Usually not directly. The EU AI Act's general-purpose AI model obligations, which have applied since 2 August 2025, fall on the providers who develop those models and place them on the market. An agent builder is normally a provider or deployer of an AI system instead, with duties set by what the agent is used for.
What do the general-purpose model rules require?
The EU AI Act (Regulation (EU) 2024/1689) treats general-purpose AI models separately from AI systems. A general-purpose model is one that can perform a wide range of distinct tasks and be built into many downstream systems; our entry on what a general-purpose AI model is sets out the definition.
In substance, providers of these models must prepare technical documentation, give information and documentation to downstream providers who build on the model, put in place a policy to comply with EU copyright law, and publish a summary of the content used for training. Models with systemic risk carry further duties around evaluation, incident reporting and cybersecurity.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Who is a model provider and who is an agent builder?
| You are | Your usual position under the Act | Model rules apply to you? |
|---|---|---|
| A lab that trains and releases a general-purpose model | Provider of a general-purpose AI model | Yes |
| A firm that builds an agent on a hosted model and sells it | Provider of an AI system | Not the model rules, but system rules by risk category |
| A bank that builds an agent for its own operations | Provider and deployer of an AI system | System rules; deployer duties |
| A bank that uses a vendor's agent | Deployer | Deployer duties |
| A firm that substantially modifies a model, for example through heavy fine-tuning | May take on model provider duties for the modification | Possibly; take advice |
The last row is where builders should be careful. Light configuration of a model through instructions and sources does not make you its provider. Substantial modification can change your position, and where that line sits is a matter for counsel and the Commission's guidance.
What does it mean when the system is an agent?
As an agent builder, the obligations you carry come from what the agent does, not from the model underneath. An agent that answers staff questions from a policy library may carry only transparency duties, such as telling people they are interacting with an AI system under Article 50. An agent that assesses creditworthiness of individuals is part of a high-risk system, and its provider faces the requirements for high-risk systems, including risk management, data governance, record-keeping, transparency to deployers, human oversight, and accuracy and cybersecurity.
The model provider's documentation becomes an input to your own obligations. You need to know what the model was designed for, its known limitations and how it was evaluated, so you can build and document your agent responsibly. The guide to what deployers inherit from general-purpose model obligations covers how that information flows.
How do you meet your side of it?
| What you need | Control | Evidence it leaves |
|---|---|---|
| Know your role | Classify each agent: provider, deployer or both; risk category | A role and risk register |
| Model information | Obtain the model provider's documentation for downstream providers | Documentation on file |
| Avoid becoming a model provider unintentionally | Change agents through brief, sources and bounds, not model weights | Change log |
| System obligations by risk | Map each agent's use to the Act's categories | Requirement map per agent |
| Transparency | Tell people they are interacting with an AI system where required | Notices and screenshots |
What does that look like in practice?
Say a software firm builds an agent that helps lenders prepare affordability assessments, running on a hosted general-purpose model, and sells it to banks across the EU. The firm is the provider of an AI system, likely high-risk because it supports creditworthiness assessment. It is not the provider of the model, so it does not prepare the model's training summary or copyright policy. It does obtain the model provider's documentation, uses it in its own risk management and technical documentation, and gives its bank customers the information they need as deployers. It improves the agent by changing its brief and sources rather than retraining the model, which keeps its role clear.
The wider rules picture is in our guide to AI agent regulation.
Questions people ask
Does using an open-weight model change this?
Using an open-weight model does not make you its provider. Modifying and redistributing it might. Some open-source models benefit from exemptions from certain model duties, but not where systemic risk applies.
Do we need the model provider's documentation even if our agent is low risk?
It is good practice for any agent, because it tells you the model's limitations. For high-risk uses, it is part of what you need to meet your own duties.
Can the model provider's compliance cover ours?
No. It covers the model. Your obligations come from the agent and its use, and stay with you.