Article 55: Systemic-Risk GPAI Obligations
Article 55 requires providers of GPAI models classified as posing systemic risk to evaluate their models including documented adversarial testing, assess and mitigate systemic risks at Union level, track and report serious incidents to the AI Office, and maintain adequate cybersecurity for the model and its infrastructure. Compliance can be demonstrated through Codes of Practice under Article 56 until harmonised standards exist.
- 02 Aug 2025 In force since — applies to models already meeting the threshold or classified
- 02 Aug 2026 Full enforcement powers apply
- Perform model evaluation including documented adversarial testing per state-of-the-art protocols.
- Assess and mitigate possible systemic risks at Union level, including risks arising from development, market placement, or use.
- Track, document, and report serious incidents and possible corrective measures to the AI Office and national competent authorities without undue delay.
- Ensure an adequate level of cybersecurity protection for the model and its physical infrastructure.
- Demonstrate compliance via Codes of Practice under Article 56 until harmonised standards exist, or via an own adequacy demonstration assessed by the Commission.
- Treat all information obtained under Article 55 as confidential in line with Article 78.
- Evaluation reports and adversarial testing protocols
- Incident log and reports to the AI Office
- Cybersecurity measures documentation
Systemic-risk duties under Article 55 are sometimes assumed to only start once the Commission issues a formal classification decision; they apply automatically once the compute threshold is met, unless the provider successfully rebuts the presumption.
Unsettled: The exact sub-paragraph (litera) breakdown within Article 55(1) was not returned with full precision by the primary source consulted in the underlying research; check the EUR-Lex text directly for citation in formal documents.
What regulators published on Art. 55
- Loading from the public feed…
- Regulation (EU) 2024/1689 on EUR-Lex
- Look for Article 55
- Deadline changes and the acts behind them
Get told when Art. 55 moves.
Deadlines under this regulation have already shifted once in 2026. A signed webhook, a REST API and an MCP server carry the same record this page is built from, so your systems learn about the next change without anyone re-reading the text. Free during the beta.
Get free accessInformational content only. Not legal advice and not a substitute for qualified counsel. Dates reflect Regulation (EU) 2026/1744 as of 04 Aug 2026.