When is a GPAI model a model with systemic risk: the compute threshold
A general-purpose AI model is a model with systemic risk under Art. 51(1)(a) of Regulation (EU) 2024/1689 when it has high-impact capabilities, presumed under Art. 51(2) once cumulative training compute exceeds 10^25 floating point operations, or under Art. 51(1)(b) when the Commission designates it against the Annex XIII criteria. Classification adds the Art. 55 duties to Art. 53 from the GPAI application date In force. This page gives the compute calculation, the Art. 52 notification, the evaluation sequence, the evidence and the consequence of crossing the threshold unrecorded.
Where this starts
A training run is planned, under way or finished, and the compute budget sits close to the figure in Art. 51(2). The second anxiety on the GPAI hub is whether that run crosses the systemic-risk presumption and which evaluation duties follow. The Act gives two routes into the classification. Art. 51(1)(a) classifies a model that has high-impact capabilities, evaluated on the basis of appropriate technical tools and methodologies, including indicators and benchmarks, and Art. 51(2) presumes those capabilities when the cumulative amount of computation used for training, measured in floating point operations, is greater than 10^25. Art. 51(1)(b) classifies a model the Commission designates, ex officio or after a qualified alert from the scientific panel under Art. 90, as having capabilities or an impact equivalent to that tier against the Annex XIII criteria: the number of parameters, the size or quality of the dataset, the training compute, the input and output modalities, benchmark results, the reach in the internal market, and the number of registered end-users. Annex XIII point (f) presumes a high impact on the internal market when the model has been made available to at least 10 000 registered business users established in the Union. Art. 51(3) lets the Commission amend the compute figure by delegated act and supplement the benchmarks and indicators, so a figure that is met today is re-read against the figure in force at the next model version.
The presumption turns on one number, and the Commission guidelines on GPAI scopePublished state how to produce it. Annex A of the published guidelines gives a hardware-based approach, from accelerator count, peak throughput, training time and utilisation, and an architecture-based approach, from parameter and token counts, and asks the provider to record the approach and the error margin of the estimate. The figure is cumulative, so compute spent on the runs that feed the released model counts towards it, and a modification run on an existing model adds to the base it started from. The provider notifies the Commission under Art. 52(1) without delay and in any event within two weeks after the presumption is met, or after it becomes known that it will be met, with information that demonstrates the figure; where the training plan already shows the outcome, the calculation is due before the run ends. Art. 52(2) lets the notification carry arguments that the model, although above the figure, does not present systemic risk because of its specific characteristics; under Art. 52(3) the Commission accepts or rejects those arguments, and section 2.3.3 of the published guidelines lists what a rebuttal addresses. Art. 52(5) allows a reasoned request for reassessment of a designation, and Art. 52(6) keeps a public list of the models classified.
Classification changes the obligation set in three ways. Art. 55(1) adds model evaluation with documented adversarial testing, systemic-risk assessment and mitigation at Union level, serious-incident reporting to the AI Office and cybersecurity for the model and its physical infrastructure. Annex XI Section 2 adds the evaluation strategies and results, the adversarial testing measures and the system architecture to the technical documentation the provider keeps under Art. 53(1)(a). The free and open-source exceptions in Art. 53(2) and Art. 54(6) stop applying, so a model with public weights still owes the Annex XI and Annex XII content and, for a third-country provider, an authorised representative. No harmonised standard for general-purpose AI models is cited in the Official Journal as of the anchor date, so no presumption of conformity is available under Art. 55(2), and the GPAI Code of PracticePublished is the published route: its Safety and Security chapter asks for a Safety and Security Framework in which the provider names its systemic-risk scenarios, evaluation protocols and acceptance criteria, and a Model Report that carries the results. The risk classifier takes the Art. 51 answer as an input and maps it to the obligation profile on published logic; PR-CLS v1.0 records the figure, the comparison, the designation check and the notification, and marks each determination as a technical assessment for discussion with counsel, since the Commission can classify a model by designation whatever the figure shows.
The sequence
The work runs in the order below: the compute figure and the comparison, then the designation and notification records, then the changed obligation set, then the evaluation and the file.
Calculate the cumulative training compute from the training records and record the approach and error margin.
Record Training compute determination record: cumulative figure in floating point operations, estimation approach, error margin
[Regulation (EU) 2024/1689, Art. 51(2); Commission guidelines on GPAI scope, published, Annex A.2; PR-CLS steps 21 to 22]
Compare the figure with the Art. 51(2) presumption and record whether the presumption is met.
Record Systemic-risk classification record: figure against the Art. 51(2) presumption, outcome
[Regulation (EU) 2024/1689, Art. 51(1)(a) and 51(2); PR-CLS step 23]
Check the Commission's published list and any designation decision under Art. 51(1)(b) against the Annex XIII criteria.
Record Designation check record: Art. 52(6) list consulted, designation decision found or not found
[Regulation (EU) 2024/1689, Art. 51(1)(b) and Annex XIII; PR-CLS step 24]
Record the date the presumption was met or foreseen, the notification date and each Art. 52(2) argument.
Record Notification record: date the presumption was met or foreseen, notification date, interval; rebuttal record, one row per argument
[Regulation (EU) 2024/1689, Art. 52(1) and 52(2); Commission guidelines on GPAI scope, published, sections 2.3 and 2.3.3; PR-CLS steps 25 to 26]
Record that the classification removes the Art. 53(2) and Art. 54(6) exceptions for the model.
