Article 55: Obligations for providers of general purpose AI models with systemic risk

This is the frontier model article. The evaluation duty means state of the art protocols including adversarial testing, documented, with a view to identifying and mitigating systemic risks. The assessment duty is Union wide and covers risks arising from development, placing on the market and use. The incident duty requires tracking, documenting and reporting serious incidents and possible corrective measures to the AI Office and, where relevant, to national authorities, without undue delay. The cybersecurity duty covers the model and its physical infrastructure, because a model whose weights can be stolen is a systemic risk regardless of how it behaves. Providers may rely on codes of practice to demonstrate compliance until a harmonised standard exists, and the General Purpose AI Code of Practice is the route most large providers have taken. Signing a code is not immunity: the Commission can still assess whether the underlying obligation is met.

The official text, consolidated with the Digital Omnibus applied, with everything that cites it and everything it cites: Article 55 in the EU AI Act Explorer.

No tracked enforcement action expressly cites this article. The list below is the conduct that falls inside it, enforced so far under the GDPR or the Digital Services Act instead.

• Article 5: prohibited ai practices
• Article 50: transparency obligations for certain ai systems
• Article 51: classification of general purpose ai models with systemic risk
• Article 53: obligations for providers of general purpose ai models
• Article 93: measures the ai office can require of model providers
• Article 99: penalties imposed by member states
• Article 100: fines on union institutions, bodies, offices and agencies
• Article 101: fines on providers of general purpose ai models