In short
- Article 51(2) presumes systemic risk once training compute exceeds 10^25 floating point operations, and Article 52(1) gives the provider 2 weeks to notify the Commission.
- The four Article 55(1) duties, evaluation, risk mitigation, serious incident reporting and cybersecurity, are owed to the AI Office. None of them creates a report addressed to the customer.
- The GPAI Code of Practice sets initial serious incident reports at 2, 5, 10 or 15 days depending on the harm, but those reports go to the AI Office, so a buyer learns of them only by contract.
- What the law routes to a buyer is Article 53(1)(b) documentation with the Annex XII minimum, and for systemic risk models the open-source exception in Article 53(2) does not apply.
- Models placed on the market before 2 August 2025 have until 2 August 2027 under Article 111(3), which is the gap a contract has to cover in the meantime.
Procurement teams usually learn about a systemic risk designation from the vendor’s own announcement, and the first internal question is whether it changes anything for the buyer.
It changes the vendor’s obligations a great deal and yours very little, unless the contract carries the vendor’s new duties across. Regulation (EU) 2024/1689 sends almost everything Article 55 produces to the AI Office.
01How does a model become systemic risk under Article 51?
By crossing a compute line, or by a Commission decision.
| Route | Trigger | Provision |
|---|---|---|
| Compute presumption | Training compute above 10^25 FLOP | Article 51(2) |
| Provider notification | Within 2 weeks of meeting, or knowing it will meet, the condition | Article 52(1) |
| Commission designation | Equivalent impact under Annex XIII criteria | Article 52(4) |
| Reach presumption | At least 10 000 registered business users in the Union | Annex XIII(f) |
| Reassessment request | No earlier than 6 months after designation | Article 52(5) |
Two details matter to a buyer. A provider that crosses the compute line may argue under Article 52(2) that its model exceptionally does not present systemic risk, so a model above 10^25 FLOP is not automatically on anyone’s list. And the Annex XIII reach presumption means a model can be designated because of how many businesses use it, which puts popular mid-sized models within range, not only frontier ones.
Article 52(6) requires the Commission to publish and maintain a list of systemic risk models. A written statement from the provider remains the safer record, because it can be attached to the contract.
02Which Article 55 duties are owed to the regulator rather than to you?
All four of them.
Article 55(1) adds, on top of the Article 53 and 54 duties, model evaluation with documented adversarial testing, assessment and mitigation of systemic risks at Union level, tracking and reporting of serious incidents, and an adequate level of cybersecurity for the model and its physical infrastructure. Every one of those produces evidence for the AI Office and, where appropriate, national competent authorities. Article 55(3) then routes that material into the Article 78 confidentiality regime.
The Commission enforces this directly. Article 101 allows fines on model providers of up to 3 % of annual worldwide turnover or EUR 15 000 000, whichever is higher, and Article 113 applies Article 101 from 2 August 2026 rather than from the 2 August 2025 start of Chapter V. That exposure sits with the vendor. It gives the vendor a reason to run a proper programme, and gives you no right to inspect it.
03Where does a serious incident at your vendor get reported?
To the AI Office, on clocks the GPAI Code of Practice sets out.
Article 55(1)(c) requires reporting “without undue delay” and sets no day count. The Safety and Security chapter of the General-Purpose AI Code of Practice, published on 10 July 2025, does, for providers that sign it.
| Harm the model was involved in | Initial report | Recipient |
|---|---|---|
| Serious, irreversible disruption of critical infrastructure | 2 days | AI Office |
| Serious cybersecurity breach, incl. weight exfiltration | 5 days | AI Office |
| Death of a person | 10 days | AI Office |
| Serious harm to health, rights, property or environment | 15 days | AI Office |
| Unresolved incident update | Every 4 weeks | AI Office |
| Final report | 60 days after resolution | AI Office |
The customer does not appear in the recipient column. Measure 9.1 does ask signatories to make it easier for downstream providers and users to report incidents to them, which runs the channel toward the vendor, not away from it.
If your own system is high-risk, you may also be running the Article 73 clocks of 2, 10 or 15 days, and an incident rooted in the vendor’s model is exactly the case where you need the vendor’s facts faster than the regulator does.
04Why is Article 53(1)(b) documentation the only statutory flow to a buyer?
It is owed to providers of AI systems who integrate the model, and it has a floor.
Article 53(1)(b) requires the model provider to draw up, keep up to date and make available documentation that gives integrators a good understanding of capabilities and limitations and lets them comply with their own obligations. Annex XII sets the minimum: tasks and the systems the model can go into, acceptable use policies, release date and distribution methods, software versions, architecture and number of parameters, input and output modalities and their maximum size, the technical means of integration and, where applicable, information on training, testing and validation data.
Two points sharpen this for systemic risk models. Article 53(2) exempts open-source models from the documentation duties, but that exception does not apply to general purpose models with systemic risk, so an open-weight systemic risk model still owes you Annex XII. And models placed on the market before 2 August 2025 have until 2 August 2027 under Article 111(3), so an older model may lawfully still be catching up.
