OpenAI's general-purpose model duties run to the Commission and to whoever builds on the model. They do not run to the bank that bought it.

Question 31 asks the supplier to describe the data the model was trained on, in enough detail for the firm to form a view on whether it can lawfully use the output. The answer comes back as one sentence and a link. Please refer to the published model card.

Nobody is being evasive. The supplier has answered with the only document it is obliged to put in front of a customer, and that document was not written to answer question 31.

The general-purpose model obligations in the AI Act applied from 2 August 2025. Seven months on, most procurement packs still treat them as a disclosure regime. They are not. They are a set of duties owed to particular named parties, and the parties are named in the text.

Four obligations, and a different recipient for each

Article 53 puts four things on the provider of a general-purpose model. The useful way to read them is by who receives what.

Technical documentation of the model, kept current, covering the training and testing process and the results of the evaluation, with a minimum content set fixed in an annex. It is drawn up, held, and supplied to the AI Office and to national competent authorities on request. It is not published, and the chapter's confidentiality provisions are there to make sure nobody publishes it by accident.

Information and documentation for providers of AI systems who intend to integrate the model into their own systems, so those providers understand what the model can and cannot do and can meet their own obligations. Another minimum set in another annex. The recipient here is specified with some care, and it is a provider of an AI system.

A policy to comply with Union copyright law, including a means of identifying and respecting a reservation of rights made under the text and data mining exception in the 2019 directive. The duty is to put the policy in place. The text does not say publish it.

And a sufficiently detailed summary of the content used for training, made publicly available, on a template from the AI Office. That one is written for everybody, and everybody includes you.

One to the regulator, one to the integrator, one to nobody in particular, one to the world. Providers of models carrying systemic risk owe a further set on top — evaluation, risk mitigation, incident reporting, cybersecurity — and those run to the AI Office as well.The classification test for systemic risk is a compute threshold with a presumption attached and a Commission power to designate. No figure appears in this piece, on purpose. The load-bearing word in all of it sits in the second obligation.

Whether you are owed the integrator's pack turns on a question your firm has not answered

A deployer uses an AI system under its own authority. A provider develops a system, or has one developed, and places it on the market or puts it into service under its own name. Those are different roles with different duties and the Act keeps them apart.

So: your firm licenses the model, wraps it in an internal application, gives the application a name, and puts it in front of underwriters. Whether you are now a provider of that system is a live question, and if you are, you are also the party the second obligation is owed to. That is not a happy way to acquire an entitlement. Becoming a provider brings a great deal with it, most of it expensive, and none of it is worth taking on for the sake of a documentation pack. But it is the only route in the chapter by which the information lands in your hands rather than the Commission's.

A label in a contract is evidence of what the parties intended. It is not evidence of what they did.

Enterprise terms tend to settle this on paper, and the paper tends to say the customer is the deployer. Check whether the facts match the characterisation, because a supervisor will. If your firm holds the system out under its own brand, sets what it is for, and decides who it is used on, the label in the definitions clause is going to have a thin time of it.

The document that is public is a summary, and it says so in its name

The training content summary is a real improvement on what came before and it will not answer your question. The template asks for a narrative account of the main data sources, the large publicly available datasets, and how the provider handled reservations of rights. What it does not produce is anything you could run a clearance check against, and it was never meant to. The summary exists so that parties with a legitimate interest, rightsholders chiefly, can work out whether to ask a question. Your interest is in an indemnity. The summary is not evidence for one and no amount of reading it closely will make it so.

The copyright policy is the sharper omission. You may ask for it. There is no obligation to give it to you. Several providers publish one anyway, which is a commercial decision, and a commercial decision can be reversed on a commercial timetable.

The Code of Practice, signed in the summer of 2025 by most of the large providers including OpenAI, is the route by which a provider demonstrates that it has met Article 53 without arguing about it from first principles. Its transparency chapter turns the first two obligations into a documentation form. I have not opened the current version of that form for this piece, and I will not pretend otherwise, but it is the thing to check, because the form is where the line between the AI Office's copy and the integrator's copy is actually drawn. If a field is marked for one and not the other, that is the answer to half the questions on your due diligence sheet.

A model that was already on the market is allowed to be a work in progress

Models placed on the Union market before the August 2025 date have a run-off. The deadline for those is 2 August 2027.

Which means a supplier who answers a due diligence question with we are working towards full compliance and expect to complete ahead of the 2027 date has given an accurate and lawful answer. Procurement teams read that sentence as an evasion. It is a correct statement of the law and it should be recorded as one. What it also is, is two years in which the documentation your file is relying on does not yet have to exist in the form you are imagining.

There is a name and an address in the Union, and its duties run past you

Article 54 is the provision nobody quotes. A provider established outside the Union must, before placing a general-purpose model on the Union market, appoint an authorised representative established in a member state, by written mandate.The Commission's digital omnibus proposal reopened parts of the Act's timetable. I have not checked where it stands this week, nothing here rests on it, and as far as I have seen it left the general-purpose model dates alone. That representative keeps a copy of the technical documentation and hands it over on request, to the AI Office.

It is the closest thing in the chapter to a European address for the model. Everything it is obliged to do, it is obliged to do for somebody else.

What a procurement team can actually ask for

The entitlement you want is contractual, because the statutory one does not exist. Ask for the integrator's information set as the provider maintains it, on request, with a service level. Ask for notice of material change to the model, in writing, with a period attached. Ask for the copyright policy. Ask for a warranty that the public summary was accurate as at a stated date. None of that is unusual to ask for and none of it is given to you by the regulation.

Then go through your questionnaire and mark, against each question, which of the four documents it is actually asking for. Most sheets are asking for the first one. You will never see the first one.

The obligations have been live since August and the Commission's power to fine anyone for breaching them was deferred by a year. That year runs out this summer. Nothing about what a customer is entitled to changes on that date; what changes is that the answers suppliers have been giving become answers with a penalty attached, and the first sign of whether the documentation exists at all will be somebody at the AI Office asking to see it. Not somebody in procurement.