Is 10^25 FLOP the only EU AI Act systemic-risk route for GPAI models?

No. The 10^25 FLOP threshold creates a presumption of high-impact capabilities, but the Commission can also designate a GPAI model as systemic risk based on Annex XIII criteria, including capability or impact considerations.

FAQEU AI Act

EU AI Act GPAI and systemic-risk duties

Q: Does Article 55 cybersecurity cover only the API or app built around the model?

No. Article 55 refers to cybersecurity protection for the GPAI model with systemic risk and the physical infrastructure of the model. Recital 115 specifically points to model weights, algorithms, servers, datasets, operational security, cybersecurity policies, technical controls, and cyber and physical access controls.

Q: Who enforces EU AI Act duties for GPAI model providers?

The Commission enforces compliance with GPAI model provider obligations, including through the AI Office, which monitors and supports compliance with general-purpose AI rules. The Commission guidelines also note that providers should cooperate with the AI Office and national competent authorities.

General-purpose AI model providers must separate baseline Article 53 duties from the additional Article 55 duties that apply only to GPAI models with systemic risk.

This FAQ helps check provider status, systemic-risk classification, downstream documentation, copyright and training-summary work, serious-incident reporting, cybersecurity, and Code of Practice caveats.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 25, 2026

Questions

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 25, 2026

Overview

The EU AI Act regulates general-purpose AI models through Chapter V. Article 53 applies to providers of models placed on the Union market. Article 55 adds model-evaluation, systemic-risk, serious-incident, and cybersecurity duties when a GPAI model is classified as having .

Search this module

Find a question or answer quickly

5 of 5 questions

Question 1

What does Article 53 require from GPAI model providers?

Article 53 requires providers of general-purpose AI models to keep technical documentation for authorities, provide information to downstream AI system providers, maintain a copyright-compliance policy, and publish a sufficiently detailed summary of the content used for training.

The downstream information must help AI system providers understand the model's capabilities and limitations and comply with their own AI Act obligations, while protecting intellectual property, confidential business information, and trade secrets.

Keep model technical documentation up to date, including the training and testing process and evaluation results, for the AI Office and national competent authorities on request.
Provide integration documentation to downstream providers, including capabilities, limitations, acceptable use policies, release and distribution details, architecture, software dependencies, and other Annex XII information.
Put in place a policy to comply with Union copyright and related-rights law, including rights reservations under Article 4(3) of Directive (EU) 2019/790.
Publish the Article 53(1)(d) public summary of training content using the AI Office template.

What makes a model a general-purpose AI model under the EU AI Act?

A general-purpose AI model is an AI model, including one trained with large amounts of data using self-supervision at scale, that has significant generality, can competently perform a wide range of distinct tasks, and can be integrated into many downstream systems or applications. The definition excludes models used for research, development, or prototyping before they are placed on the market.

Does Article 53 apply only to models with ?

No. Article 53 is the baseline duty for providers of general-purpose AI models. Systemic-risk status adds Article 55 duties, but it does not supersede Article 53.

What should downstream providers receive for EU AI Act integration?

They should receive enough current documentation to understand the model's tasks, capabilities, limitations, acceptable use policies, release method, input and output modalities, relevant software, architecture, parameters, and integration constraints so they can meet their own AI Act obligations.

Citations

Regulation (EU) 2024/1689 (EU AI Act)

Primary legal text for Article 53 duties and Annex XI and XII documentation content.

European Commission - GPAI provider guidelines

Commission guidance on GPAI model provider scope, lifecycle documentation, downstream information, open-source exemptions, and staged application.

Question 2

When is a GPAI model classified as having systemic risk?

Article 51 classifies a general-purpose AI model as a model with if it has , or if the Commission designates it after an ex officio assessment or a qualified alert from the scientific panel using Annex XIII criteria.

The Act creates a compute-based presumption: a model is presumed to have when the cumulative computation used for training is greater than 10^25 floating point operations. Article 52 then requires notification to the Commission without delay and in any event within two weeks after the requirement is met or it becomes known that it will be met. The Commission can also designate a model under the separate Annex XIII route.

Systemic-risk analysis concerns Union-level effects from the model's reach or . The Regulation names actual or reasonably foreseeable negative effects on public health and safety, public security, fundamental rights, or society as a whole, including propagation across the value chain. The provider should assess plausible downstream effects and misuse across sectors alongside benchmark performance and direct applications.

