Foundation Models / GPAI

Definition and scope

Obligations specific to general-purpose / foundation models above certain capability thresholds.

The cross-jurisdiction picture below shows how each of 29 tracked instruments treats this topic. The patterns vary substantially — and 6 regimes are silent, leaving gaps that future policy work could address.

Historical primacy & cross-jurisdiction tension

First addressed by OECD AI Principles (Recommendation) on 2019-05-22 (implicit). Subsequent regimes have either codified, diverged from, or remained silent on this baseline.

• Forum-shoppingEU AI Act↔Executive Order 14179 — Removing Barriers to American Leadership in AI
• Forum-shoppingExecutive Order 14110 on Safe, Secure, Trustworthy AI↔UN GA Resolution on Safe, Secure, Trustworthy AI
• Forum-shoppingInterim Measures for Generative AI Service Management↔African Union Continental AI Strategy

Cross-jurisdiction coverage

Silent regimes — gap signal

Instruments that do not address Foundation Models / GPAI — candidates for future policy work.

• Executive Order 14179 — Removing Barriers to American Leadership in AIUS
• UN GA Resolution on Safe, Secure, Trustworthy AIUN
• African Union Continental AI StrategyAfrican_Union
• NYC Local Law 144 of 2021 (Automated Employment Decision Tools)US
• Colorado Artificial Intelligence Act (SB 24-205)US
• Illinois HB 3773 / Public Act 103-0804 (AI Employment Discrimination)US

Related enforcement cases

Documented enforcement actions where regulators invoked a rule against a deploying organisation, with the primary-source case record and the lesson the field has drawn from each.

• FTC investigation of OpenAIUS · 2023 · ongoing
  Federal Trade Commission v. OpenAI — Civil Investigative Demand alleging consumer-protection violations: misleading claims about ChatGPT capabilities, training-data privacy, and consumer harm from hallucinations.
  Lesson: First US federal enforcement action against a frontier-AI developer. Establishes that pre-AI-statute consumer-protection authority (FTC §5) can be applied to AI services — supports the US 'sectoral / ex-post liability' regime (vs EU's ex-ante AIA). Action remains pending; no judgment yet.
  Source record →news secondary
• New York Times v. OpenAI + MicrosoftUS · 2023 · ongoing
  New York Times Company (private civil litigation) v. OpenAI Inc. + Microsoft Corp. — Unauthorised reproduction of NYT-copyrighted articles in GPT training corpora; output of substantially similar text on prompted query; removal of copyright-management information.
  Lesson: First major frontier-foundation-model copyright lawsuit by a primary news source. Discovery has surfaced disclosure of training-data composition that the EU AIA Art. 53 transparency requirements would have surfaced ex-ante. The case is the highest-stakes ex-post-liability action testing whether US sectoral approach can substitute for ex-ante regulation on training-data rights — outcome will inform 2025-2027 regulatory debates.
  Source record →
• CAC Doubao deep-synthesis enforcementCN · 2024–2024
  Cyberspace Administration of China (CAC) v. ByteDance (Doubao) — Doubao deployed deepfake-generation feature without prior CAC algorithm registration; failed to embed mandatory deep-synthesis content-provenance label per Deep Synthesis Provisions Art. 16. CAC requested feature removal pending registration.
  Lesson: First named CN-GENAI-2023 enforcement against a frontier-tier Chinese AI developer. Demonstrates: (1) CN registration regime applies pre-deployment + has bite even against domestic champions; (2) cross-instrument enforcement (GenAI rules + Deep Synthesis rules) is operative; (3) remediation is rapid (weeks not years) but private — no consent decree text published.
  Source record →
• EDPB ChatGPT TaskforceEU · 2023–2024
  European Data Protection Board (EDPB) — coordinated DPA action v. OpenAI — Italian Garante temporarily banned ChatGPT (Mar-Apr 2023) over alleged lack of legal basis for training-data processing, missing age-verification, and inability to honour data-subject rights. EDPB convened taskforce to coordinate DPA responses.
  Lesson: First EU-wide AI enforcement coordination predating the EU AIA. Established that GDPR applies fully to LLM training + deployment + that DPAs would coordinate via EDPB rather than fragment. ChatGPT resumed Italian service after age-verification + Article-15 right-of-access endpoint additions. Direct precedent for EU AIA Art. 53 implementation timeline.
  Source record →
• MEITY deepfake takedown advisoriesIN · 2023–2024
  Ministry of Electronics and Information Technology (MEITY) v. Multiple intermediaries — Meta, YouTube/Google, X, several Indian social platforms — Failure to take down political deepfake content within statutory windows (36 hours under IT Rules 2021). MEITY's Mar-2024 advisory additionally required pre-deployment-approval for AI models above unspecified capability thresholds; rescinded Apr-2024 after frontier-lab pushback.
  Lesson: India's compressed legislative cycle: a sweeping pre-deployment-approval requirement (closer to CN registration than US sectoral) was rescinded within 5 weeks after industry + civil-society pushback. Demonstrates that Global South AI regulation is in active design AND that even nationally-coercive states face frontier-lab leverage. Indian regulatory approach now favours post-deployment incident reporting + IT-Rules takedown.
  Source record →

Related debates — rival interpretations & counterevidence

Structured controversies where this topic is the locus of disagreement. Each debate page lays out the competing positions with primary-source citations for each side.

• Open-Source vs Closed-Source Frontier Models — Should the most-capable AI models be released under permissive licenses (open weights), or only via API / structured-access agreements? The dispute is foundational to nearly every frontier-AI governance instrument.
• Pause AI vs Accelerate Capabilities — Should the global community impose temporary or capability-conditional pauses on frontier-AI development, or should development accelerate with safety work conducted in parallel?
• Pre-Deployment Red-Team vs Post-Deployment Audit — Should AI capability + safety evaluations happen primarily before deployment (red-team gating release), or primarily after (post-deployment audit + incident response)?
• Risk-Based vs Principles-Based vs Ex-Post Liability Regimes — Should AI governance work via (a) risk-based ex-ante categorisation + obligations (EU), (b) high-level principles delegated to sector regulators (UK / OECD / G7), or (c) ex-post liability + civil litigation (US sectoral)?
• Compute vs Behavioural Capability Thresholds — Should the regulatory trigger for 'frontier' / 'foundation' / 'systemic-risk' status be training-compute thresholds (objective + ex-ante observable), or behavioural-capability evaluation (more semantically meaningful but operationally costly)?

Related topics

Topics with similar coverage patterns across the tracked instruments.

• Transparency Obligations
• Catastrophic & Existential Risk
• Agentic AI Governance
• Individual Redress
• International Coordination