Foundation model

In plain English

A foundation is not a house; it is what many different houses are built on. A foundation model is trained once, at great cost, on huge and varied data. Many organizations then adapt it into chatbots, coding tools or document readers.

The term was coined in a 2021 Stanford paper by Bommasani and colleagues. It describes models trained on broad data at scale that can be adapted to a wide range of downstream tasks. The authors chose the name to stress that these models are central to many systems, yet incomplete on their own.

Example

Corvid Labs, a fictional company, trains a large multimodal model and licenses it to EU businesses through an API. Three customers build on it.

• A bank builds an internal policy assistant using retrieval-augmented generation. The model itself is unchanged, so the bank has no model duties. Its assistant is classified by use.
• A legal-tech start-up fine-tunes the model for contract review. Under Commission guidelines, it becomes provider of the modified model only if the fine-tuning uses more than a third of the original training compute.
• An HR vendor builds a candidate-ranking tool. That is a high-risk system under Annex III, and the vendor is its provider.

Corvid, as model provider, owes the Art. 53 duties. If its training compute exceeded 10²⁵ FLOP, it would also owe the Art. 55 systemic-risk duties.

Why it matters

EU AI Act. Older study guides and AI Act drafts spoke of foundation models. The final AI Act uses "general-purpose AI model" (Art. 3(63)). Its definition mentions models trained with a large amount of data using self-supervision at scale. Commission guidelines give an indicative test: training compute above 10²³ FLOP plus the ability to generate language, images or video. See general-purpose AI model for the full duties.

NIST. The Generative AI Profile says that, for its purposes, generative AI generally refers to generative foundation models.

California. SB 53 has applied since 1 Jan 2026. It defines a frontier model as a foundation model trained with more than 10²⁶ operations (California Department of Technology).

Supply chain. Your vendor may build on someone else's foundation model, making that company a fourth party. Due diligence should map that layer.

How the AIGP exam tests it

Foundation models are introduced in lesson I.A.1. Their EU rules sit in lesson II.C.8.

Common traps:

• Old vocabulary. Expect "GPAI model" in EU questions. "Foundation models are regulated only inside high-risk systems" is a stale claim; GPAI duties have applied since 2 Aug 2025.
• Model vs system. A customer using a foundation model for hiring makes the hiring system high-risk, not the model.
• Wrong threshold. 10²⁵ FLOP is the EU systemic-risk presumption. 10²⁶ operations is California's frontier line.
• Every adapter is a provider. Only a modification above a third of the original compute makes a downstream modifier the model's provider.

The tell: ask whether the question is about the model or the product built on it.