A general-purpose AI model is classed as having systemic risk under Article 51 if it has high impact capabilities, presumed when training compute exceeds 10 to the power of 25 floating point operations, or if the Commission designates it. Article 55 then adds duties: evaluation with adversarial testing, risk mitigation, incident reporting and cybersecurity protection.
How classification works
Article 51(1) gives two routes:
- High impact capabilities, evaluated with appropriate technical tools, indicators and benchmarks.
- A Commission decision, on its own initiative or after a qualified alert from the scientific panel, that the model has equivalent capabilities or impact, weighing the criteria in Annex XIII.
Article 51(2) adds a presumption: a model is presumed to have high impact capabilities when cumulative training computation is greater than 10 to the power of 25 floating point operations. Article 51(3) lets the Commission amend thresholds and benchmarks by delegated act as technology develops. The notification procedure sits in Article 52, which we did not review.
A presumption is not a cliff. A model under the figure can still be designated, and the figure itself can change.
Extra duties in Article 55
On top of Articles 53 and 54, providers of systemic risk models must:
- Evaluate models using standardised, state-of-the-art protocols and tools, including documented adversarial testing to identify and mitigate systemic risks.
- Assess and mitigate possible systemic risks at Union level, including their sources.
- Track, document and report serious incidents and possible corrective measures to the AI Office and, where appropriate, national authorities without undue delay.
- Ensure adequate cybersecurity protection for the model and its physical infrastructure.
Providers may rely on approved codes of practice under Article 56 to show compliance until a harmonised standard is published. Others must show alternative adequate means for Commission assessment.
Why this matters to people who only use models
If you integrate a systemic risk model, your supplier carries these duties, not you. Still, they shape what you can ask for: evaluation summaries, an incident contact, and notice of changes that affect your use. Build those into the contract and your vendor review.
Security angle
Two items are directly security work. Adversarial testing is red teaming under another name, with documentation. Cybersecurity of weights and infrastructure is the same question every organisation holding valuable assets faces: access control, monitoring, and protection of the build and serving pipeline.
Timing
General-purpose model duties have applied since August 2025, and the AI Office gains enforcement powers such as requesting information and fining from August 2026, per the Commission page.
If you are a model provider, start the evaluation and incident processes before you cross any threshold. Teams that wait until classification is certain tend to find that red team reports, incident channels and security reviews take months to set up.
Quick check
Does a model below the compute figure escape systemic risk rules?
Not necessarily. The Commission can designate a model on other criteria, and the threshold can be amended.
Can open-source systemic risk models use the open-source exception?
No. Article 53(2) excludes models with systemic risk from the exception.
Sources
- AI Act Article 51, classification
- AI Act Article 55, obligations for systemic risk models
- AI Act Article 53
- European Commission, AI Act regulatory framework
Last reviewed: 19 October 2026.
