The EU sorts frontier AI models by one compute number it calls an imperfect proxy

The two-week notice

Since 2 August 2025, a company that trains a large enough AI model has two weeks to tell the European Commission it did so. The trigger is a single number: cumulative training compute greater than 10²⁵ floating-point operations, summed across the whole training run. Cross it, and Article 51(2) of the AI Act presumes the model carries "high impact capabilities" and therefore "systemic risk."¹ The provider must estimate that compute in advance, report the figure to two significant figures, and notify the Commission's AI Office within two weeks of expecting to cross the line, before training even finishes, because labs plan their compute allocation up front.²

The AI Office is the hand on the lever. It holds exclusive competence to supervise providers of general-purpose AI models, models trained on broad data and adaptable to many downstream tasks, and it alone can demand documentation, evaluate a model, or impose a fine.²

The number that sorts the models

Two numbers do the sorting. The lower one decides whether a system is a general-purpose AI model at all: the Commission's Guidelines set an indicative floor of 10²³ FLOP, roughly the compute to train a one-billion-parameter model on a large dataset, paired with an ability to generate language, images, or video.² The higher one, 10²⁵ FLOP, sits two orders of magnitude above it and flips a model into the systemic-risk tier by presumption.¹ Everything past the first line owes the baseline duties; everything past the second owes four more.

The presumption is rebuttable, but the burden sits with the provider. A lab that trains past 10²⁵ FLOP may argue its model lacks high-impact capabilities, and the Guidelines say the Commission will weigh that. It also says the provider must adduce the evidence, and that arguments about planned mitigations are not suitable grounds for exclusion.² The tier is fixed on raw capability, not on how carefully the model is later deployed. The same Guidelines pull downstream developers in: fine-tune a model with more than a third of its original training compute and you become a provider in your own right, with the duties that follow.²

What the upper tier is meant to catch is set out in the Act's recitals: chemical, biological, radiological and nuclear risks where a model lowers the barrier to weapons development, offensive cyber capabilities that ease vulnerability discovery and exploitation, loss of control over models that pursue goals misaligned with human intent, and the large-scale facilitation of disinformation.³ These are capabilities and pathways, not incidents that have already happened. The threshold is a bet that compute tracks the capability closely enough to act on it before it materializes.

Four duties below the line, four above

Below the systemic-risk line, every provider of a general-purpose model owes four things. It must keep technical documentation of the model, hand downstream developers the information they need to integrate it, put in place a policy to comply with EU copyright law including honoring the text-and-data-mining opt-outs rightsholders reserve, and publish a "sufficiently detailed summary" of the content used for training.⁴ Open-weight models released under a free licence are exempt from the first two, the documentation duties, but not from the copyright policy or the training summary, and the exemption disappears the moment a model is classified systemic-risk.⁴ The common line that open models are largely off the hook is wrong.

Past the line, four more duties attach. A systemic-risk provider must evaluate the model against standardised protocols including adversarial testing, assess and mitigate systemic risks at Union level, report serious incidents to the AI Office without undue delay, and maintain an adequate level of cybersecurity over the model and its physical infrastructure.⁵ These are the duties aimed at the capabilities the recitals fear, and they fall on only a handful of frontier labs.

None of these obligations tells a provider exactly what compliance looks like. That gap is filled, for now, by the General-Purpose AI Code of Practice, published on 10 July 2025 and drawn up by independent experts with around a thousand stakeholders.⁶ Signing is voluntary. Adherence lets a provider demonstrate compliance with the Article 53 and 55 duties, and the Commission has confirmed the Code as an adequate tool, but the Code grants no presumption of conformity. That status is reserved for harmonised technical standards the EU has not yet written, which makes the Code a temporary bridge, and the Commission says as much.⁶ The training summary has its own instrument: an AI Office template, published 24 July 2025, that sets a "common minimal baseline" for what a provider must disclose.⁷

An admitted proxy

The compute threshold has an obvious problem, and the Commission names it first. Its own Guidelines call training compute "an imperfect proxy for generality and capabilities," then defend it as "the most suitable approach at present."² The dispute is therefore not whether 10²⁵ FLOP is a proxy. Everyone agrees it is. The dispute is whether an admitted proxy is good enough to catch the models that matter.

The independent case says it is not, in both directions. Writing in the Harvard Journal of Law and Technology, Sasha Rosenthal-Larrea and Lucille Finn argue that any FLOP-based rule "will always be both over- and under-inclusive": some high-risk models fall below the line while some harmless ones cross it, because compute measures one input and not the data quality, training method, or architecture that also decide what a model can do.⁸ The line is already eroding from below. Distillation trains capable models at a fraction of the compute, and architectures such as mixture-of-experts reach comparable performance with far fewer operations, so a dangerous model can sit under 10²⁵ FLOP by construction.⁸ A hard threshold can also invert the incentive it means to set, rewarding a developer who trains up to the line and stops, to stay outside the tier.

A summary that summarizes little

The transparency duty has the same shape: a real obligation that stops short of what it appears to promise. The training-content summary is not a disclosure of the training data. The AI Office template asks for a high-level narrative in three parts, general information, a list of data sources, and relevant processing details, with the level of detail varying by source and explicit room to withhold what a provider treats as a trade secret or confidential business information.⁷ Its stated aim is to help copyright holders and others exercise their rights, not to let anyone reconstruct the corpus. A provider can meet the duty without naming a single dataset it would rather keep private.

A second worry is about who defines the risk at all. In the European Journal of Risk Regulation, Samuel Carey argues that routing the systemic-risk duties through a voluntary code drafted with industry makes GPAI developers "directly involved in defining the parameters of their own regulatory obligations," a structure prone to capture, in which measurable technical risks crowd out harder-to-quantify harms to fundamental rights.⁹ Carey also points to the split between models and systems: a systemic risk embedded in a model can surface through a downstream product that never enters the Act's high-risk category, a gap he calls regulatory arbitrage.⁹ These are arguments, not findings. They name where the mechanism runs thin.

What the lever leaves standing

What does the rule actually remove? A specific opacity. A regulator and the developers building on a model now have a named authority that can compel documentation, a public if partial account of training data, and, for the largest models, a duty to test for and report the capabilities the recitals fear. That is more than existed on 1 August 2025.

What stays standing is the enforcement. The AI Office cannot impose a fine until 2 August 2026, and the fines it can then levy reach 3% of global annual turnover or 15 million euro, whichever is higher.² Providers whose models were on the market before August 2025 have until August 2027 to comply.²

The sharpest forecast against the regime is that it will drive providers away rather than into compliance. Its strongest witness so far is Meta, which in July 2025 declined to sign the Code; its chief global affairs officer, Joel Kaplan, wrote that "Europe is heading down the wrong path on AI" and that the Code introduces measures "which go far beyond the scope of the AI Act."¹⁰ That is a real refusal, and it is worth weighing at full strength. But it is a forecast, not a record. Meta declined a voluntary code; it did not withdraw a single model from the EU. Whether the rules chill open models, or push providers to decline the market, is a prediction about behaviour no source has yet observed.

The residual risk lives in the distance between what the Act names and what it has switched on. The Act names the capabilities, points the AI Office at them, and sets a compute number to find them. That number is an admitted proxy; the transparency it buys is a summary the template lets a provider thin; the code that carries the duties is one a provider can refuse; and the fine that would make any of it bite has not yet been imposed. The machinery is real. How much risk it removes is bounded by how much of itself the AI Office has actually turned on.