Model evaluation to the AI Act Code of Practice
A provider of a general-purpose AI model with systemic risk is evaluating the model to the Safety and Security chapter of the published GPAI Code of PracticePublished and has to document the result under Art. 53(1) and Art. 55(1). Art. 53(4) and Art. 55(2) make adherence to the Code one route for showing those duties are met; the duties sit in the articles. The AI Office can request the documentation and fine under Art. 101 from the enforcement date In force. This page gives the evaluation sequence, the records it leaves and the consequence of an undocumented run.
Where this starts
The organisation is the provider of a general-purpose AI model that meets the Art. 51 classification, and its research function has evaluated the model as it developed: benchmark suites, internal red-teaming and external probes, each recorded in a notebook or a results channel, and none in a document written for the AI Office. The GPAI hub lists the two anxieties this page answers: the Annex XI documentation has to be assembled from research notes, and adversarial testing has been done ad hoc, without a campaign that can be repeated at the next model version. The article text sets the target. Art. 55(1) requires the provider of a model with systemic risk to perform model evaluation in accordance with standardised protocols and tools that reflect the state of the art, including conducting and documenting adversarial testing, in order to identify and mitigate systemic risks. Art. 53(1) requires the technical documentation to include the training and testing process and the results of the evaluation, and Annex XI Section 2 names what a model with systemic risk adds: the evaluation strategies and results with the evaluation criteria, the metrics and the methodology on the identification of limitations, and the measures put in place for internal or external adversarial testing and for model adaptations such as alignment and fine-tuning.
Neither article names a particular code of practice. Art. 53(4) and Art. 55(2) let the provider rely on a code of practice under Art. 56 to demonstrate that the duties are met until a harmonised standard is published, and no harmonised standard for general-purpose AI models is cited in the Official Journal as of the anchor date on the standards page, so no presumption of conformity is available on either route. Regulation (EU) 2026/1744 amended neither article and moved no GPAI date. The Safety and Security chapter of the GPAI Code of PracticePublished is the published description of what the evaluation duty looks like in practice, in ten commitments: a Safety and Security Framework (Commitment 1), systemic risk identification and analysis (Commitments 2 and 3), acceptance determination (Commitment 4), safety and security mitigations (Commitments 5 and 6), the Safety and Security Model Report (Commitment 7), and responsibility allocation, serious incident reporting and additional documentation (Commitments 8 to 10). Measure 3.2 of that chapter asks for at least state-of-the-art model evaluations with methods appropriate to the model and the risk, and lists the forms they take: question and answer sets, task-based evaluations, benchmarks, red-teaming and other adversarial testing, human uplift studies, model organisms, simulations and proxy evaluations. A signatory demonstrates Art. 55(1) through those measures; a non-signatory that applies no harmonised standard demonstrates alternative adequate means for assessment by the Commission, and the same evaluation records serve as that demonstration. The adherence statement is the provider's declaration and the assessment of alternative means is the Commission's.
Regulation (EU) 2024/1689 sets no evaluation score, attack success rate or risk acceptance level for Art. 55(1)(a). The one figure nearby is the Art. 51(2) presumption, cumulative training compute greater than 10^25 floating point operations, which the Commission can amend under Art. 51(3); the Art. 55 obligation page records it as a classification gate that sets no test threshold. Every pass criterion therefore comes from the lower levels of the source hierarchy, with the code-of-practice level in use. Under Measure 4.1 of the Safety and Security chapter of the GPAI Code of PracticePublished the provider defines its own systemic risk tiers in terms of model capabilities, measurable, with at least one tier not yet reached and a safety margin for the uncertainty of the assessment, and the evaluation is run against those tiers. NIST AI RMF 1.0Published supplies the rationale for selecting each metric, and ISO/IEC TR 24029-1:2021Published supplies the statistical, formal and empirical method categories that structure the adversarial part. PR-15-ROB v1.0 runs the evaluations the provider's Framework names, records the measured value next to the criterion the provider set, and does not state that the criterion is the right one; it is the independent external evaluation of Appendix 3.5 of the chapter only where the engagement is scoped as one. Art. 53 then takes the results: PR-11-DOC v1.0 checks that each result cited in Annex XI Section 2 carries its protocol name, dataset version and model version and resolves to a stored record.
The sequence
The work runs in the order below: the classification gate, then the criteria and the plan, then the runs at a fixed model version, then the records for Annex XI and the Model Report.
Confirm the Art. 51 classification from the PR-CLS training compute determination record before any evaluation runs.
Record Classification gate record with the reference to the PR-CLS training compute determination record
[Regulation (EU) 2024/1689, Art. 51(2); PR-CLS training compute determination; PR-15-ROB step 2]
Extract each systemic risk scenario and its acceptance criterion from the Safety and Security Framework, with the criterion's source.
Record Systemic risk scenario list with the acceptance criterion and the target justification record per scenario
[GPAI Code of Practice, Safety and Security chapter, Measures 2.2 and 4.1; NIST AI RMF 1.0, Measure 1.1; PR-15-ROB step 9]
Freeze the model version, inference configuration, random seeds and tool versions in one environment manifest.
Record Environment manifest with the model version hash, inference configuration, seeds and tool versions
[PR-15-ROB step 1]
Write the evaluation plan: one protocol, tool set, elicitation method and criterion for each risk scenario.
