Skip to content
←Back to glossaryAI

Systemic risk of a general-purpose AI model

A regulatory classification triggered by the compute used in training, imposing reinforced obligations on the most capable models.

Definition

Regulation (EU) 2024/1689, Article 51(2): a general-purpose model is presumed to carry systemic risk once its training has used more than 10^25 floating-point operations. The obligations on providers of these models have applied since August 2, 2025. The European artificial intelligence regulation treats general-purpose models separately. They have no assigned purpose and underpin applications their provider does not know about. Among them, the text singles out those presenting systemic risk and imposes reinforced obligations: model evaluation, adversarial testing, serious incident reporting and cybersecurity protection. What makes the trigger remarkable is that it is purely quantitative. It counts the cumulative compute used in training, measured in floating-point operations, against a threshold set in the text. The lawmakers accept this as a second best, since capability cannot be measured directly. The choice has its flaws. A fixed threshold ages as training methods grow more efficient, and a highly capable model trained efficiently can fall below it. The text therefore provides for revising the threshold. It also gives the Commission power to designate a model on other criteria, which puts judgment back where the number fails.

Its 8 cross-references, woven across the glossary's 18 categories
Systemic risk of a general-purpose AI model: AI glossary illustration, AlgoPolis
Example

Regulation (EU) 2024/1689 presumes that a general-purpose AI model presents systemic risk where the cumulative compute used for its training, measured in floating-point operations, exceeds ten to the power of twenty-five.

Read next
Related terms
Related articles
Stay informed

Follow the research

One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.

No spam, one-click unsubscribe, no data ever sold.