# Providers of systemic-risk GPAI models must secure the model and its infrastructure

- **Record type**: Obligation
- **Instrument**: Regulation (EU) 2024/1689 — Artificial Intelligence Act
- **Jurisdiction**: European Union
- **Category**: accuracy_robustness_security
- **Binding**: Yes
- **Applies from**: 2025-08-02
- **Provision**: Article 55(1)(d)

## What the duty requires

Providers of general-purpose AI models with systemic risk must ensure an adequate level of cybersecurity protection for the model and for the physical infrastructure it runs on, which in practice covers protection of model weights, training and inference environments, and access controls against theft, tampering and unauthorised release. Codes of practice and harmonised standards may be used to show compliance.

## What an organisation does about it

Apply a documented security standard to weight storage, training clusters and inference endpoints, with penetration tests and insider-risk controls.

## Controls that meet this duty

- Accuracy, robustness, fairness and security testing (satisfies): https://aipolicytracker.org/controls/accuracy-robustness-security-testing
- Frontier model safety and security framework (supports): https://aipolicytracker.org/controls/frontier-model-safety-framework

## Parent instrument

- Regulation (EU) 2024/1689 — Artificial Intelligence Act
  - Record: https://aipolicytracker.org/policies/eu-ai-act
  - Context file: https://aipolicytracker.org/policies/eu-ai-act.md

## Provenance

- **Record page**: https://aipolicytracker.org/obligations/eu-ai-act-art-55-systemic-risk-cybersecurity
- **Official source**: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- **Provision**: Article 55(1)(d)
- **Review status**: pending review
- **Confidence**: high
- **Facts last confirmed**: never confirmed against the official source
- **Retrieved**: 2026-09-24
- **Licence**: https://creativecommons.org/licenses/by/4.0/

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.