If your organisation uses a large language model, a multimodal foundation model, or any AI system trained on broad data and adapted for fashion-specific tasks—trend forecasting, copywriting, design ideation, supplier communication—you are already inside the scope of the EU AI Act's Title VIII provisions on general-purpose AI (GPAI) models. The obligations are not hypothetical. They are live for providers of GPAI models and are beginning to bind deployers who integrate those models into product workflows.
This article defines the key terms, maps the compliance mechanism, and names what is still genuinely unsettled for fashion AI and legal teams.
Key Takeaways
- The EU AI Act distinguishes between providers of GPAI models (those who train or fine-tune them) and deployers (those who integrate them into downstream applications); fashion brands typically sit in the deployer position but may shift to provider status when they fine-tune.
- Providers of GPAI models must maintain and share a technical documentation summary covering training data, capabilities, and known limitations—including a copyright compliance summary for training data.
- Models deemed to present systemic risk (broadly, those trained above a compute threshold of 10²⁵ FLOPs) face additional obligations: adversarial testing, incident reporting, and cybersecurity measures.
- Deployers in fashion are not passive: they inherit residual transparency duties and must ensure their use of a GPAI model does not create a high-risk AI system without the corresponding conformity assessment.
- The regulatory timeline has shifted; fashion AI teams should treat current deadlines as a floor for preparation, not a ceiling.
What Is a General-Purpose AI Model Under the EU AI Act?
The Act defines a general-purpose AI model as an AI model trained on large amounts of data using self-supervision at scale, capable of serving a wide range of tasks, and made available to third parties. The definition is deliberately broad. It captures the foundation models that fashion brands access today through enterprise cloud platforms—GPT-4-class models, multimodal vision-language models, and large embedding models used for semantic search across product catalogues.
Crucially, the definition attaches to the model, not the application built on top of it. A fashion brand that deploys Azure OpenAI to generate product descriptions is a deployer of a GPAI model. The model provider—Microsoft, in this case, offering cloud-hosted access to OpenAI foundation models through Azure—bears the primary Title VIII obligations. The deployer, however, is not exempt.
Provider vs. Deployer: Why the Distinction Matters for Fashion
The Act draws a hard line between the entity that places a GPAI model on the market or puts it into service (the provider) and the entity that uses it under its own authority for a specific purpose (the deployer). For most fashion brands, the default position is deployer. You call an API; the model provider is responsible for the model card, the copyright summary, and the systemic risk assessment.
That position changes the moment you fine-tune. If a brand takes a base foundation model and fine-tunes it on proprietary design briefs, historical tech packs, or supplier correspondence, the Act's recitals suggest the fine-tuning entity may assume provider obligations for the resulting model variant. The boundary is not yet settled in guidance, but the risk is real and legal teams should document the architecture of any fine-tuning pipeline before it goes to production.
Organisations using Databricks to orchestrate fine-tuning runs on proprietary fashion data—fabric classifications, SKU hierarchies, grading rules—should treat that workflow as a potential provider-status trigger and seek legal review accordingly.
The Core Transparency Obligations for GPAI Model Providers
Technical Documentation and the Model Card Requirement
Providers must draw up and maintain technical documentation before placing a GPAI model on the market. The documentation must be sufficient to allow downstream providers and deployers to understand the model's capabilities and limitations. The Act specifies minimum content: a general description of the model, its intended tasks, the training methodology, and the compute resources used.
For fashion deployers, the practical implication is that you should be able to obtain—and retain—a version of this documentation for every foundation model you integrate. If a vendor cannot supply it, that is itself a compliance signal.
Copyright Compliance Summaries
This is the provision that has attracted the most attention in creative industries. GPAI model providers must make publicly available a sufficiently detailed summary of the content used to train the model, in accordance with a template the EU AI Office is developing. The intent is to allow rightsholders to assess whether their works were included in training data and to exercise opt-out rights under the EU's text and data mining exceptions.
For fashion brands, this matters in two directions. First, if your brand's design archives, runway imagery, or pattern libraries were scraped without consent, the copyright summary mechanism is the instrument through which you may eventually identify and contest that. Second, if you are generating commercial outputs—marketing copy, product imagery prompts, design variations—using a model trained on contested data, you carry downstream exposure until the provider's summary is published and reviewed.
The EU AI Office has indicated that templates for these summaries are part of the codes of practice being developed with model providers. As of the time of writing, those codes remain in draft.
Capability Evaluations
Providers must evaluate GPAI models before release, including adversarial testing where appropriate, to identify and mitigate foreseeable risks. The evaluation must cover the model's performance across the range of tasks it is reasonably foreseeable it will be used for.
For a fashion deployer, this means you should review whatever evaluation documentation your model provider publishes—benchmark results, red-teaming summaries, known failure modes—and assess whether those evaluations cover the specific tasks you are deploying the model for. A model evaluated primarily for general-purpose text generation may have undocumented failure modes when applied to structured fashion data: size specifications, colour codes, material composition strings.
Systemic Risk: The Higher Tier
The Act creates a separate, more demanding regime for GPAI models that present systemic risk. The threshold is defined by training compute: models trained using more than 10²⁵ floating-point operations are presumed to present systemic risk. The largest frontier models currently available through enterprise APIs—including those accessible via Azure OpenAI—fall into this category.
For providers of systemic-risk models, the obligations extend to:
- Adversarial testing: model-level red-teaming conducted by qualified independent experts.
- Incident reporting: serious incidents and corrective measures must be reported to the EU AI Office.
