General-Purpose AI under the EU AI Act: A Conceptual Allocation of Duties across the Value Chain

Abstract

This article examines how the final version of the EU Artificial Intelligence Act (“AI Act”, adopted 2024) allocates obligations across the AI value chain, with a focus on general-purpose AI (“GPAI”) or foundation models. It proposes a taxonomy of key actors – foundation model providers, fine-tuners, integrators, and deployers – and analyses the interfaces between them, including documentation tools (model cards, system cards) and logging requirements. Building on principles of control, foreseeability, benefit, and capability, the article argues for a principled distribution of compliance duties: those who design and train foundational AI models should bear upstream transparency and safety obligations, while those who adapt or deploy AI in specific contexts shoulder downstream risk management and oversight duties. The analysis discusses the EU Act’s enforcement model (market surveillance authorities and an EU AI Office) and contrasts it with data protection supervision, highlighting the need for coordination in areas of overlap. A comparative outlook considers the UK’s pro-innovation, context-driven approach and the evolving US regulatory landscape. Finally, the article offers recommendations for regulatory guidance and standards development (ISO/IEC, CEN/CENELEC) to support effective implementation, accounting for recent developments including the Digital Omnibus Regulation, the AI Office’s emerging guidelines, and the broader debate on EU regulatory competitiveness triggered by the Draghi Report. This approach aims to clarify how the EU AI Act’s final provisions on general-purpose AI models can serve as a global benchmark for balanced AI governance.