Rule set sha256:a7e715b79299

EU_AI_ACT_GPAI_SYSTEMIC_RISK_001

One rule of the rule set with digest a7e715b792994b004a7cc9714100077fad036164172ce42812ed396af0b727f5. An audit record that names this digest and this rule was decided by the rule as shown here. Every rule in this set.

RuleEU_AI_ACT_GPAI_SYSTEMIC_RISK_001
Rule version5cb524e1632d6a428b7a17461b2ced7345775ae9a5885022de8f9bc0664e6e9a
ProvisionRegulation (EU) 2024/1689, Article 55(1)
ELI: http://data.europa.eu/eli/reg/2024/1689/art_55/par_1/oj
ApprovalApproved
Approved by Leo Celis (via agent review per §5.1 amendment v1.1) on 2026-10-22

rules/regulations/eu/eu_ai_act_gpai_systemic_risk.yaml

Citation
Regulation (EU) 2024/1689, Article 55(1): In addition to the obligations listed in Articles 53 and 54, providers of general-purpose AI models with systemic risk shall: (a) perform model evaluation in accordance with standardised protocols and tools reflecting the state of the art, including conducting and documenting adversarial testing of the model with a view to identifying and mitigating systemic risks; (b) assess and mitigate possible systemic risks at Union level, including their sources, that may stem from the development, the placing on the market, or the use of general-purpose AI models with systemic risk; (c) keep track of, document, and report, without undue delay, to the AI Office and, as appropriate, to national competent authorities, relevant information about serious incidents and possible corrective measures to address them; (d) ensure an adequate level of cybersecurity protection for the general-purpose AI model with systemic risk and the physical infrastructure of the model.
Condition
Imposes additional obligations on providers of general-purpose AI models with systemic risk, including models trained with more than 10^25 FLOPs. Article 55(1) of the EU AI Act requires these providers to perform model evaluations, assess and mitigate systemic risks, conduct adversarial testing (red teaming), report serious incidents, and ensure adequate cybersecurity protections.
Layer 1 detects
one sequence on one line: large-scale, systemic-risk, high-capability (each also with a space) or frontier, then model, GPAI, AI model or AI system; then within about 30 characters without, lacking, missing or no, then adversarial test or testing, red team or teaming (also "red-team", "redteam"), incident report or reporting, risk mitigation, model evaluation or safety assessment ("release the frontier model without red teaming"). It matches wording, not meaning: it does not read whether the model has systemic risk, so it misses the practice told in other words ("Our 10^26 FLOP model goes public Friday; evals can wait."), and it fires on text that only names the practice, such as a refusal. Whether a text does the practice is judged in Layer 2.
Condition type
regex; semantic condition in the file, not run by the engine
Status in the file
approved