AI Vocabulary · 08 Rules & Responsibility
What is Systemic Risk?
Under the EU AI Act, the risk that the most powerful general-purpose models pose to society as a whole. It brings extra duties for their providers.
The EU AI Act treats a small group of general-purpose AI models differently: those whose high-impact capabilities could have significant effects on the EU market, on public health, safety, security, fundamental rights or society as a whole, and could spread at scale across the value chain (Article 3).
A model is classified this way if it has high-impact capabilities, or if the European Commission decides so. High-impact capabilities are presumed when the cumulative compute used to train the model is greater than 10^25 floating-point operations (Article 51). The Commission can adjust this threshold.
Providers of such models have additional duties under Article 55: evaluate the model with state-of-the-art methods, including documented adversarial testing (red teaming); assess and mitigate systemic risks; report serious incidents without undue delay; and ensure adequate cybersecurity. A voluntary Code of Practice, published in July 2025, has a separate chapter on safety and security for these providers.
Why it matters for you
These duties fall on the makers of the largest frontier models, not on companies that use them. For you, they mainly mean more information and testing from your providers.
Own it
If you build on a frontier model, ask your provider whether it is classified as posing systemic risk and whether it has signed the Code of Practice. Keep the answer with your vendor records. This entry is an overview, not legal advice.
Where it comes from
The definition is Article 3(65) of Regulation (EU) 2024/1689, the classification Article 51 and the duties Article 55. The General-Purpose AI Code of Practice was published by the Commission on 10 July 2025.
Related
Your AI Learning Hub
Learn the whole AI Vocabulary, step by step, and build with it. Build it. Own it.