Introduction
The smallest of the four packs: five controls addressing the parts of the EU AI Act that show up in traffic. It is also the pack most likely to be misread, because the Act is a law and a pack of five checks looks like a compliance answer. It is not one, and this page is direct about why.
Where to find it
AI Governance > Policies > System Policies > EU AI Act GPAI.
The five controls
Control | Check | Applied on | Action |
Block destructive booking actions |
| Tool name | Block |
Flag model or version drift |
| Tool output | Flag |
Disclose AI-generated content to end users |
| Agent output | Flag |
Flag disparate outcome patterns |
| Agent output | Flag |
Block production PII from training/fine-tuning pipelines |
| Tool input | Block |
Note: Packs are maintained content, not fixed product surface. The list above was read from the product and may change as the pack is updated. The pack's own
Controlstab is always the current list.
The transparency control is the one doing real regulatory work
Disclose AI-generated content to end users is the only control in any of the four packs that maps to a specific, unambiguous statutory duty rather than to good practice.
The Act's transparency provisions require people to be told when they are interacting with an AI system and when content has been artificially generated. That is a rule about what reaches the user, which is precisely the kind of thing a check on Agent output can observe.
It is worth noticing that it is set to Flag rather than Block. Blocking undisclosed output would be technically possible and operationally severe; flagging tells you where disclosure is missing so you can fix the agent's instructions, which is the actual remedy.
What five controls cannot do — and this is most of the Act
The EU AI Act's obligations are overwhelmingly about documentation, assessment and process. Almost none of them are observable in a request.
Obligation | Pack contributes? |
Transparency to users | Yes — directly |
Post-market monitoring | Partly — incidents and telemetry are inputs to it |
Record-keeping and logging | Partly — incident records are durable evidence |
Risk management system | No |
Data and data governance | No |
Technical documentation | No |
Human oversight design | No |
Accuracy, robustness, cybersecurity | No — these are system properties, not checks |
Conformity assessment | No |
Registration and CE marking | No |
"One of ten obligations is met directly. Anyone reporting that the EU AI Act pack is enabled, and stopping there, has answered a question nobody asked."
"GPAI" is a scope, and it may not be yours
The pack is named for the Act's general-purpose AI model chapter, which imposes obligations on providers of GPAI models — organisations that develop and place such models on the market.
Most organisations using this product are not GPAI providers. If you build agents on models somebody else trained, the GPAI obligations sit with that model provider, and your obligations arrive through a different route — most often as a deployer of an AI system, and potentially a high-risk one depending on what the agent does.
That does not make the pack useless to you. Its controls are sensible regardless of which role you hold. It does mean adopting it is not evidence that you have met your own obligations, because it is built around obligations that may not be yours. Establish your role first — see Roles & Responsibilities.
Four of the five are shared
Only Block destructive booking actions is unique to this pack — and it is the most domain-specific control in any of them, written around a travel-booking scenario. Treat it as a worked example of a blocked-tools control rather than as a general requirement; if your agents do not book anything, it will never fire and you should replace it with the equivalent for whatever irreversible action your agents can take.
Adopting it
Establish your role under the Act first — Provider, deployer, importer, distributor. The pack's relevance depends entirely on the answer, and it is a legal question rather than a product one.
Keep the disclosure control, whatever your role — Transparency duties reach almost everyone deploying a user-facing assistant.
Replace the booking control with your own irreversible actions — Payments, deletions, submissions, notifications to third parties — whatever your agents can do that cannot be undone.
Do not report the pack as compliance — Report it as one operational control set among the documentation and assessment work the Act actually requires.
Operationalizing the EU AI Act
EU AI Act Overview
General-Purpose AI Models
Common Misreadings
Operationalizing in UnifyApps
Related
EU AI Act vs GDPR / DPDP