This case study examines how a company providing a large language model via API would approach compliance with the GPAI provisions of the EU AI Act. The company, "ExampleLM Inc.", trains its models using compute exceeding 10^25 FLOPs.

Step 1: Determine Systemic Risk Status

Because ExampleLM's training compute exceeds 10^25 FLOPs, the model is presumed to have systemic risk under Article 51(2). ExampleLM must notify the AI Office before placing the model on the EU market. It must comply with both Article 53 (baseline obligations) and Article 55 (systemic risk obligations).

Step 2: Prepare Article 53 Documentation

ExampleLM must prepare technical documentation per Annex XI, including model architecture, training data summary, capability evaluations, and known limitations. The training data summary must be publicly available per Annex XII. ExampleLM must also publish its copyright policy, including its approach to handling opt-outs from text and data mining under Article 4(3) of Directive 2019/790.

Step 3: Conduct Adversarial Testing (Article 55)

Before each major model release, ExampleLM conducts structured adversarial testing (red-teaming) to identify systemic risks including: bioweapon assistance, cyberattack facilitation, large-scale disinformation, undermining democratic processes, and other risks identified in the GPAI Code of Practice. Results are documented and used to implement mitigations. The AI Office may request access to evaluation reports.

Incident reporting: any serious incident involving the model must be reported to the AI Office without undue delay
Downstream information sharing: ExampleLM's API documentation and model cards must satisfy Article 53(1)(d)
Cybersecurity: ExampleLM must protect the model infrastructure against adversarial attacks and data poisoning
Code of Practice adherence: ExampleLM registers adherence to the GPAI Code of Practice approved by the Commission