Art.55
EU AI Act Guide › Chapter V — General-Purpose AI Models › Article 55

Article 55 – Obligations of Providers of General-Purpose AI Models with Systemic Risk

GPAI Models SME Relevant ~2 min read · 484 words

Article 55 establishes the additional obligations that apply specifically to providers of GPAI models classified as presenting systemic risk under Article 51. On top of the baseline obligations of Article 53, systemic-risk model providers must conduct adversarial testing, assess and mitigate systemic risks, report serious incidents, and ensure cybersecurity. This is the regulatory framework for the world’s most powerful AI models.

✓ Low compliance impact for SMEs

WHAT THE ARTICLE IS ABOUT

The heavier compliance layer for frontier AI model providers

Article 55 sets out four additional obligations that apply exclusively to providers of GPAI models with systemic risk — those exceeding the 10^25 FLOPs training compute threshold or otherwise classified as systemic risk under Article 51. These obligations are designed to address the unique dangers that frontier AI models can pose at a societal and systemic level.

WHAT IT SAYS

Adversarial testing, risk mitigation, incident reporting, and cybersecurity

  • Systemic-risk GPAI providers must perform model evaluation in accordance with standardised protocols — including conducting and documenting adversarial testing to identify and mitigate systemic risks
  • They must assess and mitigate possible systemic risks at Union level — including identifying the sources of those risks and how they might emerge along the AI value chain
  • They must track, document, and report without undue delay to the AI Office and relevant national authorities any serious incidents and possible corrective measures
  • They must ensure an adequate level of cybersecurity protection for both the model itself and its physical infrastructure
  • Providers may rely on codes of practice under Article 56 to demonstrate compliance until harmonised standards are published — compliance with published harmonised standards grants a presumption of conformity
  • Providers who neither adhere to an approved code of practice nor comply with harmonised standards must demonstrate alternative adequate means of compliance to the AI Office

WHO IS AFFECTED

The handful of frontier AI companies with systemic-risk models

  • OpenAI, Google DeepMind, Anthropic, Meta, Mistral and any other provider whose GPAI model meets the systemic risk classification threshold
  • Open-source GPAI model providers whose models are classified as systemic risk — the open-source exemption in Article 53 does not apply to systemic-risk models
  • The AI Office which monitors compliance with these obligations and receives incident reports
  • National competent authorities who also receive serious incident notifications

WHAT IT MEANS FOR SMES

Safer AI infrastructure through mandatory frontier model oversight

  • Most SMEs will never be subject to Article 55 directly — the compute threshold is far beyond what any small business could afford to train
  • Indirectly, Article 55 matters because the AI models SMEs rely on daily — GPT-4, Claude, Gemini — are provided by companies subject to these obligations
  • The adversarial testing and risk mitigation requirements mean the foundation models you build on are subject to systematic safety evaluation — a structural protection for everyone who uses these models
  • The incident reporting obligation creates transparency: serious incidents involving systemic-risk models are reported to the AI Office, building an evidence base that informs regulatory responses
  • When evaluating AI vendors, knowing whether their underlying model is subject to Article 55 obligations is a meaningful signal about the level of safety oversight applied to that technology

Related Articles

← Back to the Guide
← Previous Art. 54 — Authorised Representatives of Providers of General-Purpose AI Models Next → Art. 56 — Codes of Practice