In short. AI Act Article 55 requires providers of systemic-risk general-purpose AI models to evaluate models, mitigate risks, report serious incidents and secure infrastructure.

Definition: Article 55 of Regulation (EU) 2024/1689 sets additional safety and security duties for providers of general-purpose AI models with systemic risk. Systemic risk concerns high-impact model capabilities whose effects can spread across the value chain and significantly affect the EU market, including through harm to health, safety or fundamental rights.

Key facts

Article 55 of the AI Act adds model evaluation, risk assessment and mitigation, serious-incident reporting, and cybersecurity duties to the obligations in Articles 53 and 54.
The Commission's General-Purpose AI Code of Practice, published on 10 July 2025, provides a voluntary compliance route through its Safety and Security chapter.
As of 17 October 2026, the Commission's provider guidelines FAQ states that model-provider obligations apply from 2 August 2025, while models placed on the market before 2 August 2025 have a compliance deadline of 2 August 2027.

Which models fall within Article 55?

A general-purpose AI model can competently perform a wide range of distinct tasks and can be integrated into different systems or applications. Articles 3 and 51 define the relevant concepts and classification rules. High-impact capabilities match or exceed those recorded in the most advanced general-purpose models.

Article 51 presumes high-impact capabilities when cumulative training computation exceeds 10^25 floating-point operations, a measure of computational work. The Commission can also designate a model with equivalent capabilities or impact, including following a qualified alert from the scientific panel. Under Article 52, a provider can submit substantiated arguments that a model meeting the high-impact condition exceptionally lacks systemic risk because of its specific characteristics.

What additional work does Article 55 require?

The legal reference is:

Regulation (EU) 2024/1689
Article 55
Obligations of providers of general-purpose AI models with systemic risk

Article 55(1) requires providers to perform the following work:

Evaluate the model using standardised protocols and tools reflecting the state of the art. This includes conducting and documenting adversarial testing to identify and mitigate systemic risks.
Assess and mitigate possible systemic risks at EU level, including their sources, arising from development, market placement or use of the model.
Track, document and report relevant information about serious incidents and possible corrective measures to the AI Office and, where appropriate, national competent authorities, without undue delay.
Ensure adequate cybersecurity protection for both the model and its physical infrastructure.

Recital 114 describes evaluations particularly before the model is first placed on the market. It also describes continuous risk assessment and mitigation, including monitoring after market placement and measures throughout the model’s lifecycle.

How do providers demonstrate compliance?

Article 55(2) permits reliance on codes of practice until a harmonised standard is published. Compliance with European harmonised standards gives a presumption of conformity to the extent that they cover the obligations. Providers using another route must demonstrate alternative adequate means of compliance for Commission assessment.

The Commission's code publication identifies the Safety and Security chapter as the part addressing Article 55. Its Transparency and Copyright chapters address Article 53. These separate chapters reflect the distinction between general model-provider duties and the additional systemic-risk duties.

What matters for a website publisher?

The obligations attach to the model provider. The Commission's provider guidelines FAQ describes that provider as the entity developing, or commissioning development of, a model and placing it on the market under its own name or trademark.

For a publisher concerned about training content, Article 53 contains the copyright-policy obligation, including respect for rights reservations, and the public training-content summary obligation. Article 55 adds safety and security work for the systemic-risk subset of those providers.

FAQ

Does an open-source licence remove these duties?

The Commission's provider guidelines FAQ confirms that providers of systemic-risk models face the additional obligations even when their models are open source.

Must providers publish their incident reports?

Article 55(1)(c) requires reporting to the AI Office and, where appropriate, national competent authorities. Paragraph 3 subjects information obtained under the article, including trade secrets, to Article 78 confidentiality obligations.

Sources

Check how a page reads to answer engines. Open the GEO score analyzer