Providers of general-purpose AI models with systemic risk must, in addition to the Article 53 baseline, perform model evaluation using standardised protocols and tools including adversarial testing, assess and mitigate systemic risks at Union level, track, document and report serious incidents and possible corrective measures to the AI Office and relevant national authorities without undue delay, and ensure an adequate level of cybersecurity protection for the model and its physical infrastructure.
How should model evaluation be approached?
Article 55 requires state-of-the-art model evaluation in accordance with standardised protocols and tools, including adversarial testing to identify and mitigate systemic risks. Evaluation in this sense is broader than a single benchmark score. It should test the model against the kinds of systemic risk identified for that model, use methods that are documented and repeatable, and record both results and limitations. Adversarial testing should be designed to probe misuse, failure modes and capability boundaries, not only to confirm expected behaviour. A provider should keep the evaluation plan, the protocols and tools used, the raw results in a controlled form, the analysis, and the decisions taken in response. Where a protocol or tool is not yet standardised for a particular risk, the provider should record what was used instead and why, and should revisit the choice as standards and practice develop.
What does assessing and mitigating systemic risk involve?
Assessment and mitigation of systemic risk requires identifying the types and sources of systemic risk at Union level, estimating their severity and probability, and putting in place measures that are proportionate to the risk. The work should consider the model's capabilities, its reach across downstream systems, and the ways in which risk can emerge along the value chain. Mitigation measures can include changes to the model, to deployment conditions, to information given to downstream providers, or to monitoring, depending on the risk identified. Each measure should have an owner, a timetable, and a way to check whether it worked. The assessment should be documented in a form that can be shown to the AI Office, updated when the model or its deployment changes, and linked to the evaluation evidence rather than kept as a separate narrative with no supporting material.
For the broader regulatory framework, see General-purpose AI models overview.
How should serious incidents be tracked and reported?
Article 55 requires providers to track, document and report serious incidents and possible corrective measures to the AI Office and, where relevant, to national competent authorities, without undue delay. A serious incident in this context includes events such as death or serious harm to health, serious disruption of critical infrastructure, infringement of fundamental rights protections, or serious harm to property or the environment, as defined in the Act. A provider needs an incident intake route that can receive reports from downstream providers and other sources, a triage step that tests whether the Article 55 threshold is met, and a reporting workflow with named owners and deadlines. Near misses and lower-severity events that inform risk assessment should also be documented, even where they do not trigger a report, so that the risk picture is not built only from reported incidents.
What cybersecurity protection is expected?
Article 55 requires an adequate level of cybersecurity protection for the model and its physical infrastructure. Adequacy is judged in context: the value and sensitivity of the model, the infrastructure on which it is trained and hosted, the access routes to weights and training material, and the consequences of compromise. Protection should cover access control, protection of model weights and training infrastructure, detection of intrusion or misuse, and response and recovery arrangements. A provider should record the controls in place, the threats considered, the testing performed, and any incidents or weaknesses found and fixed. Cybersecurity work for Article 55 should be linked to the broader evaluation and risk assessment, because a security failure can itself create or amplify a systemic risk, and a risk assessment that ignores security will be incomplete.
How do Article 55 duties relate to codes of practice?
Codes of practice under Article 56 are intended to help providers apply Articles 53 and 55, including by setting out objectives, commitments, measures and indicators for systemic-risk assessment and management. Following a code of practice that has been assessed as adequate can support a provider in demonstrating compliance, but the code does not replace the statutory duties in Article 55 itself. A provider should record which code commitments it has adopted, how they map to its Article 55 work, and where its own measures go further or differ and why. If no adequate code covers a particular risk, the provider should still carry out the Article 55 work directly from the legal text and record the basis for its approach. The code, the evaluation evidence and the risk assessment should be readable as one connected file.
Continue with Article 51 classification of systemic-risk models.
What does this guide not decide?
This guide does not decide whether a model presents systemic risk, whether an evaluation protocol is adequate, whether a mitigation measure is proportionate, or whether an event is a serious incident that must be reported. It does not set a cybersecurity standard for a particular infrastructure or assess a code of practice commitment. Those questions depend on the model's capabilities and reach, the evaluation evidence, the incident facts, and the consolidated legal text as applied by the AI Office. A provider should confirm its Article 55 programme with a competent authority or legal adviser, document its reasoning, and keep the programme under review as the model and its deployment evolve.
Frequently asked questions
Do Article 55 duties replace Article 53 duties?
No. Article 55 duties are additional to the Article 53 baseline. A systemic-risk model provider must maintain the technical documentation, downstream information, copyright policy and training summary work in Article 53, and add the evaluation, risk mitigation, incident reporting and cybersecurity work in Article 55.
What counts as a serious incident for Article 55?
The Act defines serious incidents by reference to serious harm outcomes, including death or serious health harm, serious disruption of critical infrastructure, infringement of fundamental rights, and serious harm to property or the environment. Each event should be triaged against that definition, documented, and reported without undue delay where the threshold is met.
Can a provider rely only on a code of practice?
A code of practice can help demonstrate how Articles 53 and 55 are applied, but it does not displace the statutory duties. The provider should map code commitments to its own evaluation, mitigation, incident and cybersecurity work, and record any gap or difference and the reason for it.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk Article 55 ↗European Commission AI Act overview ↗