Record the model's training compute estimate, methodology, and supporting evidence before market placement decisions.
Escalate if training compute exceeds 10^25 FLOP or if model reach, modalities, autonomy, scalability, tools, user base, or training data suggest Annex XIII significance.
If relying on the Article 52 exception argument, keep objective evidence for why the model does not present despite meeting the high-impact presumption.
Track Commission designation and reassessment decisions because systemic-risk status changes the provider duty set.

Is 10^25 FLOP the only EU AI Act systemic-risk route for models?

No. The 10^25 FLOP threshold creates a presumption of , but the Commission can also designate a model as based on Annex XIII criteria, including capability or impact considerations.

Can a provider contest systemic-risk classification under the EU AI Act?

Yes. Article 52 allows a provider that meets the high-impact condition to submit sufficiently substantiated arguments that, exceptionally, the model does not present due to its specific characteristics. A provider designated by Commission decision can also request reassessment with objective, detailed, and new reasons.

Citations

Regulation (EU) 2024/1689 (EU AI Act)

Primary legal text for Article 51 classification, Article 52 notification and reassessment, and Annex XIII designation criteria.

European Commission - GPAI provider guidelines

Commission guidance explaining GPAI scope, the systemic-risk presumption, notification to the AI Office, and training-compute estimation context.

Question 3

What extra duties apply under Article 55 for GPAI models with systemic risk?

Article 55 duties apply in addition to Articles 53 and 54. Providers of models with must evaluate the model with state-of-the-art protocols and tools, conduct and document adversarial testing, assess and mitigate systemic risks at Union level, track and report serious incidents, and protect the model and its physical infrastructure with adequate cybersecurity.

The Article 55 work should be continuous across development, placing on the market, and use. It should cover sources of , post-market learning from incidents and misuse, corrective measures, and security risks such as model leakage, unauthorised releases, circumvention of safety measures, unauthorised access, and model theft.

Model evaluation file: protocols, benchmarks or other methodologies, evaluation criteria, metrics, results, known limitations, and who performed the evaluation.
Adversarial testing file: internal or external testing plan, test scope, model adaptations, red-team findings, mitigation decisions, and unresolved risk rationale.
Systemic-risk file: Union-level risk sources, affected public interests, likelihood and severity, mitigation measures, residual risk, and post-market monitoring triggers.
Serious-incident file: incident facts, model version, affected use or integration, known or likely harm, corrective measures, reporting route to the AI Office and, where appropriate, national competent authorities.
Cybersecurity file: controls for weights, algorithms, servers, datasets, access management, physical security, leak prevention, vulnerability handling, and attack response.

What serious incidents must systemic-risk providers report under Article 55?

Article 55 requires providers to keep track of, document, and report without undue delay relevant information about serious incidents and possible corrective measures to the AI Office and, as appropriate, national competent authorities. The Commission has published a template for serious incidents involving models with .

Does Article 55 cybersecurity cover only the API or app built around the model?

No. Article 55 refers to cybersecurity protection for the model with and the physical infrastructure of the model. Recital 115 specifically points to model weights, algorithms, servers, datasets, operational security, cybersecurity policies, technical controls, and cyber and physical access controls.

Citations

Regulation (EU) 2024/1689 (EU AI Act)

Primary legal text for Article 55 model evaluation, systemic-risk mitigation, serious-incident reporting, and cybersecurity duties.

European Commission - AI Act serious incident template

Commission page announcing the reporting template for serious incidents involving GPAI models with systemic risk.

European Commission - GPAI Code of Practice

Commission page explaining the GPAI Code of Practice chapters, including the Safety and Security chapter for Article 55 systemic-risk obligations.

Question 4

How do copyright policy, training summaries, open-source models, and the Code of Practice fit together?

The Article 53 copyright policy and public training-content summary are separate duties. The copyright policy is an internal compliance policy for Union copyright and related-rights law. The public summary is a transparency artifact about the content used for model training, published according to the AI Office template.

Open-source status can remove only the Article 53(1)(a) and (b) documentation and downstream-information duties when the licence and public-availability conditions in Article 53(2) are met. It does not remove the copyright-policy or public training-summary duties, and the exception does not apply to models with .

Copyright policy: identify and comply with rights reservations under Article 4(3) of Directive (EU) 2019/790, including through state-of-the-art technologies where relevant.
Training-content summary: publish a sufficiently detailed summary using the AI Office template, generally comprehensive in scope while protecting trade secrets and confidential business information.
Open-source caveat: Article 53(2) excludes only Article 53(1)(a) and (b) for qualifying open-source models, and not for GPAI models with .
Code of Practice caveat: providers may rely on approved codes of practice to demonstrate compliance until harmonised standards are published, but providers outside an approved code or standard must show alternative adequate means to the Commission.
Copyright Code caveat: the Copyright Chapter helps demonstrate Article 53(1)(c) implementation, but it does not itself decide compliance with Union copyright law.

