Article 55: Systemic-Risk Duties of GPAI Providers
Article 55 of the EU AI Act: when a general-purpose AI model has systemic risk, the notification within two weeks, the four extra duties, dates and fines.
Providers of general-purpose AI (GPAI) models with systemic risk owe four extra duties (Article 55(1)). They cover testing, risk mitigation, incident reporting and cybersecurity.
A model has systemic risk if it has high-impact capabilities (Article 51). The Act presumes this above 1025 floating-point operations (FLOPs) of training. Providers must notify the Commission within two weeks (Article 52(1)). The duties have applied since 2 August 2025. Since 2 August 2026 the Commission can fine providers up to 3% of worldwide turnover or EUR 15 million, whichever is higher (Article 101). Next step: compare your training compute with the threshold.
A model has systemic risk if it has high-impact capabilities or the Commission designates it
Compute threshold
High-impact capabilities are capabilities that match or exceed those of the most advanced GPAI models (Article 3(64)). The Act presumes them when the cumulative computation used for training exceeds 1025 floating-point operations (FLOPs). The Commission can amend the threshold by delegated act as technology evolves (Article 51(2) and (3)).
Commission designation
The Commission can also designate a model with capabilities or an impact equivalent to high-impact capabilities, on its own initiative or after a qualified alert from the scientific panel. It uses the criteria of Annex XIII, such as parameters, training data, computation, modalities, benchmarks and reach. A model available to at least 10 000 registered business users established in the Union is presumed to have a high impact on the internal market (Article 51(1)(b), Annex XIII).
Notify the Commission within two weeks
A provider must notify the Commission without delay, and in any event within two weeks, once its model meets the high-impact-capabilities condition of Article 51(1)(a). The two weeks also start when it becomes known that the model will meet the condition. The notification must include the information that shows the condition is met (Article 52(1)).
With the notification, the provider can present substantiated arguments that the model, exceptionally, presents no systemic risk because of its specific characteristics. The Commission decides; if it rejects the arguments, the model counts as having systemic risk (Article 52(2) and (3)). Providers of designated models can send a reasoned request for reassessment, with objective, detailed and new reasons, at the earliest six months after the designation. The Commission publishes and updates a list of GPAI models with systemic risk (Article 52(5) and (6)).
Systemic-risk models carry four more duties
These duties come on top of the duties of Articles 53 and 54 (Article 55(1)). The technical documentation of these models must also describe the evaluation strategies and results. Where applicable, it adds the adversarial testing measures and the system architecture (Annex XI, Section 2).
Evaluate and test the model
Evaluate the model with standardised protocols and state-of-the-art tools. This includes adversarial testing (attacking the model on purpose to find weaknesses) (Article 55(1)(a)).
Assess and mitigate systemic risks
Assess and mitigate possible systemic risks at Union level, including their sources (Article 55(1)(b)).
Report serious incidents
Keep track of serious incidents, document them with possible corrective measures, and report them without undue delay to the AI Office and, as appropriate, to national competent authorities (Article 55(1)(c)).
Protect against cyberattacks
Ensure an adequate level of cybersecurity protection for the model and its physical infrastructure (Article 55(1)(d)).
Codes of practice can show compliance until a harmonised standard exists
Providers can rely on codes of practice (Article 56) to show they meet Article 55, until a harmonised standard is published. Compliance with European harmonised standards gives a presumption of conformity, to the extent that the standards cover these duties. Providers that follow neither an approved code of practice nor a European harmonised standard must demonstrate alternative adequate means of compliance for assessment by the Commission (Article 55(2)). Information obtained, including trade secrets, is treated confidentially (Article 55(3)). Next step: read the Commission’s GPAI Code of Practice.
Open-source models do not escape Article 55
The open-source exemption of Article 53(2) does not apply to models with systemic risk (Article 53(2)). Providers of such models established outside the Union must also appoint an authorised representative (Article 54(6)).