- Cybersecurity: appropriate technical and organisational measures to protect the model weights, training infrastructure, and access controls.
- Model evaluations: ongoing post-market monitoring, not just pre-release assessment.
Fashion deployers using systemic-risk models inherit a practical obligation: you must be able to demonstrate, if asked, that you understood the systemic-risk classification of the models you integrated and that your deployment does not amplify those risks in ways the provider's safeguards do not address.
How Deployer Obligations Interact with High-Risk AI System Rules
Title VIII obligations for GPAI models sit alongside—not instead of—the high-risk AI system rules in Title III. A GPAI model integrated into a system that makes or materially influences decisions about workers (scheduling, performance assessment, hiring) may trigger high-risk classification under Annex III, regardless of the model's own GPAI status.
Fashion brands that use foundation models in HR-adjacent contexts—workforce planning tools, automated shift allocation, performance analytics—should conduct a use-case-level risk classification before deployment. The Taylor Wessing analysis of the AI Act's application to fashion notes that most fashion AI applications currently fall outside the high-risk categories, but that the boundary depends heavily on how a system is scoped and documented.
The Regulatory Timeline: What Has Changed
The Act's GPAI provisions entered into force on a phased schedule. Compliance timelines have been subject to revision; Morgan Lewis reported in June 2026 that adjustments to certain deadlines have been made, and that organisations should treat any additional time as preparation runway rather than a signal that enforcement is distant. The EU AI Office's codes of practice for GPAI models—which will operationalise many of the documentation and evaluation requirements—are the instrument to watch.
Fashion AI teams should maintain a live register of every GPAI model in production use, updated as providers publish new documentation, evaluation results, or systemic-risk designations.
What Is Still Unsettled
Several questions remain genuinely open and are worth naming explicitly:
Fine-tuning thresholds. The Act does not specify a compute or parameter threshold below which fine-tuning does not trigger provider status. Guidance from the EU AI Office is expected but not yet published.
Copyright summary templates. The templates that GPAI providers must use for training-data summaries are being developed through the codes of practice process. Until they are finalised, deployers cannot fully assess the adequacy of what providers publish.
Interaction with the Digital Product Passport. The EU's textile strategy is developing Digital Product Passport requirements that will require machine-readable product data. Where AI systems generate or validate that data, the intersection with GPAI transparency obligations is not yet mapped in guidance.
Territorial scope for non-EU providers. The Act applies when a GPAI model is placed on the EU market or its outputs are used in the EU. How enforcement will reach non-EU providers who do not have an EU legal representative established is an open procedural question.
Definitions in practice. As a LinkedIn commentary on AI Act definitions noted in August 2026, the practical application of the Act's definitions to fashion and e-commerce contexts is still being worked through by practitioners, and the gap between legal text and operational guidance remains wide.
A Practical Checklist for Fashion AI and Legal Teams
- Map your GPAI model inventory. List every foundation model your organisation calls via API or runs internally. Record the provider, the version, and the primary use cases.
- Classify your position. For each model, determine whether your organisation is a deployer or whether fine-tuning or significant adaptation shifts you toward provider status.
- Request and retain provider documentation. Ask your model vendors for their technical documentation summaries and capability evaluation reports. File them with version numbers.
- Assess systemic-risk exposure. Identify which models in your stack are classified as systemic-risk models and document how your deployment addresses the additional obligations that classification implies.
- Conduct use-case risk classification. For each AI-assisted workflow, assess whether the application—not just the model—falls into a high-risk category under Annex III.
- Monitor the codes of practice. Subscribe to EU AI Office publications. The codes of practice for GPAI models will operationalise obligations that are currently stated at a high level of abstraction.
- Review HR-adjacent deployments separately. Any use of a GPAI model in workforce-related decision support warrants a standalone compliance review given the high-risk classification rules.
FAQ
What is a general-purpose AI model under the EU AI Act? A model trained at scale on broad data, capable of a wide range of tasks, and made available to third parties. Large language models and multimodal foundation models accessed via enterprise APIs typically meet this definition.
Does a fashion brand that only calls an API count as a provider? Generally no—API users are deployers, not providers. The provider is the entity that trained or fine-tuned the model and placed it on the market. Fine-tuning by the brand may change that analysis.
What is the systemic risk threshold and does it affect fashion deployers? The threshold is 10²⁵ FLOPs of training compute. Frontier models from major providers exceed it. Deployers using those models must understand the classification and ensure their use does not introduce additional unaddressed risks.
What is a copyright compliance summary and when must it be published? It is a structured summary of the data used to train a GPAI model, intended to help rightsholders identify whether their works were included. Templates are being finalised through the EU AI Office's codes of practice; exact publication timelines depend on that process.
Does the EU AI Act apply to fashion brands outside the EU? The Act applies when outputs of a GPAI model are used in the EU or a model is placed on the EU market. Brands selling to EU consumers should assume territorial scope applies to their AI-assisted workflows.
What happens if a deployer cannot obtain technical documentation from a provider? The inability to obtain documentation is itself a compliance risk indicator. Deployers should document their requests and responses, and consider whether to continue using a model whose provider cannot meet basic transparency obligations.
How does the GPAI regime interact with the Digital Product Passport? The intersection is not yet mapped in official guidance. Where AI systems generate or validate product passport data, teams should monitor both regulatory tracks and seek legal advice on how obligations may compound.
Further Reading
- Fashion meets the AI Act — Taylor Wessing sector focus
- Changes to EU AI Act Deadlines — Morgan Lewis
- AI Act definitions in fashion and e-commerce contexts — LinkedIn