Record Systemic risk evaluation plan with the protocol, tool set, elicitation method and acceptance criterion per scenario
[GPAI Code of Practice, Safety and Security chapter, Measure 3.2 and Appendix 3.2; PR-15-ROB step 13]
Write the threat model and the attack set, with a success criterion recorded for each attack.
Record Threat model and attack set with a success criterion per attack
[OWASP Top 10 for LLM Applications, LLM01 and LLM07; MITRE ATLAS, AML.T0051 and AML.T0054; PR-15-ROB steps 11 and 12]
Run each planned evaluation with elicitation and each attack case; record every result against its criterion.
Record Evaluation result per systemic risk and prompt attack log with the outcome per case
[GPAI Code of Practice, Safety and Security chapter, Measure 3.2 and Appendix 3.2; PR-15-ROB steps 27 and 31]
Re-run the same evaluation and attack set after each mitigation; record the change from the baseline.
Record Mitigation effectiveness delta per mitigation against the pre-mitigation baseline
[GPAI Code of Practice, Safety and Security chapter, Measure 5.1; PR-15-ROB step 32]
Write the evaluation report per risk and the adversarial campaign record for the Model Report.
Record Model evaluation report per systemic risk and adversarial testing campaign record, cited in the Safety and Security Model Report
[GPAI Code of Practice, Safety and Security chapter, Measure 7.3; PR-15-ROB step 44]
Enter each result into Annex XI Section 2 and check that each cited result resolves to a stored record.
Record Annex XI gap table rows for Section 2 and evaluation result traceability rows with the resolved record identifier
[Regulation (EU) 2024/1689, Art. 53(1)(a) and Annex XI Section 2; PR-11-DOC steps 11 and 38]
Evidence this situation ends with
| Artifact | Answers | Produced by |
|---|---|---|
| Training compute determination record (PR-CLS output) | Art. 51(2): the compute figure, the estimation approach and the comparison that puts Art. 55 in scope | PR-CLS v1.0 |
| Safety and Security Framework (GPAI Code of Practice, Safety and Security chapter) | Art. 55(2) route under the GPAI Code of PracticePublished and Art. 55(1)(b): the risk scenarios, the acceptance criteria per tier and the mitigations the evaluation is run against | the provider |
| Model evaluation report per systemic risk (PR-15-ROB output) | Art. 55(1)(a) evaluation: the protocol, tool set, elicitation method and result against the acceptance criterion for each risk, at the model version in the environment manifest | PR-15-ROB v1.0 |
| Adversarial testing campaign record (PR-15-ROB output) | Art. 55(1)(a) documented adversarial testing: the attack classes, elicitation methods, success criterion and outcome per attack, and the model version tested | PR-15-ROB v1.0 |
| Systemic risk assessment and mitigation record (Art. 55(1)(b)) | Art. 55(1)(b): the identified risks at Union level, their sources and the mitigation chosen for each, with the measured effectiveness delta | the provider |
| Safety and Security Model Report (GPAI Code of Practice, Safety and Security chapter) | Art. 55(2) route under the GPAI Code of PracticePublished: the model description, the reasons for proceeding and the documentation of identification, analysis and mitigation under Measures 7.1 to 7.3 | the provider |
| Annex XI technical documentation (Annex XI Section 1 and, for systemic risk, Section 2) | Art. 53(1)(a) and Annex XI Section 2: the evaluation strategies and results, the criteria, the metrics, the limitations methodology and the adversarial testing measures | the provider |
| Annex XI and XII completeness and consistency report (PR-11-DOC output) | Art. 53(1)(a): each Annex XI Section 2 row marked present, partial or absent, and each cited evaluation result resolved to a stored record | PR-11-DOC v1.0 |
The evaluation report and the campaign record follow the test report specification and the completeness report follows the findings register specification on the deliverables page, each with a synthetic sample; the Annex XI documentation follows the evidence pack specification, and the Framework and the Model Report are the provider's own documents in the structure the Safety and Security chapter gives them.
If nothing is done
An evaluation run without a written plan, a criterion per scenario and a stored record per result leaves Art. 55(1)(a) without the documented adversarial testing the paragraph names, Annex XI Section 2 without evaluation results that resolve to a record, and a Model Report under Commitment 7 of the GPAI Code of PracticePublished with nothing to cite. Enforcement for general-purpose AI models sits with the Commission: the AI Office can request the documentation under Art. 91, conduct its own evaluation of a model with systemic risk under Art. 92, request measures under Art. 93 up to restriction, withdrawal or recall of the model, and impose a fine under Art. 101(1) for an infringement of Art. 55 or for incorrect, incomplete or misleading information in reply to a request, from the enforcement date In force, with the amount in a given case set under the Art. 101(2) criteria. The action on the provider's side is the sequence above, run before the next release: the scenarios and criteria are extracted from the Framework, each evaluation and attack case is recorded against its criterion at a fixed model version, the results are entered into Annex XI Section 2 and the Model Report, and the re-test triggers are recorded so that the next model version re-runs the same set.
Services, guides and tools for this situation
The GPAI evaluation support service runs the evaluations and the adversarial campaign under PR-15-ROB v1.0 and the Annex XI checks under PR-11-DOC v1.0, within the limits stated on what we cannot do: no statement of adherence to the Code on the provider's behalf, no assessment of alternative adequate means, and no legal opinion on systemic-risk classification.
- Services
- Guides
- ICP hubs
Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.