Artificial Intelligence Policy Tracker
Legal requirement Safety testing and evaluation European Union Partially applicable

Manage systemic risk for high-impact general-purpose models

Download: JSON · MarkdownUnder EU AI Act, Articles 51, 52 and 55

Pending review · linked to the official source, waiting for a reviewer to confirm it (a factual check against the official source, not a legal review or legal advice)
What this label means
Verified
— a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
Pending review
— linked to the official source and in the queue for a reviewer to confirm.
Source-linked
— linked to the official source, not yet confirmed by a reviewer.
Verification policy and current standing · a factual check, not legal advice.
No change recorded as of 26 Sep 2026 · official source last checked
On this page 9 sections

In brief

Manage systemic risk for high-impact general-purpose models is a legal requirement under the EU AI Act in the European Union (Articles 51, 52 and 55). A general-purpose model is presumed to have systemic risk when the cumulative compute used for training exceeds 10^25 floating-point operations, or when the Commission designates it. It applies from 2 August 2025.

Instrument
EU AI Act
Jurisdiction
European Union
Nature
Legal requirement
Source reference
Articles 51, 52 and 55
Applies from
2 August 2025
Who it binds
General-purpose AI model provider
Evidence examples
2
Framework mappings
NIST AI Risk Management Framework 1.0
Controls that meet it
3
Official source
Open official text
Verification
Pending review · source-linked

What does it require?

A general-purpose model is presumed to have systemic risk when the cumulative compute used for training exceeds 10^25 floating-point operations, or when the Commission designates it. Providers must notify the Commission, perform model evaluations including adversarial testing, assess and mitigate systemic risks, track and report serious incidents, and ensure adequate cybersecurity for the model and infrastructure.

Practical action

Track training compute against the threshold and prepare a safety and security framework before launch.

Who does it apply to?

Providers of general-purpose AI models meeting the systemic-risk criteria.

Applies from:

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

  • satisfiesPolicyHead of AI safety · annual
    Frontier model safety and security framework

    Serves 9 recorded duties · evidence: Published frontier safety framework, Dangerous-capability evaluation report, Threshold notification to an authority

    Compute tracking, notification and the safety and security framework.

  • satisfiesTechnical measureAI security or safety lead · at launch and on material change
    Adversarial and red-team testing for generative AI

    Serves 8 recorded duties · evidence: Red-team exercise report, Red-team rules of engagement and scenario library, Adversarial findings tracker

    Model evaluation including adversarial testing.

  • supportsProcessIncident coordinator · continuous
    AI incident management and regulatory reporting

    Serves 14 recorded duties · evidence: AI incident response playbook, AI incident record, Incident report to an authority

    Tracking and reporting serious incidents to the AI Office.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

All 9 templates that cover it →

What evidence would a reviewer expect?

Evidence examples
EvidenceTypeNotes
Model evaluation and red-teaming reportsreport
Commission notification recordrecord

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every European Union duty mapped this way →

Framework mappings table
FrameworkReferenceNoteConfidence
NIST AI RMF 1.0MEASURE 2.x; NIST AI 600-1Evaluation and red-teaming practices.medium

Frequently asked questions

Is this a legal requirement?

Yes. It is a legal requirement under EU AI Act (Articles 51, 52 and 55).

Who must comply with this obligation?

Providers of general-purpose AI models meeting the systemic-risk criteria.

When does this obligation apply?

It applies from 2 August 2025.

What evidence shows compliance?

A reviewer would expect: Model evaluation and red-teaming reports; Commission notification record.

Which frameworks map to this obligation?

It is mapped to NIST AI Risk Management Framework 1.0 MEASURE 2.x; NIST AI 600-1. These are editorial crosswalks with a stated confidence, not official mappings.

Which controls satisfy this obligation?

Frontier model safety and security framework; Adversarial and red-team testing for generative AI; AI incident management and regulatory reporting.

What should an organisation do in practice?

Track training compute against the threshold and prepare a safety and security framework before launch.

Cite this record

AIPolicyTracker (2026). “Manage systemic risk for high-impact general-purpose models (EU AI Act)” [AIPT-OBL-0019, not yet verified]. https://aipolicytracker.org/id/AIPT-OBL-0019 (accessed 27 October 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0019: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, Official Journal of the European Union, https://eur-lex.europa.eu/eli/reg/2024/1689/oj.

BibTeX
@misc{aipolicytracker2026_managesystemicriskforhig,
  author       = {{AIPolicyTracker}},
  title        = {{Manage systemic risk for high-impact general-purpose models (EU AI Act)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/eu-ai-act-gpai-systemic-risk}},
  url          = {https://aipolicytracker.org/obligations/eu-ai-act-gpai-systemic-risk},
  urldate      = {2026-10-27},
  note         = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}

Change history

No change to this record's tracked fields has been recorded since 15 October 2026, when field-level history began.

Similar obligations in other instruments

Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.