GPAI evaluation support

Deliverables

The set is designed to satisfy a documentation request from the AI Office under Art. 53(1)(a), the information a downstream AI system provider needs under Art. 53(1)(b), and the evaluation and adversarial testing documentation that Annex XI Section 2 and Art. 55(1)(a) ask of a model with systemic risk. The evaluation report and the adversarial testing documentation are test reports; the Annex XI contribution and the Annex XII pack form an evidence pack; the serious-incident template is a register. The specification and a synthetic sample of each type are on the deliverables page.

Who this is for

• GPAI providers

An organisation that trains a general-purpose AI model, or fine-tunes one far enough to become its provider under the criteria in the Commission guidelines on GPAI scopePublished, carries the Art. 53 technical documentation and downstream-information duties, the copyright policy and the training-content summary. Above the Art. 51 systemic-risk threshold it also carries the Art. 55 evaluation, adversarial testing, incident reporting and cybersecurity duties. A provider established outside the Union appoints an authorised representative under Art. 54 before placing the model on the Union market, and the representative holds the Annex XI copy the AI Office can ask for. The Safety and Security chapter of the GPAI Code of PracticePublished describes what evaluation and adversarial testing evidence looks like, and its content is the reference for signatories and non-signatories alike, since a non-signatory demonstrates alternative adequate means against the same duties under Art. 53(4) and Art. 55(2).

The Art. 53 to 55 duties apply from the GPAI application date 2025-08-02In force, and the Commission's powers to request information and to fine a provider under Art. 101 apply from the enforcement date 2026-08-02In force; both entries are shown with their verified source:

• 2025-08-02In forceGPAI obligations, Art. 53-55
• 2026-08-02In forceCommission enforcement powers for GPAI (fines, requests for information)

Scope

The engagement covers one general-purpose AI model at a fixed version, recorded with its version hash, inference configuration and random seeds. PR-CLS v1.0 opens the engagement with the determinations that decide which duties apply: whether the model meets the Art. 3(63) definition against the indicative criteria in the Commission guidelines on GPAI scopePublished, whether a fine-tuning or continued-training run makes the modifier the provider of a new model, whether cumulative training compute crosses the Art. 51(2) presumption, whether the Art. 53(2) and Art. 54(6) free and open-source exception holds on the licence text and the retrievability of the weights, and, for a third-country provider, whether the Art. 54 written mandate lists every task and the representative can produce the Annex XI copy from its own custody. PR-11-DOC v1.0 then checks the documentation elements of Art. 53 that produce an observable result: Annex XI and Annex XII completeness against every point, cross-document consistency between the technical documentation, the downstream pack and the public model card, the declared input and output limits against observed behaviour at and beyond those limits, the traceability of every cited evaluation result to a stored record, and the structure of the published training-content summary against the AI Office template. For a model with systemic risk, PR-15-ROB v1.0 covers the testable elements of Art. 55 beyond the classification gate: an evaluation per identified systemic risk against the acceptance criterion in the provider's Safety and Security Framework, an adversarial campaign with a success criterion per attack, the mitigation effectiveness delta measured by re-running the same set after each mitigation, and attempts on the model itself under a documented threat model, covering weight access, extraction through the serving interface, training-data poisoning and prompt injection.

No harmonised standard for general-purpose AI models is cited in the Official Journal as of the anchor date on the standards page, and no JTC 21 draft covers these models, so no presumption of conformity is available under Art. 53(4) or Art. 55(2) today. The route the Act offers instead is a code of practice under Art. 56, and the GPAI Code of PracticePublished is the published one: its Transparency chapter supplies the Model Documentation Form that PR-11-DOC v1.0 uses as the field-level structure for Annex XI and Annex XII, its Copyright chapter supplies the measures behind the Art. 53(1)(c) policy, and its Safety and Security chapter supplies the Safety and Security Framework, the Model Report and the serious-incident reporting practice that PR-15-ROB v1.0 tests against. NIST AI RMF 1.0Published supplies the rationale for selecting each evaluation metric, and ISO/IEC TR 24029-1:2021Published supplies the statistical, formal and empirical method categories that structure the adversarial campaign.

Out of scope are the documentation and process elements of the same articles, which are inputs, and several elements that no protocol on this site tests. The content of the copyright policy under Art. 53(1)(c) is checked for presence only. The compute and energy figures under Annex XI Section 1 points 2(d) and 2(e) are checked for the records behind them; the protocol cannot re-run training or verify hardware utilisation. The physical infrastructure under Art. 55(1)(d) and the live serious-incident path under Art. 55(1)(c) are not tested; the engagement delivers the tracking template and records the reporting procedure. The evaluation is the one the provider's Safety and Security Framework names; it is the independent external evaluation described in Appendix 3.5 of the Safety and Security chapter only where the engagement is scoped as one. No conformity assessment procedure applies to a general-purpose AI model as such: the AI Office supervises the provider, may request the documentation under Art. 91 and may evaluate the model under Art. 92, and a Commission designation under Art. 51(1)(b) can classify a model as presenting systemic risk regardless of the compute figure. Each determination record is a technical assessment for discussion with counsel; the legal opinion on classification belongs to counsel, and the classification decision belongs to the provider and the Commission.

