Foundation models and systemic risk: the 10^25 FLOP threshold

Short answer: The AI Act has two tiers for general-purpose AI (GPAI) models. On top of the baseline regime sits a heavier package for models with systemic risk: the most powerful "foundation models". A model is presumed to fall in this tier if the compute used for training exceeds 10^25 FLOP (Art. 51). The extra obligations of Art. 55 then apply: model evaluation, risk mitigation, incident reporting and cybersecurity.

What is a model with systemic risk?

A GPAI model has systemic risk if it has "high-impact capabilities" that can affect the EU level as a whole — think of large-scale propagation of harm across the value chain. The AI Act uses two routes to establish this: a compute threshold as a legal presumption, and designation by the Commission on substantive criteria (such as number of users, modalities and autonomy).

The 10^25 FLOP threshold

The most concrete criterion is the amount of compute used for training, measured in floating-point operations (FLOP). If the cumulative training budget exceeds 10^25 FLOP, systemic risk is presumed. The threshold is deliberately a presumption rather than a hard line: the Commission can adjust it by delegated act to track technical progress, and can also designate models below it where the substantive criteria warrant.

In practice this threshold today touches only the largest frontier models. For most companies that use or fine-tune GPAI it is irrelevant — they fall under the baseline GPAI regime, not this heavy track.

Extra obligations for systemic risk (Art. 55)

In addition to the transparency and copyright obligations that apply to all GPAI, the provider of a model with systemic risk must:

• perform model evaluations, including standardised adversarial testing (red-teaming) to identify and mitigate systemic risks;
• assess and mitigate systemic risks at EU level, including their sources;
• track, document and report serious incidents without undue delay to the AI Office and relevant national authorities, together with corrective measures;
• ensure an adequate level of cybersecurity for the model and its physical infrastructure.

Compliance can be demonstrated through an approved Code of Practice until harmonised standards are available.

Relationship to the baseline regime

A model with systemic risk must comply with both the baseline regime and Art. 55. The systemic-risk track does not stand alone: it stacks extra requirements on top of the transparency, technical documentation and copyright policy that apply to every GPAI provider. Releasing an open-source model with systemic risk also forfeits the open-source exemptions that apply elsewhere — see open-source AI models.

What to do

• Establish your position: are you building a model above 10^25 FLOP, or using/fine-tuning one? Only the former falls under Art. 55.
• Watch for AI Office designations: models below the threshold can also be designated.
• Set up an evaluation and red-teaming process if you are a frontier-model provider.
• Embed incident detection and reporting as a process, not an ad-hoc action.
• Using a frontier model as a customer? Ask the provider for evidence of Art. 55 compliance and fold it into your own AI governance.