Two limits narrow the Article 53(1)(b) duty. It is addressed to providers of AI systems who intend to integrate the model, so an organisation that only uses the vendor’s own finished assistant is not the party it names. And it applies without prejudice to intellectual property and trade secrets, which is the clause a vendor will cite when Annex XII detail on training data comes back thin. Neither limit removes the floor: the Annex XII elements are a minimum, and a vendor that supplies less is short of Article 53, whatever its confidentiality position.
Article 53(1)(b) says nothing about notice of version changes, access to evaluation results, or incident alerts. Those exist only if someone writes them into the agreement.
05Does Article 55 cybersecurity protect your data, or only the model?
Article 55(1)(d) covers “the general-purpose AI model with systemic risk and the physical infrastructure of the model.” Commitment 6 of the Code’s Safety and Security chapter frames the aim as preventing unauthorised release, unauthorised access and model theft, so the systemic risks are acceptable.
That is weight security, not tenant security. Your prompts, retrieved documents and outputs are protected by your data processing terms and the vendor’s general security commitments, which a systemic risk designation neither strengthens nor replaces. A security questionnaire that treats the designation as a proxy for data protection is asking the wrong question.
The designation is still useful evidence of a different kind. A provider bound by Article 55(1)(d) has to define which threat actors its protections are meant to stop, under Measure 6.1 of the Code, and a buyer can reasonably ask whether its own deployment inherits any of those controls or sits outside them.
06What should a buyer write into the contract after a designation?
The information flows the Regulation sends elsewhere.
| Ask | Legal basis | Statutory or contractual |
|---|---|---|
| Annex XII documentation, kept current | Article 53(1)(b) | Statutory |
| Written statement of systemic risk status | Articles 51, 52 | Contractual |
| Incident notice within the Code's 2 to 15 day window | Article 55(1)(c) | Contractual |
| Summary of the Safety and Security Model Report | Code, Measure 10.2 | Contractual |
| Code signatory status or alternative means | Article 55(2) | Contractual |
| Version change notice before deprecation | None | Contractual |
The incident clause is the one with the clearest value. A vendor that has signed the Code already runs a process that assembles the facts within 2 to 15 days, so asking for a parallel notice to the customer costs it little, while arriving 15 days late to your own Article 73 report costs you a great deal.
The fifth row matters because Article 55(2) lets providers that do not adhere to an approved code demonstrate “alternative adequate means of compliance.” Knowing which route your vendor took tells you what evidence exists to ask about. Add these rows to the questions you put to any AI vendor, and if your team is fine tuning rather than consuming, check first whether the Chapter V duties have moved to you.
07Frequently asked questions
Does a systemic risk designation of our vendor's model create obligations for us?
Not directly. Articles 53 and 55 bind the provider of the general purpose model. Your obligations come from what you build on it, for example Article 73 incident reporting if your system is high-risk, and from any contract you signed.
Will our vendor tell us about a serious incident involving its model?
Only if the contract requires it. Article 55(1)(c) requires reporting to the AI Office and, as appropriate, national competent authorities. Measure 9.1 of the Code's Safety and Security chapter asks signatories to facilitate reporting from downstream providers to them, which is the opposite direction.
Can we see the vendor's Safety and Security Model Report?
Not as of right. Measure 10.2 of the Code asks signatories to publish a summarised version only if and insofar as necessary to assess or mitigate systemic risks. The full report is for the AI Office.
How do we find out whether a model is designated systemic risk?
Ask the provider in writing. Article 52(6) requires the Commission to publish and keep up to date a list of general purpose models with systemic risk, but we could not locate that list when this text was checked, so a written statement from the provider is the dependable record.
Does fine tuning a systemic risk model make us subject to Article 55?
Usually not. The Commission's questions and answers give as an indicative criterion that a modifier becomes provider of a new model when the compute used for modification exceeds a third of the original model's training compute, and say Article 55 should apply to modifiers only in clearly specified cases.
08References and method
- Regulation (EU) 2024/1689, Articles 51, 52, 53, 55 and 101, Annex XII and Annex XIII, for classification, notification, downstream documentation, the systemic risk obligations and the fine ceiling for model providers.
- Article 113 of Regulation (EU) 2024/1689 and Article 111 in the consolidated presentation, checked on 25 September 2026 against the text as amended, for the 2 August 2025 application of Chapter V, the carve-out of Article 101 and the 2 August 2027 transition for earlier models.
- Regulation (EU) 2026/1744, checked for amendments to Articles 51 to 55. The consolidated text shows no amendment to those provisions; the amendments relevant here are to Articles 56 and 113.
- The General-Purpose AI Code of Practice, European Commission, for the publication date of 10 July 2025, the list of signatories and the Safety and Security chapter, Commitments 6, 9 and 10.
- General-Purpose AI Models in the AI Act, Questions and Answers, European Commission, for the one third compute criterion for downstream modifiers. Not checked: whether the Commission has published the list required by Article 52(6).