Does publishing model weights remove the EU AI Act training-summary duty?

No. The AI Act and Commission materials distinguish open model access from transparency about training content. The public training-content summary and copyright policy remain relevant even for qualifying open-source models.

Can a provider use the Code of Practice instead of Article 53 or Article 55?

No. The Code of Practice is a way to demonstrate compliance with covered obligations until harmonised standards are published. It is not a replacement for the underlying AI Act duties, and providers that do not use an approved code or standard must demonstrate alternative adequate means of compliance.

Citations

Regulation (EU) 2024/1689 (EU AI Act)

Primary legal text for Article 53 copyright, training-summary, open-source exemption, and code-of-practice provisions.

European Commission - Training-content summary template

Commission page for the explanatory notice and template for public summaries of training content under Article 53(1)(d).

European Commission - Training-content summary FAQ

Commission FAQ explaining that the template gives a common minimal baseline for public training-content summaries.

GPAI Code of Practice - Copyright Chapter

Code chapter used for the caveat that adherence supports Article 53(1)(c) demonstration but does not itself determine Union copyright-law compliance.

Question 5

What staged application and enforcement points are supported for GPAI duties?

The Commission guidelines state that Chapter V obligations for model providers apply from 2 August 2025. They also state that Commission enforcement powers for these obligations enter into application on 2 August 2026, and that providers of GPAI models placed on the market before 2 August 2025 must take necessary compliance steps by 2 August 2027.

The same guidance says the guidelines are not legally binding and that authoritative interpretation of the AI Act is for the Court of Justice of the European Union. Treat the dates above as implementation milestones based on the cited Commission guidance, not as a complete enforcement calendar for every AI Act duty.

From 2 August 2025: Chapter V provider obligations enter into application according to the Commission guidelines.
From 2 August 2026: the Commission says its enforcement powers for provider obligations enter into application, including fines under Article 101.
By 2 August 2027: providers of models placed on the market before 2 August 2025 must take necessary steps to comply, according to the guidelines and Article 111(3) reference.
Do not use this FAQ to infer deadlines for unrelated high-risk AI system, prohibited-practice, transparency, product-law, or national-authority obligations.

Who enforces EU AI Act duties for model providers?

The Commission enforces compliance with model provider obligations, including through the AI Office, which monitors and supports compliance with general-purpose AI rules. The Commission guidelines also note that providers should cooperate with the AI Office and national competent authorities.

Are the Commission guidelines legally binding?

No. The guidelines state that they are not binding and that authoritative interpretation of the AI Act may only be given by the Court of Justice of the European Union. They still set out the Commission's interpretation and application approach for enforcement.

Citations

European Commission - GPAI provider guidelines

Commission guidance supporting the Chapter V application date, enforcement-power date, legacy-model compliance date, non-binding-guidance caveat, and Commission enforcement role.

Regulation (EU) 2024/1689 (EU AI Act)

Primary legal text for Article 101, Article 111, Article 113, and the underlying Chapter V obligations referenced by the Commission guidelines.

Recommended next step

Turn GPAI provider duties into reviewable records

Sorena can help map a GPAI model portfolio to Article 53 documentation, downstream information, copyright policy, training-content summaries, systemic-risk files, serious-incident routing, and cybersecurity evidence.

Research workflow

Open Research Copilot for EU AI Act

Ask questions tied to cited sources about GPAI provider scope, Article 53, Article 55, systemic-risk classification, and evidence expectations.

Explore next step

Talk to Sorena

Talk through GPAI obligations

Review your model documentation, downstream integration package, copyright policy, public training-content summary, and systemic-risk controls with Sorena.

Explore next step

Primary sources

References and citations

European Commission - AI Act serious incident template

digital-strategy.ec.europa.eu

Referenced sections

Commission page announcing the reporting template for serious incidents involving GPAI models with systemic risk.

"reporting template for serious incidents"

European Commission - GPAI Code of Practice

digital-strategy.ec.europa.eu

Referenced sections

Commission page explaining the GPAI Code of Practice chapters, including the Safety and Security chapter for Article 55 systemic-risk obligations.

"Safety and Security chapter"

European Commission - GPAI provider guidelines

digital-strategy.ec.europa.eu

Referenced sections

Commission guidance supporting the Chapter V application date, enforcement-power date, legacy-model compliance date, non-binding-guidance caveat, and Commission enforcement role.