Upstream, downstream, and in between: navigating the GPAI value chain under EU law

This article examines how responsibility and liability are allocated across the general-purpose AI (GPAI) value chain under EU law. Recognising the fluid and dynamic nature of this value chain, we analyse the obligations imposed on upstream and downstream providers in the AI Act, as well as in complementary instruments such as the GPAI Code of Practice and the European Commission’s Guidelines on the scope of the obligations for GPAI models. Our paper identifies gaps in these instruments and explores how they intersect with obligations under the General Product Safety Regulation (GPSR) and the new Product Liability Directive (PLD). The article also considers key aspects of model deployment and distribution under the Digital Services Act (DSA), particularly in relation to GPAI marketplaces and very large online platforms (VLOPs). It highlights the central role of cooperation duties in effective risk mitigation, while emphasising the asymmetries of power and information that may hinder such cooperation. Against this background, the article assesses where responsibility is most appropriately allocated along the GPAI value chain.