Governance & evidence
GPAI Systemic Risk
GPAI providers must maintain Annex XI technical documentation, downstream information (Annex XII), a copyright / TDM-reservation policy (Art.53(1)(c)), a public training-data summary (Art.53(1)(d)), and, where the >10^25 FLOPs / high-impact capability threshold is met, systemic-risk evaluation, mitigation and incident reporting (Art.55). The GPAI pack now renders per-model live fields plus a dedicated systemic-risk table instead of generic info-boxes.
Transcript
GPAI providers must maintain Annex 11 technical documentation, downstream information, a copyright policy and a public training data summary, plus systemic-risk duties above ten to the twenty-five FLOPs.
Per-model fields like copyright policy URL, energy consumption FLOPs and training data description now render in the GPAI pack as a live table per model.
Above ten to the twenty-five FLOPs or high-impact capability triggers systemic-risk duties: model evaluation including adversarial testing, risk assessment and mitigation, and incident reporting to the AI Office.
Record a systemic-risk assessment per GPAI model: FLOPs, systemic flag, evaluation performed, risk and mitigation text. This satisfies ai act fifty-five.
Regenerate the GPAI pack and verify the per-model table and systemic-risk table now show real data instead of Not provided.
Why this is required
A GPAI model card that never records its FLOPs estimate cannot show whether the systemic-risk threshold is even met, which is exactly what an AI Office notification under Article 51 requires within two weeks of determination.
Model evaluation including adversarial testing, systemic-risk assessment & mitigation, and serious-incident tracking to the AI Office are Art.55 duties that need their own dated records, not a paragraph that says 'required if systemic risk'. A one-row-per-model assessment table makes that evidence explicit.
What EuroCompliant does
Per-model live fields on AISystem (is_gpai, copyright_policy_url, energy_consumption_flops, training_data_description and lawful_basis) now render in generate_eu_gpai_documentation (framework_documents.py:1467) as a per-model table plus a per-model >1e25 FLOPs badge (red systemic risk vs yellow required-if). Where a field shows 'Not provided', add the URL or estimate on the system.
GPAISystemicRiskAssessment (models.py:1082) stores system_id, is_systemic_risk, flops_estimate, evaluation_performed, evaluation_details, risk_assessment, mitigation_measures, incident_reporting_configured. Evidence engine gpai_systemic_risk_assessed (evidence_engine.py:549) returns true when at least one row has evaluation_performed true, making ai_act_55 platform_managed (obligation_meta.py:103), completed when evidenced, otherwise not_started.
POST/GET /gpai/assessments (and GET/PUT/DELETE /gpai/assessments/{id}) are company-scoped and audit-logged as gpai.assessment_create, and the systemic-risk table in the generated GPAI pack is populated from those rows. Frontend /gpai lists GPAI models, shows per-model URLs/FLOPs, and has a form for systemic-risk assessments.
Walking through it
Mark a system as GPAI
Toggle is_gpai and fill copyright_policy_url, energy_consumption_flops and training_data_description. Those fields appear directly in the GPAI pack table.
Open /systems →Record a systemic-risk assessment
In GPAI, pick the GPAI system, set FLOPs, toggle systemic risk and evaluation performed, and add risk/mitigation text. This satisfies ai_act_55.
Open /gpai →Regenerate the GPAI pack and verify
Generate eu_gpai_documentation again. The per-model table and the systemic-risk assessment table should now show real data instead of 'Not provided'.
Open /compliance-docs →The law
Obligations for providers of GPAI models
Annex XI technical documentation, Annex XII downstream information, Art.53(1)(c) copyright/TDM policy, Art.53(1)(d) public training-data summary.
Obligations for GPAI models with systemic risk
For high-impact / >10^25 FLOPs models: model evaluation including adversarial testing, systemic-risk assessment & mitigation, serious-incident tracking to the AI Office, adequate cybersecurity.
Frequently asked
When is a model systemic-risk?
When its capabilities are high-impact or its training compute exceeds 10^25 FLOPs. The doc pack shows a heuristic badge (>1e25) per model; the formal determination is recorded in the GPAI systemic-risk assessment row (is_systemic_risk).
Does the GPAI pack still contain generic guidance?
Where no per-model data exists it shows 'Not provided, add …' rather than filler. Once the fields and an assessment are present, the generic info-boxes are replaced by real table rows.
Related guides
Documentation & evidence generation
Generating Annex IV technical documentation, declarations of conformity and framework records from data you have already entered.
Automated document generation and cryptographic signing
Generate regulator-ready documents from your own data, then download a signed PDF an auditor can verify independently.
Compliance checklists
How Articles 9 to 15 become tracked, owned, evidenced work rather than a document nobody reads.
Try it on your own systems
Everything in this guide runs in the live product. Start a free trial and follow along with your own data.
Start free trial