Record Open-source exception assessment record, systemic-risk check
[Regulation (EU) 2024/1689, Art. 53(2) last sentence and Art. 54(6); PR-CLS step 30]
Compile the obligation register with the Art. 55 duties and the Annex XI Section 2 elements added.
Record Obligation register with Art. 55 rows and the regulation entry id per date; protocol hand-off list
[Regulation (EU) 2024/1689, Art. 55(1) and Annex XI Section 2; PR-CLS steps 39 to 41]
Confirm the gate from the PR-CLS record and list each systemic risk with its evaluation protocol and acceptance criterion.
Record Classification gate record; systemic risk evaluation plan with protocol, tool set and acceptance criterion per risk
[GPAI Code of Practice, published, Safety and Security chapter, Measures 2.2, 3.2 and 4.1; PR-15-ROB steps 2 and 13]
Run each evaluation with elicitation and the adversarial campaign; record each outcome against its criterion.
Record Evaluation result per systemic risk; attack outcome matrix; mitigation effectiveness delta per mitigation
[GPAI Code of Practice, published, Safety and Security chapter, Measures 3.2 and 5.1; PR-15-ROB steps 12, 27, 31, 32 and 38]
Write the evaluation report per risk and the campaign record, and place both in the Annex XI Section 2 content.
Record Model evaluation report per systemic risk; adversarial testing campaign record; Annex XI Section 2 contribution
[GPAI Code of Practice, published, Safety and Security chapter, Measure 7.3; Regulation (EU) 2024/1689, Annex XI Section 2; PR-15-ROB step 44]
Evidence this situation ends with
| Artifact | Answers | Produced by |
|---|---|---|
| Training compute determination record (PR-CLS output) | Art. 51(2), Art. 51(1)(b) and Art. 52(1): the cumulative figure, the estimation approach and error margin, the comparison with the presumption, the designation check and the notification and rebuttal records | PR-CLS v1.0 |
| Open-source exception assessment record (PR-CLS output) | Art. 53(2) and Art. 54(6): the systemic-risk check that removes the exception for the classified model | PR-CLS v1.0 |
| Safety and Security Framework (GPAI Code of Practice, Safety and Security chapter) | Art. 55(2) and Art. 55(1)(b): the systemic-risk scenarios, the evaluation protocols and the acceptance criteria the provider sets | the provider |
| Model evaluation report per systemic risk (PR-15-ROB output) | Art. 55(1)(a): the evaluation protocol, tool set and elicitation method per risk, and the result against the acceptance criterion | PR-15-ROB v1.0 |
| Adversarial testing campaign record (PR-15-ROB output) | Art. 55(1)(a): the attack classes, the elicitation methods, the success criterion and outcome per attack, and the model version tested | PR-15-ROB v1.0 |
| Systemic risk assessment and mitigation record (Art. 55(1)(b)) | Art. 55(1)(b): the risks identified at Union level, their sources across development, placing on the market and use, the mitigation per risk and the measured effectiveness delta | the provider |
| Annex XI technical documentation (Annex XI Section 1 and, for systemic risk, Section 2) | Art. 53(1)(a) and Annex XI Section 2: the evaluation strategies and results, the adversarial testing measures and the system architecture | the provider |
| Serious incident register and reporting procedure (Art. 55(1)(c)) | Art. 55(1)(c): the relevant information per incident, the possible corrective measures and the reporting path to the AI Office | the provider |
The training compute determination record and the open-source exception record follow the assessment memo specification on the deliverables page, the evaluation report and the campaign record follow the test report specification, the Annex XI contribution follows the evidence pack specification and the incident register follows the register or checklist specification, each with a synthetic sample.
If nothing is done
A model that crosses the Art. 51(2) figure without a recorded calculation leaves the Art. 52(1) notification unmade and the Art. 55(1) duties unassigned: no evaluation with documented adversarial testing under Art. 55(1)(a), no systemic-risk assessment under Art. 55(1)(b), no incident reporting path under Art. 55(1)(c) and no cybersecurity record under Art. 55(1)(d), while the Annex XI documentation lacks its Section 2 and a model released under an open licence lacks the Annex XI and Annex XII content that the lost Art. 53(2) exception no longer excuses. Enforcement for general-purpose AI models sits with the Commission: under Art. 52(4) it can designate the model on its own initiative or after a qualified alert, under Art. 91 request the documentation, under Art. 92 evaluate the model, under Art. 93 request measures, and under Art. 101(1) impose a fine for an infringement of Chapter V, for incomplete or misleading information in reply to a request, or for a failure to give access for evaluation, from the enforcement date In force; the amount in a given case is set under the Art. 101(2) criteria. The action on the provider's side is the sequence above: the cumulative figure is calculated with its approach and error margin before the run ends, the notification is made within the Art. 52(1) period with any rebuttal attached, and the evaluation plan, the campaign and the Annex XI Section 2 content are in the file before the model is placed on the market.
Services, guides and tools for this situation
The GPAI evaluation support service opens with the compute determination and the notification record under PR-CLS v1.0 and runs the evaluations and the adversarial campaign under PR-15-ROB v1.0, within the limits stated on what we cannot do: the compute calculation checks the estimation approach and the arithmetic on the records supplied and cannot re-run training, no legal opinion is given on the classification, and no statement of adherence to the Code of Practice is made on the provider's behalf. Where the campaign extends to a language model's full attack set, the robustness and adversarial testing service runs the same protocol against the Art. 15(5) attack classes.
- Guides
- ICP hubs
Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.