GPAI stands for general-purpose AI: a model built to handle many different tasks, such as writing, summarizing, coding, or classification, rather than one narrow job. Because the same model can be reused in many downstream products and workflows, regulators treat it differently from a single-purpose system. Under the EU AI Act, some GPAI providers face extra duties around transparency, documentation, and, in stronger cases, security and testing.
For cyber security, GPAI matters because it can become both a tool and an attack surface. Defenders use it for triage, analysis, and automation, but attackers may abuse it for phishing, social engineering, or rapid content generation. Organizations that deploy GPAI should control access, review vendor assurances, monitor outputs, and test for data leakage and prompt injection. In practice, GPAI governance is part compliance, part security hygiene: know where the model is used, who manages it, and what sensitive data it can reach.