Rule set sha256:a7e715b79299
rego-art55-1d-001
One rule of the rule set with digest a7e715b792994b004a7cc9714100077fad036164172ce42812ed396af0b727f5. An audit record that names this digest and this rule was decided by the rule as shown here. Every rule in this set.
| Rule | rego-art55-1d-001 |
|---|---|
| Rule version | 145279183463e858d92a87a910e9f1456e354bdce61b318aa01e2b6d77fcf13d |
| Provision | Regulation (EU) 2024/1689, Article 55(1)(d) ELI: http://data.europa.eu/eli/reg/2024/1689/art_55/par_1/pnt_d/oj |
| Approval | Approved Approved by Leo Celis on 2026-10-22 (via agent review per §5.1 amendment v1.1) |
rules/rego/complyedge/gpai/cybersecurity_gpai.rego
- Citation
- Regulation (EU) 2024/1689, Article 55(1)(d)
- Condition
- A general-purpose AI model with systemic risk, or its physical infrastructure, left without adequate cybersecurity protection.
- Layer 1 detects
- as adjacent words, "systemic risk" (also "systemic-risk"), then gpai or model, then without or no, then cybersecurity or "adequate security", optionally followed by protection, measure or control; and no, without or inadequate, then cybersecurity, then protection or measure (singular), optionally "for", optionally "the", then model, gpai or "physical infrastructure". It matches wording, not meaning: it misses a gap in protection told in other words or in the plural ("no cybersecurity measures for the model"), and it fires on text that only names the gap, such as a refusal or an audit finding with its fix. Whether a model with systemic risk lacks adequate cybersecurity protection is judged in Layer 2.
- Condition type
- deterministic
- Status in the file
- approved