summary template and the internal usage policy. Fourth, GPAI commitments go into the procurement contracts. The last step is monitoring: we track the timeline of Commission guidance and codes of practice and update the set as it moves. Our Legal Tech Desk keeps the shared language with the technical teams.
Serving the EU market from Türkiye
The AI Act reaches a long way: where the output of a system is used in the EU, the obligation chain can attach even though the model or the product is offered from Türkiye. That is why the service is used most often by SaaS and software exporters with EU customers, by groups distributing product through a German subsidiary, and by agencies and integrators selling generative features under a white label. The personal-data layer does not run on a separate track: the KVKK and GDPR bases for training data and output data are wired into the same architecture as your KVKK/GDPR compliance programme. Deliverables: the role matrix, a gap report, the document set and the contract clauses.
We are by your side for Generative AI & GPAI Compliance
We start with the model-role analysis, build the provider documentation and the deployer-side policy set, and write GPAI commitments into your procurement contracts. Our Artificial Intelligence focus area tracks the timeline; you focus on the product.
Other Applications of This Service
AI Compliance & Governance — our other specialised solutions in this area.
Matter Connections
The focus areas, practice areas, desks and legislation connected with this sub-service.
Our Matters in This Service
The anonymised examples of our work that relate to this service.
The Team Delivering This Service
With our multilingual team of lawyers, well-versed in Turkish and German law, we are by your side.
Related Publications
Fresh perspectives and guides from the Knowledge Centre.
Open-source models are granted certain exemptions, but these are limited (especially at the systemic-risk threshold). No exemption should be assumed until your form of use and distribution have been analysed.
Depending on the scale of the modification, partial obligations may arise. The role should be determined by documenting the purpose of the fine-tuning, the dataset, and the distribution channel.
Transparency rules apply to synthetic content made available to the public; labelling is essential especially for content imitating real persons. Exceptions must be interpreted narrowly.
Generative AI & GPAI Compliance — get the right legal support.
Let us identify the right solution together, drawing on our experience in Türkiye and the DACH region.