When most people think of the term “GPAI models”, they think of openAI, Llama, Aleph Alpha, Mistral & co. But the potential range of AI models that could fall under the EU AI Act as GPAI is much wider. There are a number of large domain-related foundation models for medicine, finance, law, creativity or customer service. The regulatory boundaries to GPAI models appear to be fluid.

• Large domain-related foundation models could be regarded as GPAI models within the meaning of the EU AI Acts in individual cases.
  
• A list of medical, finance-related, legal and creative Foundation models illustrates the challenge.
  
• In view of rapid innovation cycles, the challenges of differentiation will grow with it.
  
• More legal clarity is important not only for providers of foundation models, but also for providers of AI systems.

Articles of the EU AI Act mentioned in this post (German)

• Article 2 EU AI Act
• Article 3 EU AI Act
• Article 6 EU AI Act
• Article 10 EU AI Act
• Article 53 EU AI Act.
• Article 55 EU AI Act
• Article 56 EU AI Act
• Article 72 EU AI Act
• Annex XI EU AI Act

Please note that the original text of this article is based on the official German translation of the EU AI Act. Its wording may differ in part from the English version of the EU AI Act.

Wide variety of GPAI models?!

There are a variety of foundation models with a wide range of uses for the specialist domains of medicine, finance, law, cyber security, environment, logistics, robotics, customer service, etc.

Under what conditions could corresponding foundation models be considered GPAI models within the meaning of the EU AI Act? The consequences would be considerable:

• Providers would have to comply with transparency obligations in the supply chain, see Article 53 EU AI Act.
• For them, the GPAI Code of Practice that will be created shortly would be important, see Article 56 (9) EU AI Act.
• Last but not least, they should also take a closer look at Annex XI.

The distinction is not easy: Just as many GPAI models can (also) provide specialist information, many domain-related foundation models are (also) able to cover general use cases. The boundaries of both worlds appear to be fluid, as the following, highly simplistic graphic illustrates.

The focus of this article is on the question of whether and under what conditions a domain-related foundation model could become a GPAI model. The resulting legal consequences can only be hinted at in this article. The issue has consequences, among other things, for the providers of AI systems that integrate domain-related foundation models: Only if these are to be classified as GPAI models within the meaning of the EU AI Act, the providers of the AI system have the legally guaranteed insight into its functioning. Conversely, they only become their downstream suppliers for GPAI models.

1. Leading GPAI tools are sure …

To start with a test: If you ask the leading GPAI tools whether there are “GPAI models” in the specialist domains of medicine, finance, law, etc., the answer is clearly “Yes!”. Afterwards, not only a long list of corresponding providers is presented (over 40 …). It also explains exactly why every single AI model on the list is actually a “GPAI model”!

1.1 What is a GPAI model?

Gemini, ChatGPT 4o and Copilot largely agree on what is meant by a GPAI model beyond all definitions of the EU AI Act:

Key characteristics of GPAI models include:

1. Versatility: The ability to apply the model to a wide variety of tasks across different industries or sectors, such as healthcare, finance, customer service, and more.
2. Adaptability: The capability to adapt to new tasks or domains with little to no additional training or with generalizable knowledge that can be fine-tuned.
3. Scalability: The potential to scale the model’s application from small to large datasets or from single to multiple tasks.
4. Integration: The ability to integrate into existing systems across different domains, providing insights, automation, or optimization without the need for specialized models for each task.

Using this definition, I identified providers that offer AI models or platforms capable of addressing diverse challenges across various domains, including healthcare, finance, legal, creative industries, education, customer service, manufacturing, environmental science, security, and transportation. These providers leverage GPAI models to deliver solutions that are not limited to a single domain but can be applied across multiple areas, showcasing the broad utility of their AI technologies.

1.2 Industry and/or cross-sector?

Point 1 is particularly important in the definition:

• According to this, various “industries” as well as various “sectors” are named. Many sectors are possible within a domain. Cross-sector AI is therefore also a variant of GPAI.
• Within a sector, the boundaries are also quite fluid, e.g. in medicine with the sectors of hospitals, resident (specialist) doctors, nursing, pharmacies, pharmaceutical industry, MedTech, insurers, sports and wellness and, last but not least, patients.
• If a domain-related foundation model were to be used by all companies in a certain sector, then one would assume that this would affect the protective purpose of the EU AI Act. Especially when it comes to domains with important systemic importance such as finance, the media or the healthcare industry.

