marketing.docsPage.nav.gpaiCompliance

GPAI Compliance — Chapter V

Operational aspect	What to know in ActLoom
Prerequisites	The relevant model should already be identified as GPAI or systemic-risk GPAI, with enough provider-side information available to document obligations credibly.
Main inputs	Model profile, open-source status, FLOPs, documentation artifacts, copyright policy, model card material, evaluations, and red-team exercise records.
Main outputs	GPAI compliance profile, systemic-risk flag, red-team evidence, model transparency artifacts, and incident escalation references.
Who typically uses it	Model providers, AI safety teams, legal, and compliance teams supporting foundation-model distribution.
Plan access	GPAI-related support exists across plans, while systemic-risk operations become more relevant for advanced provider or frontier-model contexts.
Relevant routes	/api/gpai/profile/[aiSystemId], /api/gpai/red-team/runs, /api/ai-systems/[id]/classification/approve

Chapter V Overview

Chapter V of the EU AI Act introduces specific obligations for providers of general-purpose AI models. ActLoom helps teams document Art. 53 obligations, determine whether the model triggers systemic-risk treatment, and maintain the evidence expected by downstream providers, deployers, and the European AI Office.

Why GPAI teams use this page

Separate baseline from frontier obligations

The page helps you distinguish standard GPAI duties from the extra burden that appears once systemic-risk treatment applies.

Prepare downstream documentation

You can organize the materials product, legal, and partner teams will request when they integrate your model into another system.

Keep evidence synchronized

Red-team exercises, copyright policy, model cards, and incident channels stay connected instead of living in separate compliance workstreams.

Art. 53 base obligations

Technical Documentation

Art. 53(1)(a)

Model architecture, training methodology, training data sources, evaluation results, and known limitations. Must be kept up to date and made available to the AI Office on request.

Art. 53(1)(b)

A summary of training data, copyright compliance measures, and any Text and Data Mining (TDM) opt-out mechanism implemented for rights holders.

Model Card

Art. 53(1)(d)

Machine-readable model card for downstream providers and deployers. Must describe intended purpose, known risks, prohibited use cases, and model limitations.

Energy Efficiency

Art. 53(1)(e)

Reported training energy consumption (kWh or MWh), inference-time power draw estimates, and any carbon offsetting measures applied.

NeuroLLM-7B

⚠ SYSTEMIC RISK · Art. 51

Model Family

NeuroLLM Series

Compute (FLOPs)

1.2 × 10²⁶

Systemic Risk

Yes — Art. 51

Model Card URL

model-card.neurovista.ai

Red Team Runs

Mar 15, 2026

12 findings2 critical

Complete

Next: Sep 2026

Oct 8, 2025

7 findings

Complete

Next: Mar 2026

Fig 30. GPAI compliance — General-Purpose AI model profile with systemic risk detection and red team tracking.

Open vs. proprietary models

Providers of open-source GPAI models benefit from reduced obligations — they are exempt from the technical documentation and model card requirements provided their parameters are publicly available. However, open-source systemic-risk models are not exempt from the Art. 55 obligations. ActLoom tracks the open-source flag and adjusts the required checklist accordingly.

Systemic Risk

GPAI models trained with a computational power above 10²⁵ FLOPs are presumed to pose systemic risk to the EU under Art. 51. This threshold reflects models at the scale of leading frontier systems. When you enter the FLOPs figure in the ActLoom GPAI profile, the system automatically applies the systemic-risk flag and surfaces all additional Art. 55 obligations as a dedicated checklist.

Additional Art. 55 obligations for systemic-risk GPAI

Obligation	Description	Article	Status tracking
Adversarial testing (red teaming)	Conduct adversarial testing at least annually using both internal evaluators and independent experts. Document all findings.	Art. 55(1)(a)	Red Team Evaluations log in ActLoom
Incident reporting to EU AI Office	Report serious incidents involving systemic-risk GPAI models to the European AI Office — distinct from the national authority Art. 73 channel.	Art. 55(1)(b)	Incident record field 'Reported to EU AI Office'
Cybersecurity measures	Implement technical and organisational measures to ensure the physical, logical, and model-weight integrity of the GPAI system.	Art. 55(1)(c)	GPAI profile cybersecurity checklist
Model evaluations	Carry out structured model evaluations in accordance with standardised protocols to assess capabilities and risks before and after significant model updates.	Art. 55(1)(d)	GPAI profile evaluation records tab

Dual reporting channels for incidents

Systemic-risk GPAI providers face two parallel incident reporting obligations: (1) Art. 73 — report serious incidents to the national market surveillance authority of the affected Member State, and (2) Art. 55 — report incidents involving the GPAI model itself to the European AI Office. ActLoom tracks both channels on the incident record and highlights when both apply.

Red Team Evaluations

Red teaming — structured adversarial testing by a team attempting to uncover harmful outputs, exploitable behaviours, or safety failures — is mandatory for all systemic-risk GPAI providers under Art. 55(1)(a). ActLoom provides a dedicated red team log for each GPAI model, capturing each exercise in detail, linking critical findings to corrective actions, and scheduling the next evaluation. This log serves as the primary evidence of compliance during AI Office audits.

Red Team Exercise Lifecycle

Plan Exercise

Define scope (capabilities to probe), assemble team (internal + independent experts), set dates, and create the exercise record in ActLoom.

Execute

Team conducts adversarial probing — jailbreaks, harmful instruction following, bias elicitation, CSAM generation attempts, and security exploits.

