Annex XI: Technical Documentation for Providers of General-Purpose AI Models

Annex XI is the checklist behind Article 53(1)(a): it converts the abstract "draw up technical documentation" duty into concrete headings every GPAI model provider must fill. Think of it as the Annex IV equivalent for GPAI models (Annex IV covers high-risk AI systems under Article 11; Annex XI covers GPAI models under Article 53).

The annex has two sections:

• Section 1 — baseline documentation for every GPAI model provider, scaled to model size and risk.
• Section 2 — additional documentation only for GPAI models designated with systemic risk under Article 51.

Point 1: General description of the GPAI model including:

• (a) Tasks the model is intended to perform and the type and nature of AI systems it can be integrated into
• (b) Applicable acceptable use policies
• (c) Date of release and methods of distribution
• (d) Architecture and number of parameters
• (e) Modality (e.g. text, image) and format of inputs and outputs
• (f) The licence

Point 2: Detailed description of the development process including:

• (a) Technical means (e.g. instructions, infrastructure, tools) required for integration into AI systems
• (b) Design specifications and training process: methodologies, techniques, key design choices, rationale, assumptions, optimisation targets, and parameter relevance
• (c) Data used for training, testing, and validation (where applicable): type, provenance, curation methodologies (cleaning, filtering, etc.), number of data points, scope, main characteristics, sourcing and selection methods, and measures to detect unsuitability and identifiable biases
• (d) Computational resources used to train the model (e.g. number of floating-point operations), training time, and other relevant training details
• (e) Known or estimated energy consumption of the model (where unknown, may be based on information about computational resources used)

All Section 1 information must be appropriate to the size and risk profile of the model—proportionality is built into the text.

GPAI models designated with systemic risk under Article 51 must also provide:

1. A detailed description of evaluation strategies, including evaluation results, based on available public evaluation protocols and tools or other evaluation methodologies. Evaluation strategies shall include evaluation criteria, metrics, and the methodology for identification of limitations. 2. Where applicable, a detailed description of measures for internal and/or external adversarial testing (e.g. red teaming), model adaptations including alignment and fine-tuning. 3. Where applicable, a detailed description of the system architecture explaining how software components build or feed into each other and integrate into overall processing.

Section 2 is in addition to Section 1—systemic-risk providers must satisfy both sections.

• Article 53(1)(a) — The direct legal hook: providers must prepare documentation "as referred to in Annex XI."
• Article 51 — Systemic risk classification triggers Section 2 extras.
• Article 52 — Procedure for systemic-risk designation; once designated, Section 2 kicks in.
• Article 55 — Systemic-risk obligations reference the evaluation and adversarial testing artefacts that Section 2 documents.
• Article 56 — Codes of practice can inform how evaluation strategies and metrics in Section 2 are shaped.
• Article 54 — Authorised representatives may hold and transmit Annex XI documentation on behalf of third-country providers.
• Annex XII — Transparency information that GPAI providers must make publicly available (complementary to the private-facing Annex XI file).
• Annex XIII — Systemic risk criteria (the thresholds that determine whether Section 2 applies).
• Annex IV — Technical documentation for high-risk AI systems (the Annex XI counterpart under Article 11; do not confuse the two—Annex IV covers downstream AI systems, Annex XI covers upstream GPAI models).
• Article 113 — Application dates (Chapter V applied from 2 August 2025; transitional rules for existing models until 2 August 2026).

Teams sometimes confuse Annex XI and Annex IV. The distinction:

• Annex IV → documentation for high-risk AI systems (the downstream product or application), required by Article 11.
• Annex XI → documentation for GPAI models (the upstream model), required by Article 53(1)(a).

If your GPAI model is integrated into a high-risk system, both annexes may need to be satisfied—Annex XI by the GPAI provider, and Annex IV by the high-risk system provider. The downstream provider relies on Article 53(1)(b) information from the GPAI provider to populate parts of their Annex IV file.

Editorial note: The following reproduces Annex XI Section 1 from the English consolidated text of Regulation (EU) 2024/1689. Section 2 (systemic risk extras) and the energy-consumption clarification note appear in full on EUR-Lex Annex XI. Always re-open EUR-Lex before compliance decisions.

Section 1

*Information to be provided by all providers of general-purpose AI models*

The technical documentation referred to in Article 53(1), point (a) shall contain at least the following information as appropriate to the size and risk profile of the model:

1. A general description of the general-purpose AI model including:

(a) the tasks that the model is intended to perform and the type and nature of AI systems in which it can be integrated;

(b) the acceptable use policies applicable;

(c) the date of release and methods of distribution;

(d) the architecture and number of parameters;

(e) the modality (e.g. text, image) and format of inputs and outputs;

(f) the licence.

2. A detailed description of the elements of the model referred to in point 1, and relevant information of the process for the development, including the following elements:

(a) the technical means (e.g. instructions of use, infrastructure, tools) required for the general-purpose AI model to be integrated in AI systems;

(b) the design specifications of the model and training process, including training methodologies and techniques, the key design choices including the rationale and assumptions made; what the model is designed to optimise for and the relevance of the different parameters, as applicable;

(c) information on the data used for training, testing and validation, where applicable, including the type and provenance of data and curation methodologies (e.g. cleaning, filtering, etc.), the number of data points, their scope and main characteristics; how the data was obtained and selected as well as all other measures to detect the unsuitability of data sources and methods to detect identifiable biases, where applicable;

(d) the computational resources used to train the model (e.g. number of floating-point operations), training time, and other relevant details related to the training;

(e) known or estimated energy consumption of the model.

With regard to point (e), where the energy consumption of the model is unknown, the energy consumption may be based on information about computational resources used.

Section 2

*Additional information to be provided by providers of general-purpose AI models with systemic risk*

1. A detailed description of the evaluation strategies, including evaluation results, on the basis of available public evaluation protocols and tools or otherwise of other evaluation methodologies. Evaluation strategies shall include evaluation criteria, metrics and the methodology on the identification of limitations.

2. Where applicable, a detailed description of the measures put in place for the purpose of conducting internal and/or external adversarial testing (e.g. red teaming), model adaptations, including alignment and fine-tuning.

3. Where applicable, a detailed description of the system architecture explaining how software components build or feed into each other and integrate into the overall processing.

Source: EUR-Lex Annex XI.

The recitals in the same consolidated AI Act on EUR-Lex contextualise GPAI documentation, proportionality ("appropriate to the size and risk profile"), transparency, and systemic-risk evaluation. Use the official preamble on EUR-Lex—do not rely on unofficial recital lists without checking sequence and wording against the authentic text.