1.3 GPAI-Models and Knowlegde Graphs

The already difficult distinction between GPAI models and domain-related foundation models is made more difficult by the potential use of knowledge graphs.

The strength of (mostly LLM-based) GPAI models lies in their ability to understand and generate complex relationships in texts. Knowledge graphs, on the other hand, offer a structured and easily accessible knowledge base.

The combination of both technologies makes this possible:

• More accurate answers: LLMs can access the facts stored in Knowledge Graphs to provide more precise and fact-based answers.
• Deeper insights: By analyzing the connections in Knowledge Graphs, LLMs can answer more complex questions that require multiple steps of logical reasoning.
• Better contextualization: LLMs can better understand the context of questions when they can access the information stored in Knowledge Graphs.

This is one of the key challenges of knowledge graphs:

• That, on the one hand, they can be used as training data.
• On the other hand, in many cases they are not part of the training data.
• Therefore, domain-related foundation models can also be extended by knowledge graphs.

In fact, it would have to be checked in each individual case when which variant is to be assessed as GPAI within the meaning of the EU AI Act.

This topic can also only be hinted at here. With such a special subject matter and in view of the clarity of the initial definition used, even AI and legal experts are likely to come to differing assessments as to whether and when domain-related foundation models should generally be designated as “GPAI” – regardless of which ones also fall under the GPAI definition of the EU AI Act.

2. Clear GPAI Model Definition?

So to the legal definition: Article 3 No. 63 EU AI Act contains a list of criteria for GPAI models:

‘For the purposes of this Regulation, the following definitions apply:

• general-purpose AI model’, an AI model
• — including where such an AI model is trained with a large amount of data using self-supervision at scale —
• that displays significant generality and
• is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market,
• and that can be integrated into a variety of downstream systems or applications,
• except AI models that are used for research, development or prototyping activities before they are released on the market;

3. Proximity of GPAI and Foundation Models

Obviously, there is a conceptual and technical proximity between GPAI models and domain-related foundation models, which can be regarded as GPAI models, at least from an AI point of view.

Examples of the terminology of domain-related foundation models:

• GMAI models in the sense of a foundation model for medicine
• Types of domain-specific foundation Models for Medicine, Finance or Legal
• Robotic foundation models with different purposes
• Generative foundation models for creative purposes.

This circumstance is perhaps the most important reason for the need for clear legal requirements. They are especially necessary for domain-related foundation models that can be used universally (inside and partly outside their domain)!

There is a need for clarification in two senses: Firstly, with regard to the positive classification as a GPAI model within the meaning of the EU AI Act. On the other hand, with regard to the clear negative exclusion that any universally usable AI model does not constitute a GPAI model within the meaning of the EU AI Act.

4. International understanding and rapid innovation

Two aspects must be emphasized at this point:

• The conceptual differences already result from the fact that the EU AI Act is a legal norm that is only valid within the EU. Outside the EU, GPAI models can be defined quite differently than in the scope of the EU AI Act.
• In addition, the rapid development of all types of AI models must be taken into account. Drawing clear boundaries is becoming increasingly difficult due to techniques such as Transfered Learning (TLM), because specific AI models are trained by general AI models – and vice versa.
• Sooner or later, it will be possible to achieve a strong alignment in the sense of an AI-related “entrophy“, i.e. a theoretical “balance” of all kinds of models.

For this reason alone, the present article cannot offer any final answers. Rather, it is intended to stimulate discussion. The main goal is to ensure that corresponding questions are taken into account when creating the Code of Practice for GPAI models by May 2, 2025!

