← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act Article 55: extra duties for GPAI models with systemic risk

Article 55 layers additional obligations on top of the general Article 53 duties for general-purpose AI models classified as carrying systemic risk under Article 51 — in practice, models whose training compute exceeds the 10^25 FLOPs threshold that triggers a rebuttable presumption, or that the Commission designates by decision.

What Article 55 requires

• Perform model evaluation, including adversarial testing and red-teaming, to identify and mitigate systemic risk.
• Assess and mitigate possible systemic risks at Union level, including their sources.
• Track, document and report serious incidents and possible corrective measures to the AI Office and, as relevant, national authorities, without undue delay.
• Ensure an adequate level of cybersecurity protection for the model and its physical infrastructure.

Who it applies to

A narrow set of providers — currently the frontier labs whose models cross the compute threshold or receive a Commission designation. Downstream deployers of these models are not directly bound by Article 55, but they inherit the practical consequence: unpredictable model behaviour is exactly what red-teaming and incident tracking are meant to catch.

What evidence this implies

Evaluation reports, red-team findings and remediation records, an incident log with timestamps and severity, and documentation of cybersecurity measures. This evidence is largely internal to the provider and not something a deployer can reconstruct from the outside.

Gaps to state honestly

Systemic-risk obligations apply from 2 August 2025 alongside the rest of Chapter V, but enforcement guidance and the voluntary Code of Practice referenced in the Act are still maturing. A deployer cannot substitute its own agent logs for the provider's model-level evaluation — the two sit at different layers, a distinction our provider vs. deployer guide covers in more depth.

How Vetro helps

Vetro sits at the deployment layer, not the model-training layer, so it cannot attest to a provider's red-teaming. What it can do is give you, as a deployer or integrator, a verifiable record of every call your agent made to a systemic-risk model, so that if an incident is traced back to your integration you have evidence of what your own system did. Vetro Attest verifies a ledger or OTLP GenAI trace for free and, for 49 USD, produces a counter-signed report against the Act. Not legal advice.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.