Manage systemic risk for high-impact general-purpose models
Download: JSON · MarkdownUnder EU AI Act, Articles 51, 52 and 55
What this label means
- Verified
- — a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
- Pending review
- — linked to the official source and in the queue for a reviewer to confirm.
- Source-linked
- — linked to the official source, not yet confirmed by a reviewer.
On this page 9 sections
In brief
Manage systemic risk for high-impact general-purpose models is a legal requirement under the EU AI Act in the European Union (Articles 51, 52 and 55). A general-purpose model is presumed to have systemic risk when the cumulative compute used for training exceeds 10^25 floating-point operations, or when the Commission designates it. It applies from 2 August 2025.
- Instrument
- EU AI Act
- Jurisdiction
- European Union
- Nature
- Legal requirement
- Source reference
- Articles 51, 52 and 55
- Applies from
- 2 August 2025
- Who it binds
- General-purpose AI model provider
- Evidence examples
- 2
- Framework mappings
- NIST AI Risk Management Framework 1.0
- Controls that meet it
- 3
- Official source
- Open official text
- Verification
- Pending review · source-linked
What does it require?
A general-purpose model is presumed to have systemic risk when the cumulative compute used for training exceeds 10^25 floating-point operations, or when the Commission designates it. Providers must notify the Commission, perform model evaluations including adversarial testing, assess and mitigate systemic risks, track and report serious incidents, and ensure adequate cybersecurity for the model and infrastructure.
Practical action
Track training compute against the threshold and prepare a safety and security framework before launch.
Who does it apply to?
Providers of general-purpose AI models meeting the systemic-risk criteria.
- Sectors
- Cross-sector / all sectors
- Use cases
- Generative AI and foundation models
Applies from:
Which controls meet this duty?
Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.
-
satisfiesPolicyHead of AI safety · annualFrontier model safety and security framework
Serves 9 recorded duties · evidence: Published frontier safety framework, Dangerous-capability evaluation report, Threshold notification to an authority
Compute tracking, notification and the safety and security framework.
-
satisfiesTechnical measureAI security or safety lead · at launch and on material changeAdversarial and red-team testing for generative AI
Serves 8 recorded duties · evidence: Red-team exercise report, Red-team rules of engagement and scenario library, Adversarial findings tracker
Model evaluation including adversarial testing.
-
supportsProcessIncident coordinator · continuousAI incident management and regulatory reporting
Serves 14 recorded duties · evidence: AI incident response playbook, AI incident record, Incident report to an authority
Tracking and reporting serious incidents to the AI Office.
Templates that cover this duty
Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.
- AI Risk Register (MIT AI Risk Repository taxonomy)
Register · XLSX · v4
- EU AI Act Role and Risk Classifier
Checklist · XLSX · v4
- EU AI Act Article 50 Transparency Kit
Kit · DOCX and XLSX · v32
- NIST AI RMF ↔ EU AI Act ↔ ISO/IEC 42001 Crosswalk
Crosswalk · XLSX · v3
What evidence would a reviewer expect?
| Evidence | Type | Notes |
|---|---|---|
| Model evaluation and red-teaming reports | report | |
| Commission notification record | record |
Framework mappings
Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.
See every European Union duty mapped this way →
| Framework | Reference | Note | Confidence |
|---|---|---|---|
| NIST AI RMF 1.0 | MEASURE 2.x; NIST AI 600-1 | Evaluation and red-teaming practices. | medium |
Frequently asked questions
Is this a legal requirement?
Yes. It is a legal requirement under EU AI Act (Articles 51, 52 and 55).
Who must comply with this obligation?
Providers of general-purpose AI models meeting the systemic-risk criteria.
When does this obligation apply?
It applies from 2 August 2025.
What evidence shows compliance?
A reviewer would expect: Model evaluation and red-teaming reports; Commission notification record.
Which frameworks map to this obligation?
It is mapped to NIST AI Risk Management Framework 1.0 MEASURE 2.x; NIST AI 600-1. These are editorial crosswalks with a stated confidence, not official mappings.
Which controls satisfy this obligation?
Frontier model safety and security framework; Adversarial and red-team testing for generative AI; AI incident management and regulatory reporting.
What should an organisation do in practice?
Track training compute against the threshold and prepare a safety and security framework before launch.
Cite this record
AIPolicyTracker (2026). “Manage systemic risk for high-impact general-purpose models (EU AI Act)” [AIPT-OBL-0019, not yet verified]. https://aipolicytracker.org/id/AIPT-OBL-0019 (accessed 27 October 2026). Data licensed CC BY 4.0.
Permanent id AIPT-OBL-0019: it never changes or gets reused, and its address keeps working if this page moves.
Cite the official text alongside it: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, Official Journal of the European Union, https://eur-lex.europa.eu/eli/reg/2024/1689/oj.
BibTeX
@misc{aipolicytracker2026_managesystemicriskforhig,
author = {{AIPolicyTracker}},
title = {{Manage systemic risk for high-impact general-purpose models (EU AI Act)}},
year = {2026},
howpublished = {\url{https://aipolicytracker.org/obligations/eu-ai-act-gpai-systemic-risk}},
url = {https://aipolicytracker.org/obligations/eu-ai-act-gpai-systemic-risk},
urldate = {2026-10-27},
note = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}
Change history
No change to this record's tracked fields has been recorded since 15 October 2026, when field-level history began.
Similar obligations in other instruments
- Large frontier developers must publish a frontier AI framework — California SB 53, California (United States)
- Large frontier developers must send periodic summaries of catastrophic-risk assessments to the state — California SB 53, California (United States)
- Operators of AI above the compute threshold must run lifecycle risk management and report safety results — AI Basic Act, South Korea
- Measure and test trustworthiness characteristics (Measure) — NIST AI RMF, United States (voluntary)
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.