GPAI in banks and insurers: When does general-purpose AI become a compliance topic?

What does GPAI mean?

GPAI models are AI models that can be used for a broad range of tasks. Providers such as OpenAI, Microsoft, Anthropic, Google, Mistral or Meta may be subject to provider obligations under Art. 53 to 56 EU AI Act. Financial institutions are typically users or deployers of AI systems and services built on such models.

What do financial institutions typically use GPAI for?

Text analysis, summaries, documentation and coding, via ChatGPT, Microsoft Copilot, Claude/Gemini, GitHub Copilot or local LLMs.

The services in the table are illustrative examples; what matters is the product variant actually licensed, the model version and the contractually agreed data processing.

Which governance duties do institutions have for GPAI?

Inventory, documentation, GDPR roles and DPA, AI literacy under Art. 4, provider due diligence under DORA and limiting shadow GPAI.

• include GPAI services and API uses in the AI inventory
• document purposes, data categories and responsible owners
• review GDPR roles, data processing agreements and third-country transfers
• take appropriate measures to support the development of AI literacy among relevant staff (Art. 4 EU AI Act as amended by the Digital Omnibus: measures are required, not a guaranteed individual level of literacy) and document them as a governance good practice
• provider due diligence: Code of Practice status, documentation and security evidence; manage ICT and cyber risks from frontier models under DORA (see the joint EBA/EIOPA/ESMA statement of 31 July 2026)
• limit shadow GPAI through technical and organisational controls

How do model, service and legacy model differ?

GPAI model providers (Art. 53 et seq.) and deployers of an application built on the model are separate roles: model providers do not carry all usage risks, and the institution does not inherit the model provider obligations. GPAI models placed on the market before 2 August 2025 only have to meet the provider obligations by 2 August 2027 (Art. 111(3)). Supplier questions should therefore record model and model version, the date of placing on the market, available documentation and the service actually used separately.

When does the institution become a provider itself?

Art. 25(1) EU AI Act shifts provider obligations to the institution only in three high-risk constellations: its own name or trademark on a high-risk AI system already placed on the market, a substantial modification of a high-risk AI system, or a change of intended purpose that turns an AI system (including a GPAI system) into a high-risk system. This is distinct from the general provider definition in Art. 3(3) and from the GPAI model provider role under Art. 53 et seq. Fine-tuning, RAG and own AI applications do not automatically trigger provider duties, but should be assessed for purpose change, high-risk use and external effect.

What does the GPAI Code of Practice cover?

The GPAI Code of Practice, published by the European Commission on 10 July 2025, is a voluntary tool for GPAI model providers to demonstrate compliance with transparency, copyright and, for systemic-risk models, safety and security requirements. For institutions, signature and evidence status is a due-diligence signal, but it does not replace their own assessment.

In addition, on 10 June 2026 the European Commission finalised the Code of Practice on Transparency of AI-generated Content; by the end of July 2026 around 190 companies and organisations had signed. It gives practical shape to the Art. 50 marking and labelling duties that have applied since 2 August 2026 and is relevant for institutions using generative services in customer contact or for published content. The Commission's final guidelines on Art. 50 (20 July 2026) allocate the duties by role: providers design the interaction notice and the machine-readable marking, deployers label deepfakes and published AI-generated text on matters of public interest. The optional EU icons for labelling AI-generated content, available since September 2026, do not replace the assessment of the legal duty itself.

Which GPAI questions should the board ask?

Five questions on approval, data input, Code of Practice evidence, labelling under Art. 50 and purpose changes through RAG or fine-tuning.

• Which GPAI services are officially approved, and which are used in practice?
• May personal data, customer data or confidential documents be entered?
• Which providers have signed the GPAI Code of Practice or provide alternative evidence?
• Which generative services produce externally visible content, and is Art. 50 labelling ensured – for example through the provider's transparency Code of Practice commitments?
• Which RAG or fine-tuning applications change the purpose of a system?