LLM API Provider (GPAI)

1. What counts as “sufficient detail” in technical documentation

Art. 53(1)(a) requires technical documentation, but the Act does not specify a precise format or minimum content standard for standard GPAI providers (unlike the detailed Annex IV template applicable to high-risk systems). NeuralAPI's legal team reviewed the AI Office's draft guidance and the GPAI Code of Practice documentation templates to calibrate the expected level of detail. The key tension was between regulatory sufficiency and competitive sensitivity: disclosing too much about training data composition or model architecture could disadvantage NeuralAPI commercially. The final 67-page technical file was designed to fully satisfy the regulatory floor while limiting disclosure of genuinely proprietary methodology.

2. Retroactive copyright compliance for training data

The EU's DSM Directive (Art. 4) allows text and data mining for commercial purposes unless rightholders have expressly reserved this right. Implementing a robust TDM opt-out detection process retroactively — after the model had already been trained — raised difficult questions. NeuralAPI could not un-train on data that had been ingested, but it could: (1) document its good-faith crawl practices at the time of training, (2) publish a clear policy for future training runs, and (3) remove datasets from the documented training corpus where licensing was unclear. Three third-party datasets were removed from the training data summary after the licensing review found terms inconsistent with commercial TDM use.

3. Downstream provider information — defining the compliance split

Art. 53(1)(b) requires GPAI providers to give downstream providers the information they need to meet their own EU AI Act obligations. For NeuralAPI, this meant understanding what its 2,000+ API customers were building — and what compliance information they might need. NeuralAPI could not perform due diligence on every downstream use case. Its solution was a layered information approach: a public model card covering general capabilities and limitations; a developer documentation section on common application types and their compliance implications; and a dedicated enterprise compliance pack for customers building systems that might themselves be high-risk under Annex III.

4. Swiss incorporation — confirming the EU AI Act applies

NeuralAPI is incorporated in Switzerland, which is outside the EU. However, the EU AI Act applies to providers who place AI systems on the EU market or put them into service in the EU — regardless of where the provider is established (Art. 2(1)(c)). With 2,000+ EU developer customers actively using the API to build EU-market products, there was no credible argument that NeuralAPI was outside the Act's scope. NeuralAPI appointed an EU AI Act authorised representative based in Brussels, as required by Art. 54 for non-EU providers.