5. Three-level classification

In this respect, it makes sense to use a similar three-level differentiation with regard to the examples mentioned above and below, as used by the Applied AI Initiative in the context of high-risk AI systems, among others:

In this respect, the different technical languages collide – especially in the future:

• From a technical point of view, the AI world refers to some offers as a “GPAI model”, although it is not one within the meaning of the EU AI Act.
• Conversely, GPAI models within the meaning of the EU AI Act may not be recognized or designated as such by their providers. For example, because they have a purely domain-related view.
• Last but not least, the provider of the AI system, in which the different variants are integrated, is the victim: He bears overall responsibility – also for all integrated AI models, whether GPAI or not.
• Therefore, in case of doubt, the system provider should also have a high interest in obtaining as much detailed information as possible from the model providers.

Only GPAI models within the meaning of the EU AI Act are subject to comprehensive transparency obligations. With all other AI models, these exist only to a limited extent. Often they are purely a matter of negotiation.

6. Questions arising from this

From a legal point of view, the above definition raises at least three questions:

1. What is an “AI model” in general?
2. What is meant by “generality” and when is it “significant”?
3. When is a “wide spectrum” of different tasks “competently” performed?

Considering the domain-related use of the term “Foundation Model” mentioned above, these questions are potentially different for each domain, its use cases, and adjacent industries and sectors.

Here is an overview of all relevant aspects:

The boundaries between the domains are sometimes fluid. Certain AI models are therefore also able to cover several specialist areas. This alone could turn them into GPAI models, for example in education, innovation, cyber security or the legal profession. This makes it all the more important to have clear criteria that enable AI practice to reliably compare its own professional assessments with legal requirements.

7. What are the answers?

The EU AI Act itself does not provide any precise indications. It is true that recitals (97) and (111) are dedicated to the topic of “GPAI”. In addition, specific definitions can be found in Article 3 No. 64 et seq. of the EU AI Act. However, these often refer to GPAI models with systemic risk. This is a special variant – not the rule with regard to the GPAI models without systemic risk, which are already covered by Article 53 EU AI Act.

It is therefore important that the questions are specified in guidelines where possible. In particular, the creation of the Code of Practice for GPAI models should be mentioned as an opportunity in this regard. In this regard, please refer to the following article, which is comprehensively dedicated to this challenge.

Details on the question of what AI models are within the meaning of the EU AI Act can be found in this article:

The main purpose of this article is to clarify which domain-related foundation models could fall under the EU AI Act as GPAI models. It doesn’t matter whether they come from the EU or from a third country: The only important aspect is whether they are offered in the EU (see Article 2 EU AI Act).

8. Concrete examples

In the following, four of many possible domains with corresponding solutions are examined in more detail – medicine, finance, law and the creative industries:

• The offers listed are exemplary and by no means exhaustive.
• In addition, it cannot be said for sure at this point whether these are really “GPAI models within the meaning of the EU AI Acts” or “only” “other AI models”.
• It is important that the providers mentioned offer domain-specific AI services that can be integrated into various AI systems with varying purposes, among other things, as an AI model.
• Some of the services are also no longer on the market – but they still serve as an example of the challenge!

For some of the examples below, it seems comparatively likely that they are GPAI. For others, this is less the case. What applies in individual cases will not be discussed further at this point. Everyone can represent their own assessment here!

8.1 Medical Foundation Models

The following medical foundation models could be GPAI models within the meaning of the EU AI Act:

• IBM Watson Health: Was an offering for AI-driven solutions for medical diagnostics, treatment recommendations, and research.
• Google Health (Med-PaLM): Focuses on AI in medical imaging and health data analysis.
• PathAI: Specializes in AI-powered pathology analysis for cancer diagnosis.
• Zebra Medical Vision: Provides AI models for medical imaging analysis in a wide range of conditions.
• Tempus: Uses AI to personalize cancer care by analyzing clinical and molecular data.
• Infermedica: Provides AI-powered solutions for medical diagnosis and patient triage.
• Ada Health: Develops an AI-powered health assessment platform that provides personalized health information.
• CureMetrix: Specializes in AI in medical imaging, especially mammography.
• Icometrix: Uses AI to analyze MRI and CT scans of the brain for neurological diseases.
• Luscii: Provides an AI to diagnose various diseases.

