What counts as a systemic-risk general-purpose AI model under the EU AI Act?

As the European Union prepares to enforce its comprehensive AI Act, one of the most consequential designations facing general-purpose model developers is the classification of their systems as “systemic-risk.” This special status, which applies to only the most powerful general-purpose AI models, imposes a significantly higher compliance burden under the bloc’s AI governance framework. The rules become applicable from August 2, 2025, with phased enforcement beginning in 2026 and extending to 2027 for existing models.

Under Article 51 of the AI Act, systemic-risk classification is tied to both computational scale and demonstrated capability. Analysts and institutional observers expect the designation to directly impact the world’s most advanced models—those that underpin technologies like OpenAI’s GPT-4o, Google’s Gemini, Meta’s LLaMA 3, and potentially newer open-source and sovereign AI initiatives.

What technical thresholds determine if a general-purpose AI model is classified as systemic-risk under the EU AI Act?

The AI Act establishes a clear computational benchmark in Article 51(2): any general-purpose AI model trained using more than 10²⁵ floating-point operations (FLOPs) is presumed to carry systemic-risk status. This threshold is designed to identify models at the frontier of capability, with sufficient scale to influence downstream applications, public safety, or democratic institutions.

The 10²⁵ FLOP metric is not arbitrary—it reflects the estimated compute used in the training of high-capacity models like GPT-4 and is consistent with industry projections of compute growth. Models that surpass this threshold must meet enhanced obligations under Articles 55 and Annex XI/A of the AI Act.

To ensure the regulation remains relevant amid rapid efficiency gains, Article 97 authorizes the European Commission to revise this FLOP threshold over time via delegated acts. This anticipatory clause acknowledges that future models may achieve equivalent capabilities using less compute.

Can smaller models still be designated as systemic-risk based on capability or real-world impact?

Yes. Article 51(1)(b) enables regulators to classify models below the 10²⁵ FLOP benchmark as systemic-risk if their capabilities or real-world impact are judged equivalent to those of larger systems. This qualitative clause is critical for identifying models whose emergent behaviors—such as autonomous planning, manipulation, or dual-use synthesis—may present societal risk despite a smaller training footprint.

Such designations can be based on a variety of factors, including scale of deployment, reach of downstream applications, or observed risks to fundamental rights and public safety. Annex XIII of the AI Act outlines technical characteristics used to assess high-impact capabilities, including generalized problem solving, goal formulation, and generation of scientific hypotheses without supervision.

This dual-track system ensures that systemic-risk designations are not limited to a narrow subset of compute-intensive models. Instead, they reflect a broader principle: capability and impact are what matter most—not just raw FLOPs.

What specific obligations apply to developers of systemic-risk general-purpose AI models?

Once designated as systemic-risk under the EU AI Act, providers must comply with a rigorous set of risk mitigation, transparency, and accountability requirements outlined in Article 55 and detailed in Annex XI/A. These include:

Conducting adversarial testing and structured red-teaming to identify and mitigate misuse risks before deployment. This includes probing for prompt injection vulnerabilities, deceptive behaviors, and alignment failures.

Completing pre-deployment risk assessments focused on the model’s ability to cause significant harm, with special attention to safety, cybersecurity, and fundamental rights.

Implementing post-market monitoring systems to continuously track incidents and performance anomalies, including risks that emerge after fine-tuning or downstream integration.

Establishing secure, tamper-resistant logging systems and technical interfaces for incident reporting. Providers must report serious incidents—such as bias amplification, privacy violations, or the generation of harmful content—without undue delay to both the EU AI Office and competent national authorities.

Applying robust cybersecurity protections throughout the lifecycle of the model, from pretraining infrastructure to public APIs and customer deployments.

Undergoing independent third-party audits and submitting documentation demonstrating compliance. These audits must evaluate technical safeguards, data practices, and governance mechanisms.

Registering systemic-risk models in a publicly accessible EU database maintained by the AI Office. This enables transparency for downstream deployers and regulatory visibility.

Non-compliance with these obligations can trigger fines of up to €15 million or 3% of the provider’s global annual turnover, whichever is higher. These penalties reflect the high-stakes nature of systemic-risk models and the EU’s intent to ensure accountability.

Why does the EU use compute scale as a proxy for risk, and how is that expected to evolve?

The European Commission’s use of compute thresholds stems from research suggesting a correlation between training scale and emergent AI capabilities. Large-scale models trained with over 10²⁵ FLOPs often exhibit generalized reasoning, multimodal synthesis, and the ability to generalize to unseen tasks—traits associated with systemic impact.

However, policymakers acknowledge that compute is not a perfect predictor. By coupling the FLOP threshold with a qualitative impact clause, the Act ensures regulators retain the flexibility to capture lower-compute models that present significant societal or security risks.

Over time, the Commission can revise these thresholds and associated technical annexes to reflect progress in model efficiency and risk understanding. Analysts believe that additional indicators—such as user base size, data heterogeneity, and integration into critical systems—may also influence future systemic-risk designations.

What are the implications for AI model providers seeking to deploy in the European Union?

Model developers operating at or near frontier-scale will need to begin compliance preparation immediately, particularly if planning to launch new models in the EU after August 2, 2025. New models must comply with systemic-risk obligations within one year—by August 2026—while models already in the EU market before the application date will have until August 2027.

To meet these deadlines, providers will need to establish internal compliance teams, red-teaming protocols, incident tracking pipelines, and audit frameworks. Third-party validation may also become a procurement requirement, especially in regulated sectors such as healthcare, education, and critical infrastructure.

Importantly, systemic-risk obligations apply regardless of whether the model is closed-source or open-source. While some obligations in the AI Act are waived for non-commercial open-source models, this exemption does not extend to systemic-risk classification. If an open-source model meets the threshold or demonstrates comparable impact, its developers—or downstream deployers—may still be held responsible under Article 55.

This raises important questions about how open-weight model developers, GitHub repositories, and fine-tuners will coordinate to ensure compliance, particularly in the case of decentralized deployment.

What happens next in the process of systemic-risk classification and enforcement?

The European Commission and the newly established AI Office will publish supplementary guidance before the Act’s provisions become applicable. This guidance is expected to clarify technical indicators for systemic-risk classification, define compliance templates for audits and documentation, and standardize red-teaming protocols across the bloc.

In parallel, national supervisory authorities (NSAs) will begin building enforcement capacity, potentially collaborating with cybersecurity agencies and domain-specific regulators. Enforcement of systemic-risk provisions is expected to begin in August 2026 for new models and August 2027 for legacy models, although regulators may conduct pre-enforcement dialogues with key providers in the interim.

The EU’s systemic-risk framework is also being closely watched by international regulators. Several provisions—such as mandatory incident reporting and capability audits—mirror recent U.S. Executive Orders and UK AI Safety Institute proposals. Over time, a convergence of global standards for systemic-risk classification may emerge, particularly for large model providers operating across jurisdictions.

What are the strategic implications of adopting systemic-risk safeguards early in the development cycle?

For AI developers, systemic-risk compliance is more than a regulatory requirement—it is a reputational asset. Early integration of risk assessments, adversarial testing, and documentation workflows can reduce both enforcement exposure and downstream market friction. It may also facilitate access to high-trust sectors like finance, government, and defense.

Institutional investors increasingly view regulatory readiness as a competitive differentiator. Providers that can demonstrate systemic-risk resilience may benefit from faster procurement cycles, cross-border compatibility, and inclusion in public-sector AI initiatives.

Moreover, early adoption of systemic-risk practices sends a clear message to users, developers, and regulators: this model is not just powerful—it is also responsibly managed.