Log Findings

Record total number of findings, critical findings, and a structured description of each critical issue found.

Triage & Remediate

Create corrective action records for each critical finding. Link them to the red team exercise for a complete evidence chain.

Schedule Next

Set the date for the next annual exercise. ActLoom displays upcoming red team dates on the GPAI compliance dashboard.

Exercise field	Purpose
Scope	Defines which capabilities, modalities, or safety concerns are tested
Evaluation team	Records internal staff and independent experts who participated
Critical findings	Summarises the highest-severity failures discovered
Linked remediation	Connects each critical issue to a corrective action owner and deadline
Next evaluation date	Maintains annual or event-driven re-testing cadence

Evidence quality matters

A red team log is only useful if findings, remediation, and follow-up dates are explicitly linked. ActLoom keeps that evidence chain intact so you can show not just that testing happened, but that material issues were actually handled.

Evidence pack to keep current

A current model card with intended uses, prohibited uses, and known limitations.
Up-to-date records of evaluations, red-team findings, and remediation linked to model versions.
Copyright and training-data transparency materials ready for downstream requests.
A clear escalation path for incidents that need national authority reporting, AI Office reporting, or both.

Related Sections

AI Act Reference

Use this when GPAI obligations need to be grounded in the broader legal timeline and role structure.

Documents

Go here when GPAI evidence needs to become a controlled export, report, or supporting attachment.

Incident Management

Read this when a systemic-risk event or evaluation finding becomes an operational escalation.

Artifacts

Use this for the output-centric view of model profiles, red-team logs, and supporting evidence packs.

Ready to get started?

Join hundreds of companies using ActLoom to simplify AI Act compliance. Start your free assessment today — no credit card required.

Start Free Assessment View Pricing

Questions? Contact us at support@actloom.com

Operational aspect

What to know in ActLoom

Prerequisites

The relevant model should already be identified as GPAI or systemic-risk GPAI, with enough provider-side information available to document obligations credibly.

Main inputs

Model profile, open-source status, FLOPs, documentation artifacts, copyright policy, model card material, evaluations, and red-team exercise records.

Main outputs

GPAI compliance profile, systemic-risk flag, red-team evidence, model transparency artifacts, and incident escalation references.

Who typically uses it

Model providers, AI safety teams, legal, and compliance teams supporting foundation-model distribution.

Plan access

GPAI-related support exists across plans, while systemic-risk operations become more relevant for advanced provider or frontier-model contexts.

Relevant routes

/api/gpai/profile/[aiSystemId], /api/gpai/red-team/runs, /api/ai-systems/[id]/classification/approve

Chapter V Overview

Why GPAI teams use this page

Separate baseline from frontier obligations

The page helps you distinguish standard GPAI duties from the extra burden that appears once systemic-risk treatment applies.

Prepare downstream documentation

You can organize the materials product, legal, and partner teams will request when they integrate your model into another system.

Keep evidence synchronized

Red-team exercises, copyright policy, model cards, and incident channels stay connected instead of living in separate compliance workstreams.

Art. 53 base obligations

Technical Documentation

Art. 53(1)(a)

Model architecture, training methodology, training data sources, evaluation results, and known limitations. Must be kept up to date and made available to the AI Office on request.

Art. 53(1)(b)

A summary of training data, copyright compliance measures, and any Text and Data Mining (TDM) opt-out mechanism implemented for rights holders.

Model Card

Art. 53(1)(d)

Machine-readable model card for downstream providers and deployers. Must describe intended purpose, known risks, prohibited use cases, and model limitations.

Energy Efficiency

Art. 53(1)(e)

Reported training energy consumption (kWh or MWh), inference-time power draw estimates, and any carbon offsetting measures applied.

NeuroLLM-7B

⚠ SYSTEMIC RISK · Art. 51

Model Family

NeuroLLM Series

Compute (FLOPs)

1.2 × 10²⁶

Systemic Risk

Yes — Art. 51

Model Card URL

model-card.neurovista.ai

Red Team Runs

Mar 15, 2026

12 findings2 critical

Complete

Next: Sep 2026

Oct 8, 2025

7 findings

Complete

Next: Mar 2026

Fig 30. GPAI compliance — General-Purpose AI model profile with systemic risk detection and red team tracking.

Open vs. proprietary models

Obligation

Description

Article

Status tracking

Adversarial testing (red teaming)

Conduct adversarial testing at least annually using both internal evaluators and independent experts. Document all findings.

Art. 55(1)(a)

Red Team Evaluations log in ActLoom

Incident reporting to EU AI Office

Report serious incidents involving systemic-risk GPAI models to the European AI Office — distinct from the national authority Art. 73 channel.

Art. 55(1)(b)

Incident record field 'Reported to EU AI Office'

Cybersecurity measures

Implement technical and organisational measures to ensure the physical, logical, and model-weight integrity of the GPAI system.

Art. 55(1)(c)

GPAI profile cybersecurity checklist

Model evaluations

Carry out structured model evaluations in accordance with standardised protocols to assess capabilities and risks before and after significant model updates.

Art. 55(1)(d)

GPAI profile evaluation records tab

Exercise field

Purpose

Scope

Defines which capabilities, modalities, or safety concerns are tested

Evaluation team

Records internal staff and independent experts who participated

Critical findings

Summarises the highest-severity failures discovered

Linked remediation

Connects each critical issue to a corrective action owner and deadline

Next evaluation date

Maintains annual or event-driven re-testing cadence