Foundation Model / GPAI Model

Why It Matters

Foundation models represent the most significant concentration risk in the history of enterprise technology. A handful of models — GPT-4, Claude, Gemini, Llama — from a handful of providers underpin thousands of applications across every industry. When one of these models changes behaviour, degrades in quality, or experiences an outage, every downstream system is affected simultaneously. This is not a vendor dependency problem. It is an infrastructure dependency problem, analogous to the internet backbone or the global financial payments system.

The EU AI Act recognised this systemic risk by creating a dedicated regulatory framework for general-purpose AI models (Art. 51–56). All GPAI model providers must comply with transparency obligations: technical documentation, copyright law compliance, and a sufficiently detailed summary of training data content. Models classified as posing “systemic risk” — currently defined by a 10^25 FLOPs training compute threshold — face additional obligations including adversarial testing, incident tracking and reporting, cybersecurity protections, and energy consumption disclosure.

For enterprises, the challenge is that you are legally responsible for systems built on foundation models, but you have limited visibility into and no control over the foundation model itself. Your vendor can change the model version, modify safety filters, adjust pricing, or deprecate the model entirely. Your governance framework must account for this dependency without relying on the assumption that the vendor’s governance is sufficient.

The Stress Test

Your organisation has built seven production applications on a single foundation model provider’s API. The provider announces a model deprecation with 90 days notice. Three of your applications require the deprecated model’s specific capabilities for accuracy. Your evaluation tests show the replacement model performs 12% worse on your domain-specific benchmarks. Your contracts with customers guarantee a performance SLA based on the deprecated model’s outputs.

You have 90 days to migrate seven systems, re-evaluate all performance benchmarks, update all governance documentation, retrain your users, and renegotiate customer SLAs — or find an alternative provider, port your RAG pipelines, re-embed your vector databases, and re-evaluate everything from scratch. Your AI strategy was built on a single foundation model. Your business continuity plan did not include a foundation model exit strategy. Most do not.

In the Wild

How to Govern It

You cannot control the foundation model. You can govern your dependency on it.

Within the AI Control Index, foundation model governance spans multiple layers and shields:

• Supply Chain (S3) — The primary control layer. Foundation model dependency requires: vendor due diligence (provider’s EU AI Act compliance status, GPAI Code of Practice adherence), contractual provisions (version change notification, performance stability commitments, exit terms), and multi-provider strategy (portability assessment, fallback provider evaluation, abstraction layers).
• AI Engineering (L5) — Continuous evaluation against foundation model version changes. When the vendor updates the model, your evaluation pipeline must re-run automatically. Model-agnostic evaluation benchmarks that test your application’s requirements, not the model’s general capabilities.
• GRC (S1) — AI Actor Classification: your role relative to the foundation model provider (deployer, downstream provider, or re-provider if you fine-tune). Evidence Factory captures vendor due diligence, evaluation results, and classification decisions as governance artifacts.
• Observability (S4) — Runtime monitoring for model behaviour changes: output quality metrics, response pattern analysis, and anomaly detection that flags when the model behind the API behaves differently from the validated version.
• Applications & Agents (L4) — Abstraction layers between your application and the foundation model. Provider-agnostic interfaces that allow model switching without application re-engineering. Circuit breakers that activate when model behaviour deviates beyond acceptable bounds.

When It’s Relevant

Every organisation that uses, integrates, fine-tunes, or depends on a foundation model — whether through direct API access, embedded in a third-party product, or through open-source model deployment. Foundation model governance is not limited to organisations that interact with the provider directly; it extends to anyone in the dependency chain.

Foundation model governance is critical when:

• Your business-critical applications depend on a single foundation model provider
• You need to comply with the EU AI Act and must understand your role relative to the GPAI model provider
• Your vendor has a history of silent model updates that affect downstream behaviour
• You are building a multi-year AI strategy and need to assess concentration risk
• You fine-tune a foundation model and need to determine whether this changes your regulatory classification

Related Terms