8.2 Financial Foundation Models

The following Financial Foundation models could be GPAI models within the meaning of the EU AI Act:

• Bloomberg: Uses AI models to analyze financial data and create news.
• BlackRock Aladdin: A comprehensive investment management platform that uses AI for portfolio management and risk assessment.
• Kensho (S&P Global): Provides AI solutions for financial analysis and market insights.
• Ayasdi: Specializes in AI-powered financial fraud detection and risk management.Numerai: An AI-driven hedge fund that uses collective intelligence for trading algorithms.
• Quantexa: Provides AI-powered solutions for financial crime detection and data analysis.
• Feedzai: Focuses on AI for financial fraud detection and risk management.
• Strands: Provides AI-powered financial management and personalized banking solutions.
• Meniga: Provides AI-powered solutions for personal finance management and digital banking.

In addition, one could even ask whether some of these providers do not even have GPAI models with systemic risks. After all, it is highly likely that the world’s leading financial institutions are the customers of some providers.

8.3 Legal Foundation Models

The following Legal Foundation models could be GPAI models within the meaning of the EU AI Act:

• ROSS Intelligence: Uses AI for legal research and document review.
• Luminance: AI-powered platform for contract analysis and review of legal documents.
• Kira Systems: Specializes in AI-driven contract review and due diligence processes.
• LawGeex: Provides AI to automate contract review to ensure compliance with legal standards.
• Neota Logic: Provides AI-driven solutions for automating legal workflows and decision-making.
• Ayfie: Specializes in AI for legal search and document analysis.
• ThoughtRiver: Develops AI-powered tools for pre-reviewing contracts and risk analysis.

According to the view represented here, the legal application possibilities for AI models are enormous. It can be classified as general applicability with good reason, since law plays a role in almost all situations in life: from highly specific subject areas to everyday issues such as neighbourly disputes. So if a lawyer offers AI-supported information on his website that enables legal questions of all kinds to be addressed to citizens, then the “glass of the GPAI model” is “half full” and not “half empty” in case of doubt (german saying).

8.4 Special Case: Creative Foundation Models

Perhaps the most important special case is creatively usable foundation models. Special case because the danger of deep fakes and fake news is explicitly regulated in the EU AI Act. This CAIR4 article provides detailed information (so far only in german language):

Here it seems obvious that corresponding domain-related foundation models, e.g. for image and video production, are to be regarded as GPAI models within the meaning of the EU AI Act. This should then also be offered by providers such as e.g. Adobe Sensei or RunwayML .

And the legal conclusion? “If you say A, you have to say B too” … (German saying). In other words, if domain-related foundation models should be classified as GPAI models in the creative sector, how should the boundaries be drawn in other domains, e.g. medical imaging?

9. Conclusion

According to the view taken here, there is a need for action: In view of the technical language already established in the AI world, it is not sufficient to use or coin legal terms that only partially correspond to AI practice.

According to the view taken here, e.g. Google Health (Med-PaLM), the AI from Bloomberg and Adobe Sensei are to  be regarded as GPAI models simply because of their enormous performance and universal usability (see above in the sense of unambiguous GPAI models). Conversely, if this is assumed, it becomes increasingly difficult to classify which of the other models mentioned “only” has another AI model (regardless of whether it is clearly not a GPAI model or whether it is unclear whether it is a GPAI model):

• The main reason is that the two previously mentioned presumably unique domain-specific GPAI models blur the boundaries of “significant generality” and “multiple specific usability” within a domain and adjacent domains.
• The legal AI models in particular show that they have a wide general range of applications, e.g. compared to medical or finance-related AI (authorities, law firms, companies, NGOs & more).
• The protective purpose of the EU AI Act, which should be similarly critical of both variants, i.e. that of “significant general usability” and “multiple specific usability”, is particularly important.
• If one assumes this, it also becomes a challenge for all other AI models mentioned and not mentioned with comparatively specific domain use whether and to what extent they are also to be regarded as GPAI models within the meaning of the EU AI Act.

Clear guidelines, e.g. in the Code of Practice for GPAI models, would make this classification easier.

Links to the articles of the EU AI Act mentioned in this post (German):

• Article 2 EU AI Act
• Article 3 EU AI Act
• Article 6 EU AI Act
• Article 10 EU AI Act
• Article 55 EU AI Act
• Article 56 EU AI Act
• Article 72 EU AI Act
• Article 111 EU AI Act
• Annex XI

About the author:

Oliver M. Merx