rego-gpai-55-001

rules/rego/complyedge/gpai/systemic_risk.rego

Citation

Regulation (EU) 2024/1689, Article 55(1)

Condition

Providers of general-purpose AI models with systemic risk shall perform model evaluations, assess and mitigate systemic risks, track and report serious incidents, and ensure adequate cybersecurity.

Layer 1 detects

"systemic risk" (space, hyphen or one word), then the word "no", "not", "without" or "lack" (any ending), then assess, evaluat or mitigat; the word "no", "not", "without" or "lack" (any ending), then "systemic risk" written the same way, then assess or evaluat; "gpai" or "foundation model" (space, hyphen or one word), then systemic, then the word "no", "not" or "without", then mitigat or report; skip, bypass, omit or ignor, then "systemic risk"; and "high capability" or "frontier" (high capability with space, hyphen or one word), then model, then the word "no", "not" or "without", then risk followed later by assess, or "red team" (space, hyphen or one word). Case is ignored, the parts must sit on one line in the order given with any words between them, and a part not called a word can start inside a longer word. It matches wording, not meaning: it does not read the training compute or the designation ("Our 10^26 FLOP model goes public Friday; evals can wait." does not fire), and it fires on text that says the Article does not apply ("Our 2B model is not a systemic-risk model, so no systemic risk assessment is required." fires). Whether a provider of a model with systemic risk skips an Article 55(1) duty is judged in Layer 2.

Condition type

deterministic

Status in the file

approved