European UnionAI Act, Article 55 (obligations for providers of general-purpose AI models with systemic risk)
Regulation (EU) 2024/1689, Article 55
In force since .
An AI governance rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting
- Audit expectation
- none
What it requires
- If your general-purpose AI model is classified as a model with systemic risk under Article 51, whether by high-impact capabilities (presumed above 10^25 floating-point operations of training) or by a Commission decision, in addition to your Article 53 duties, perform model evaluation using standardised, state-of-the-art protocols and tools, including conducting and documenting adversarial testing to identify and mitigate systemic risks.NIST AI RMFMEASURE 2.7
- Assess and mitigate the systemic risks your model may pose at Union level, including where those risks originate, whether in the model's development, its placing on the market, or its use.NIST AI RMFMAP 5.1NIST AI RMFMANAGE 1.3
- Keep track of, document, and report to the AI Office, and as appropriate to national competent authorities, without undue delay, relevant information about serious incidents involving your model and any corrective measures you have taken or plan to take. The Regulation states no fixed number of days for this report and no explicit moment its clock starts from, only that it must be made without undue delay.NIST AI RMFMANAGE 4.3
- Ensure an adequate level of cybersecurity protection for your model and its physical infrastructure.NIST AI RMFMEASURE 2.7
- You may rely on an AI Office code of practice, or a harmonised standard once one is published, to demonstrate compliance with these duties. If you rely on neither, demonstrate an alternative adequate means of compliance instead.
These lines are LexLint's reading of the law's text. Also read by: General-Purpose AI Code of Practice (Transparency, Copyright, and Safety and Security chapters) (guidance from the European Commission, issued ); European Commission (guidance, recorded ).
In the frameworks
- NIST AI RMF
- MAP 5.1Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented.
- MEASURE 2.7AI system security and resilience – as identified in the MAP function – are evaluated and documented.
- MANAGE 1.3Responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented. Risk response options can include mitigating, transferring, avoiding, or accepting.
- MANAGE 4.3Incidents and errors are communicated to relevant AI actors, including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalty structure
Article 101(1): the Commission may fine a provider of a general-purpose AI model up to 3% of its annual total worldwide turnover in the preceding financial year or EUR 15,000,000, whichever is higher, where it finds that the provider intentionally or negligently infringed the relevant provisions of the Regulation (point (a)) or committed one of the failures listed in points (b) to (d). Article 101 has no lower-of rule for an SME: Article 99(6) limits its rule to each fine referred to in Article 99, and Article 99(6a), inserted by Regulation (EU) 2026/1744, limits its own to the fines referred to in Article 99(4) and (5). Article 101 applies from , the Regulation's general date of application, since Article 113, third paragraph, point (b), excepts it from the earlier date it gives Chapter V, which carries Article 55.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 15,000,000
- Turnover percentage cap
- 3
Who enforces it
Settledness
- As of
- Guidance link
- https://digital-strategy.ec.europa.eu/en/faqs/guidelines-obligations-general-purpose-ai-providers
- Guidance body
- European Commission
- Open questions
- Within how many days must a provider report a serious incident to the AI Office under Article 55(1), point (c), when the provision says only 'without undue delay'?
- Which events make an incident involving a general-purpose AI model 'serious' for Article 55(1), point (c), when the term 'serious incident' is defined in Article 3, point (49), for AI systems?
What it makes you log
Logging duty
In addition to the duties Article 53 places on providers of general-purpose AI models, a provider whose model is classified as carrying systemic risk must keep track of, document, and report serious incidents involving the model, without undue delay, to the AI Office and, as appropriate, national competent authorities. The Article states no fixed number of days and no period the record must be kept for. The clause's own verb is "document", a duty to be able to demonstrate rather than a named log: it never uses "logs", "records", "event recording" or "audit trail". This reading matches Article 73's parallel serious-incident duty, which reads the same way for the same textual reason. The Article requires reporting to the AI Office; the AI Office's power to request documentation and information from a provider is Article 91's, not this Article's.
- Kind
- Implicit
- As of
- Provision
- Article 55(1), point (c)
- Trigger
- security_incident
Why the legislator wanted it
- As of
- Quote
- the general-purpose AI model provider should without undue delay keep track of the incident and report any relevant information and possible corrective measures to the Commission and national competent authorities
- Source link
- https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
- Source kind
- Recital
- Purpose
- incident_reconstruction
- regulator_supervision
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32024r1689
What this law does
Article 55 binds providers of general-purpose AI models with systemic risk, in addition to the disclosure and copyright duties Article 53 places on providers of general-purpose AI models. The open-source exemption in Article 53(2) from the duties in Article 53(1), points (a) and (b), never applies to a model with systemic risk. A model is presumed to carry systemic risk when its training used more than 10^25 floating-point operations.
The Commission may also designate a model this way on the basis of equivalent capabilities or impact. Those providers must perform model evaluation using standardised, state-of-the-art protocols, including adversarial testing to identify and mitigate systemic risks. They must also assess and mitigate the systemic risks their model may pose at Union level, including where those risks originate.
They must keep track of, document, and report to the AI Office, and as appropriate to national competent authorities, without undue delay, relevant information about serious incidents involving their model and any corrective measures. And they must maintain an adequate level of cybersecurity protection for the model and its physical infrastructure.
The reporting duty names no fixed number of days and no explicit moment the clock runs from; it states only that the report must be made without undue delay. Article 73's reporting duty for high-risk AI systems sets a general ceiling of 15 days running from when the provider or, where applicable, the deployer becomes aware of the incident. That ceiling tightens to 10 days where the incident caused a person's death.
It tightens to 2 days for a widespread infringement or a serious and irreversible disruption of critical infrastructure. 'Serious incident' is defined once, in Article 3, point (49), for the whole Regulation, as an incident or malfunctioning that leads to a person's death or serious harm to health, a serious and irreversible disruption of critical infrastructure, an infringement of Union law protecting fundamental rights, or serious harm to property or the environment.
That definition is written for an AI system, a term the Regulation defines in Article 3, point (1). A general-purpose AI model is a separate defined term in the same Article. Article 55 supplies no definition of a serious incident keyed to a model rather than a system. A provider may rely on an AI Office code of practice, or a harmonised standard once one is published, to demonstrate compliance with these duties, and must show an alternative adequate means of compliance if it relies on neither.
Article 113's third paragraph, point (b), applies Chapter V, which contains Article 55, from , a year ahead of the Regulation's general application date. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since ) left that point unchanged, replacing only points (a) and (c) and adding point (d). A provider whose model was already on the market before that date has until to come into compliance.
Guidance on this law
How the bodies that enforce this law read it. Guidance binds nobody by itself, so LexLint never raises a finding from it; the duty is this law's.
- General-Purpose AI Code of Practice (Transparency, Copyright, and Safety and Security chapters), the European Commission
When LexLint raises it
When your app profile says your app provides a general-purpose AI model.
Back to the example · Lint your app
Page updated .