EU AI Act Art.55: Obligations of providers of GPAI models with systemic risk
Article 55 of the EU AI Act binds the gpai model provider. It requires Providers of GPAI models with systemic risk shall additionally: perform model evaluation incl adversarial testing; assess and mitigate possible systemic. This page states what it requires, who it binds and the evidence to keep. Browsing is free; the conformance kit is USD 499.
Specifics
| Instrument | Regulation (EU) 2024/1689 (the EU AI Act), as amended by Regulation (EU) 2026/1744 |
|---|---|
| Article | Art.55 |
| Binds | GPAI model provider |
| Group | General-Purpose AI Models |
| Evidence items | 4 |
| Linked NIST AI RMF controls | 2 |
| Linked ISO/IEC 42001 controls | 2 |
| Last updated |
Who does Art.55 bind?
The article binds the gpai model provider. The Act places each duty on a named party in the value chain, so a system can carry a provider duty and a deployer duty at once. Confirm your own position against the text; this page names the party, it does not rule on your facts.
The general-purpose AI model duties apply from 2 August 2025. See the full timeline.
What does Art.55 require?
Providers of GPAI models with systemic risk shall additionally: perform model evaluation incl adversarial testing; assess and mitigate possible systemic risks; track, document and report to the AI Office and competent authorities serious incidents and possible corrective measures; and ensure an adequate level of cybersecurity protection for the model and its infrastructure.
This is our plain-language statement of the article, not the text of the regulation. Read the article: Art.55 (Regulation (EU) 2024/1689 on EUR-Lex).
What evidence should we keep for Art.55?
| Category | Evidence to keep |
|---|---|
| GPAI systemic risk | Model-evaluation reports (incl adversarial) |
| GPAI systemic risk | Systemic-risk assessment and mitigation |
| GPAI systemic risk | Serious-incident reporting records |
| GPAI systemic risk | GPAI cybersecurity controls |
What does a linked control mean here?
A linked control is a NIST AI RMF or ISO/IEC 42001 control that the held rule set records as a topical match, with a confidence and a one-line reason. It does not establish that meeting one requirement satisfies the other, it is not legal advice, and it is not certification. Where no control is recorded, the page says so and does not guess. Sources: the NIST AI RMF and ISO/IEC 42001.
Which NIST AI RMF controls line up with Art.55?
2 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | NIST AI RMF | Confidence |
|---|---|---|
AIRMF-MN-1.1 | A determination is made as to whether the AI system achieves its intended purpose and stated objectives and whether its development or deployment should proceed | unstated |
AIRMF-MS-2.7 | AI system security and resilience as identified in the MAP function are evaluated and documented | unstated |
Which ISO/IEC 42001 controls line up with Art.55?
2 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | ISO/IEC 42001 | Confidence |
|---|---|---|
A.5.5 | Assessing societal impacts of AI systems Systemic risk assessment is societal in scope but reaches only certain general purpose models. | medium |
A.8.4 | Communication of incidents Systemic risk model incidents tracked, documented and reported to the AI Office. | medium |
What does the conformance kit add for Art.55?
The kit renders this obligation into your own role checklist with the evidence register, the linked controls and a CSV export, for USD 499 one off. See what is in the kit or open it.