The systemic-risk threshold
A GPAI model is presumed to carry systemic risk when the cumulative compute used for its training exceeds 10^25 floating-point operations. That adds model evaluation and adversarial testing, systemic risk assessment and mitigation, serious incident reporting, and cybersecurity protection.
Why it is like this
A bright line was needed that a provider can evaluate itself at training time, and compute is the only proxy available before the model exists. The Commission can revise it.
Not to be confused with
A measure of how good the model is. It is a presumption, rebuttable on evidence, and the Commission can also designate a model below the threshold on other criteria.
In practice
Providers crossing the threshold must notify the Commission within two weeks of knowing they will — which means the duty bites during training, not after release.
Source: Regulation (EU) 2024/1689 (AI Act) — Article 51 and Article 55. Read on .
Predict Check yourself
A provider realises mid-training that the run will exceed 10^25 FLOP. When is the Commission notified?
Show the answer
Within two weeks of knowing the threshold will be met — so during training, not at release.
Article 52(1) says "without delay and in any event within two weeks after that requirement is met or it becomes known that it will be met".