Where a model generates synthetic audio, image, video or text, the Annex XII information may describe the marking technique the provider applies under Art. 50(2). PR-11-DOC v1.0 records the statement and its consistency with the technical documentation; whether the technique is adequate is an unsettled point, and the marking tests run under PR-50-MARK v1.0 in the Article 50 marking and detection service.

What we test

The table lists every testable element of the covered obligations with the protocol that runs it and the artifacts it produces for the record; documentation and process elements are listed in the inputs section below.

Regulation (EU) 2024/1689 sets no test threshold in Art. 53, Art. 54 or Art. 55, so every pass criterion comes from a six-level hierarchy. Level one is a harmonised standard cited in the Official Journal, and none is cited as of the anchor date, so no presumption of conformity exists for any criterion. Level two is a JTC 21 draft, and none covers general-purpose AI models. Level three is an ISO/IEC document: ISO/IEC TR 24029-1:2021Published supplies method categories and no numeric pass level. Level four is a Commission guideline or code of practice, and it is the level in use: under Measure 4.1 of the GPAI Code of PracticePublished the provider sets its own systemic-risk acceptance criteria in the Safety and Security Framework, and the Commission guidelines on GPAI scopePublished give indicative criteria for model status and for when a modifier becomes a provider, stated as rebuttable. Level five is NIST AI RMF 1.0Published for the metric selection rationale. Level six is the state of the art, justified by the provider. The one figure in the Act near these articles is a classification gate: Art. 51(2) presumes high-impact capabilities when cumulative training compute, measured in floating point operations, is greater than 10^25, and Art. 51(3) lets the Commission amend the figure by delegated act. Where no published threshold exists, the target-justification step of PR-15-ROB v1.0 and the determination-rationale step of PR-CLS v1.0 record the provider's target, its source level and the reason it fits the model's release context; the report shows the measured value next to that target.

Protocols used

Three versioned protocols run the engagement in sequence; each page states every step with the standard clause, guideline section or Act provision it derives from.

• PR-15-ROB v1.0Robustness and adversarial testing protocolv1.0
• PR-CLS v1.0Classification and role determination protocolv1.0
• PR-11-DOC v1.0Annex IV documentation assembly and consistency protocolv1.0

PR-CLS v1.0 covers general-purpose AI model status, provider status after modification, the Art. 51(2) compute gate, the Art. 52(1) notification record, the free and open-source exception and the Art. 54 mandate and retrieval exercise. It produces the training compute determination record, the provider determination record, the open-source exception assessment record and the Article 54 applicability and exception determination memo, each with the rationale for every judgement the guidelines leave to the provider. It does not give a legal opinion on classification; the AI Office or a court can reach a different result, and the compute calculation checks the estimation approach and the arithmetic on the training records supplied; it cannot re-run the training.

PR-15-ROB v1.0 covers the evaluation, adversarial testing, mitigation effectiveness and model cybersecurity elements of Art. 55 in four phases: preparation, execution, analysis and reporting. It produces the model evaluation report per systemic risk and the adversarial testing campaign record, each with the environment manifest, the evaluation plan, the tool set, the elicitation method and the result against the acceptance criterion or the success criterion. It does not show that an acceptance criterion is the appropriate one, and an adversarial result holds only for the attack methods, budgets and access levels in the recorded attack set; the protocol cannot show the absence of attacks outside that set.

PR-11-DOC v1.0 covers Annex XI and Annex XII completeness, cross-document consistency, the declared input and output limits, evaluation result traceability and the training-content summary structure. It produces the Annex XI and XII completeness and consistency report, with a gap table on the Model Documentation Form fields, a consistency table across the technical documentation, the downstream pack and the public model card, and an observation log for the declared limits. It shows presence, consistency and traceability; it does not show that a declared value is correct, does not judge whether the Annex XII information gives a downstream provider a good understanding of the model under Art. 53(1)(b), and does not assess the copyright policy.

Engagement shape

The engagement is fixed-scope and scoped per request; the classification and readiness assessment is the entry service and, where it has run, its obligation register fixes which of the three articles and which model versions are in scope. The provider supplies model access at a fixed version, the model card, licence text and distribution channel list, the training records for the original model and for any modification run, the Annex XI documentation and the Annex XII pack as they stand, the public training-content summary, the copyright policy, and, for a model with systemic risk, the Safety and Security Framework with its risk scenarios, evaluation protocols and acceptance criteria, plus read access to the weight store and the training repository where the threat model puts them in scope. A third-country provider also supplies the written mandate, and the authorised representative supplies its custody records.

