EU AI Act Article 55(1)(b)

Where this comes from

Who it applies to

What engineering work it implies

Related obligations

Where the same control satisfies more than one framework — comply once, cover many.

• EU Artificial Intelligence ActPrerequisite
  Assess GPAI high-impact capabilities and Commission designation, including the greater-than-10^25 FLOP presumption and Article 52 notification procedureArticles 51 and 52 - GPAI systemic-risk classification and notification
• EU Artificial Intelligence ActComplements
  Systemic risk GPAI providers must conduct adversarial testing (red-teaming) using state-of-the-art protocols and document the results, with a view to identifying and mitigating systemic risksArticle 55(1)(a) - Obligations for providers of general-purpose AI models with systemic risk: model evaluation and adversarial testing
• EU Artificial Intelligence ActComplements
  Track, document and report serious incidents and possible corrective measures without undue delay under Article 55(1)(c)Article 55(1)(c) - Serious-incident tracking, documentation and reporting for systemic-risk GPAI
• EU Artificial Intelligence ActComplements
  Systemic risk GPAI providers must implement adequate cybersecurity measures protecting both the model itself and the physical infrastructure on which it runsArticle 55(1)(d) - Cybersecurity of systemic-risk GPAI models and their physical infrastructure

Evidence an auditor expects

• Assessment documentDocument review

  Article 55(1)(b) Union-level systemic-risk assessment

  Model-specific assessment of possible Union-level systemic risks and their sources from development, market placement and use; record plausible pathways, impact, uncertainty and residual risks. An incident register or evaluation report alone does not complete this assessment.

• Process recordDocument review

  Systemic-risk mitigation and effectiveness evidence

  Link identified risks and sources to implemented mitigations, owners, effectiveness evidence and remaining gaps. Justify reassessment cadence without inventing an annual certification or a universal 72-hour report. Protect confidential material and use a justified retention policy.

Questions people ask

Does EU AI Act Article 55(1)(b) apply to my service?

It applies when Project involves providing a general-purpose AI model (GPAI); GPAI assessed Union model scope: YES; GPAI assessed Article 51 classification: YES.

When does this become enforceable?

EU AI Act Article 55(1)(b) is enforceable from 2 August 2025. Its current status is: in force.

What evidence does an auditor expect?

Article 55(1)(b) Union-level systemic-risk assessment; Systemic-risk mitigation and effectiveness evidence.