Some uses are outside the Act
The Act does not apply to AI systems where and in so far as they are used exclusively for military, defence or national security purposes. The same holds for placing them on the market or putting them into service for those purposes (Article 2(3)). It does not apply to AI systems or models specifically developed and put into service for the sole purpose of scientific research and development (Article 2(6)). It does not apply to research, testing or development of AI systems or models before they are placed on the market or put into service (Article 2(8)). Testing in real-world conditions is not covered by that exclusion.
Duties apply since 2 August 2025; fines at the earliest from 2 August 2026
Article 113 applies Chapter V (Articles 51 to 56) from 2 August 2025. Chapter XII on penalties applies from the same date with one exception: Article 101 on fines for GPAI providers applies from 2 August 2026 (Article 113).
Providers of models placed on the market before 2 August 2025 have until 2 August 2027 to comply (Article 111(3)). The Commission cannot fine an infringement of the duties by these models before 2 August 2027 (Article 101(1)(a)). Fines under Article 101(1), points (b) to (d), for failing to answer an information request, follow a requested measure or give access for an evaluation, apply from 2 August 2026.
The Commission can fine a provider up to 3% of its total worldwide annual turnover in the preceding financial year or EUR 15 million, whichever is higher (Article 101(1)). Fines apply to intentional or negligent conduct. This covers infringing the relevant provisions, not complying with a requested measure and not giving access to the model for an evaluation. It also covers failing to answer a request for documents or information, and supplying incorrect, incomplete or misleading information. For a model placed on the market before 2 August 2025, the duties must be met by 2 August 2027 (Article 111(3)). An infringement of the Article 53 duties by such a model therefore cannot be fined before then. Conduct under Article 101(1)(b) to (d) can be fined from 2 August 2026. The Commission must first hear the provider (Article 101(2)). The Court of Justice of the European Union can cancel, reduce or increase the fine (Article 101(5)).
What Scanara does for systemic-risk providers
A guided GPAI provider assessment
Scanara walks you through the duties of Articles 53 to 55 for your model and records your answers. You decide which duties apply, with counsel where the stakes warrant.
Annex XI documents, systemic-risk section included
Scanara generates Annex XI documentation from templates, partly pre-filled from your answers. You supply the evaluation results and the model-specific content.
Documents your testing, does not run it
Scanara helps you document model evaluation and adversarial testing. It does not perform them, and it does not decide whether your model has systemic risk.
Common questions: threshold, penalties, start dates and open source
Does my GPAI model fall under Article 55?
Yes, if it has systemic risk. One route: the cumulative computation used for training exceeds the threshold in Article 51(2), which the Act treats as a presumption of high-impact capabilities. The other route: the Commission has designated the model (Article 51(1)). With the notification, you can argue that the model, exceptionally, presents no systemic risk (Article 52(2)). The Commission decides (Article 52(3)).
What happens if we don’t comply?
Since 2 August 2026 the Commission can fine providers. The cap is 3% of worldwide annual turnover or EUR 15 million, whichever is higher (Article 101(1)). Fines apply to intentional or negligent infringements. The Court of Justice of the European Union can cancel, reduce or increase the fine (Article 101(5)).
When do these duties take effect?
Since 2 August 2025 for models placed on the EU market from that date. Models placed on the market before 2 August 2025 have until 2 August 2027 (Article 111(3)). Article 55 applies together with Article 53, which has the same dates.
Is a model under an open-source licence exempt?
No, not if it has systemic risk. The open-source exemption does not apply to models with systemic risk (Article 53(2)), and providers established outside the Union must appoint an authorised representative (Article 54(6)).
Read the detail behind related duties
Article 53: GPAI Provider Duties
Covers the four duties every GPAI provider has, which Article 55 builds on.
GPAI obligations: what model providers and builders must do
Gives the overview for providers and for builders who use a GPAI model through an API.
EU AI Act Deadlines: Complete Timeline
Shows every application date of the Act, GPAI dates included.
Scanara prepares evidence from your repositories
Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.