The work follows the order of the protocols. PR-CLS v1.0 runs first and writes the determination records that gate the rest: its training compute determination record is an input to PR-15-ROB v1.0, and its provider determination and open-source exception records are inputs to PR-11-DOC v1.0. PR-15-ROB v1.0 then writes the environment manifest, fixes the evaluation plan and the attack set with a criterion per item, executes the evaluations, the campaign and the cybersecurity attempts against the fixed version, compares each result with its criterion and reports. PR-11-DOC v1.0 runs last so that the evaluation results it traces are the ones just recorded: it freezes the input set, walks every Annex XI and Annex XII point, reconciles the technical documentation, the downstream pack and the model card, observes the declared limits and writes the completeness and consistency report. Re-measurement after a model version change is the regression testing service.

What we cannot do

• We do not perform conformity assessments where a notified body is required.
• We do not issue CE marking or the EU Declaration of Conformity.
• We are not a notified body.
• We do not give legal opinions on classification or liability.
• We test against requirements, prepare evidence, and structure documentation; compliance decisions remain with the provider or deployer, their notified body, and their counsel.

Read the full statement

For this service the limit means that the provider determination record and the training compute determination record are reasoned technical assessments for discussion with counsel, and the Commission can reach a different result by designation under Art. 51(1)(b). We issue no statement of adherence to the Code of Practice and no assessment of alternative adequate means; the first is the provider's declaration and the second is the Commission's assessment under Art. 53(4) and Art. 55(2). A model evaluation report states a result next to the acceptance criterion the provider set; it does not state that the criterion is appropriate.

What the client must have ready

The documentation and process elements of the covered obligations are inputs to the test; the list below is generated from the obligation records.

The inputs take the form the protocol pages specify: an inference endpoint or local runtime at the declared input and output limits, a spreadsheet or log export per training run with accelerator type and count, training time and utilisation or architecture and token counts, and digital documents with version identifiers for the Annex XI set, the Annex XII pack, the model card, the licence, the mandate and the Safety and Security Framework. A missing input is recorded as missing in the report; no protocol substitutes a value for it.

Questions

+−When does a GPAI model have systemic risk?

Art. 51(1)(a) classifies a general-purpose AI model as a model with systemic risk when it has high-impact capabilities, evaluated with technical tools and methodologies including indicators and benchmarks. Art. 51(2) presumes high-impact capabilities when the cumulative training compute, measured in floating point operations, is greater than 10^25; Art. 51(3) lets the Commission amend that figure. Art. 51(1)(b) adds a model the Commission designates against the Annex XIII criteria. PR-CLS calculates the compute from the training records and records the comparison, the classification and any Art. 52(1) notification.

+−What do signatories of the GPAI Code of Practice have to do?

A signatory demonstrates the Art. 53(1) duties, and for a model with systemic risk the Art. 55(1) duties, through the measures of the GPAI Code of Practice. The Transparency chapter asks for the Model Documentation Form, kept up to date. The Copyright chapter asks for a policy that identifies machine-readable rights reservations. The Safety and Security chapter asks for a Safety and Security Framework, evaluations with adversarial testing, mitigations, a Model Report and incident reporting. PR-11-DOC and PR-15-ROB check the evidence against the measures of the Code.

+−What is an authorised representative under the EU AI Act?

Under Art. 54(1) a provider of a general-purpose AI model established outside the Union appoints, by written mandate and before placing the model on the Union market, an authorised representative established in the Union. Under Art. 54(3) the representative verifies the Annex XI documentation and the Art. 53 and Art. 55 duties, keeps a copy of that documentation, and answers reasoned requests from the AI Office. Art. 54(6) exempts open-source models with public parameters unless the model presents systemic risk. PR-CLS verifies the mandate and runs a retrieval exercise.

+−What are the GPAI model obligations?

Art. 53(1) requires the provider of a general-purpose AI model to keep technical documentation with the Annex XI content, to give downstream providers information with the Annex XII content, to put in place a copyright policy that identifies rights reservations, and to publish a training-content summary in the AI Office template. Art. 54 adds an authorised representative for a third-country provider. Art. 55 adds evaluation, adversarial testing, risk mitigation, incident reporting and cybersecurity for a model with systemic risk. PR-CLS, PR-11-DOC and PR-15-ROB test the observable elements.

+−Which guidelines exist for providers of general-purpose AI models?

Two published Commission documents apply. The Commission guidelines on GPAI scope give the criteria for what counts as a general-purpose AI model, an indicative compute-fraction criterion for when a modifier becomes a provider, the conditions of the Art. 53(2) open-source exception and Annex A on estimating training compute. The GPAI Code of Practice, drawn up under Art. 56, gives the measures a provider may rely on under Art. 53(4) and Art. 55(2). No harmonised standard for general-purpose AI models is cited in the Official Journal as of the anchor date.

Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.

Ask about scopehello@aiassurancelabs.com