The EU AI Act puts four duties on a frontier model, and only the incident report binds hard

Article 55 sets four duties and names who enforces them

Since 2 August 2025, a company that places a general-purpose AI model with systemic risk on the EU market owes four duties written into one article of Regulation (EU) 2024/1689. Article 55(1) says the provider "shall" evaluate the model with "standardised protocols and tools reflecting the state of the art, including conducting and documenting adversarial testing"; "assess and mitigate possible systemic risks at Union level"; "keep track of, document, and report, without undue delay, to the AI Office ... relevant information about serious incidents"; and "ensure an adequate level of cybersecurity protection."¹ The enforcer is named too. Under Article 101 the Commission itself, not a national authority, "may impose ... fines not exceeding 3 % of their annual total worldwide turnover in the preceding financial year or EUR 15 000 000, whichever is higher."¹ Four duties, an office that receives the reports, a Commission that can fine.

Grading the four duties by their operative verb

The four duties share the verb "shall" and not its force, because each carries a different qualifier, and sorting them by that qualifier is the task. Two are best-effort standards pegged to a baseline the provider helps set; assessment is mandatory but its sufficiency is judgment; only the order to "report, without undue delay, to the AI Office ... relevant information about serious incidents"¹ binds without an escape in its wording. A missed report is a fact; an inadequate evaluation is an argument.

Of four duties, one binds cleanly. That is not a drafting flaw, since a rule about testing frontier systems must reference an evolving practice. It does leave the reporting duty carrying alone the weight the other three share loosely.

The trigger runs on the provider's own compute count

Before any duty applies, a model must be classified as carrying systemic risk, and the default path runs through the provider. Article 51(2) presumes high-impact capabilities "when the cumulative amount of computation used for its training measured in floating point operations is greater than 10^25."¹ The Commission's own guidance settles who counts: the figure is self-assessed, expected "accurate within ±30%," which it calls "a self-reporting mechanism rather than third-party verification."² The regulation matches it, having the provider "notify the Commission ... within two weeks after that requirement is met."¹

The same article lets a provider that crosses the line argue back over it, presenting "sufficiently substantiated arguments to demonstrate that, exceptionally, although it meets that requirement, the ... model does not present ... systemic risks."¹ A model that persuades the Commission it is safe owes nothing under Article 55. The Commission can still designate one "ex officio or following a qualified alert from the scientific panel,"¹ but that is the exception; the ordinary route begins with the lab's estimate and its own rebuttal. This is the reliance on self-assessment an in-house scaling policy runs on, now carrying a statute and a fine.

What a single training run cannot measure

Set aside who counts the operations and the count is still the wrong instrument. Sara Hooker, the strongest technical critic of the threshold, analyses it from outside the Regulation and argues training compute predicts neither thing the rule uses it to stand in for. Not capability: "the bitter lesson doesn't explain why Falcon 180B is easily outperformed by far smaller open weights models such as Llama-3 8B."³ Not risk: hold two models at equal FLOP where "one has had safety alignment during post-training and the other has none," and the count scores them the same while "one will present a far lower risk."³ As she puts it, "FLOP only accounts for a single model, but does not capture risk of the overall system."³

A fixed line also catches more each year without moving. Small-model benchmark scores "went from an average of 38.59% ... to an average of 77.15% across 2024 submissions" in "a mere span of 2 years,"³ so a capability that once required sitting above the line is now reached well below it. The statute half-concedes this in its own text. Article 51(3) gives the Commission delegated power to amend the thresholds "in light of evolving technological developments,"¹ and the designation route exists so capability the number misses can be caught by hand. The 10^25 figure is the headline, and the law already treats it as provisional.

Why a signed Code binds harder than a house policy

The regulation points to a Code of Practice as one way to show the duties are met. Published by the AI Office on 10 July 2025, the Code runs in three chapters; its Safety and Security chapter "is only relevant to the small number of providers of the most advanced models ... under Article 55."⁴ Signing is optional: Article 55(2) lets providers "rely on codes of practice ... to demonstrate compliance," while one that does not adhere "shall demonstrate alternative adequate means of compliance."¹ "Voluntary" describes the route, not the obligation. The Code buys a presumption of compliance; it does not create the duty or excuse it.

That is what makes the Code sharper than a lab's own safety framework, and the clearest statement comes from a think tank with no stake in it. Unlike the Seoul and Hiroshima commitments, interface writes, the EU has fines "of up to 3% of a company's annual total worldwide turnover" and power to pull models from the market, so "for the first time, the AI office will have insight into the risk management processes of the world's most advanced AI models."⁵ Where an internal policy rests on "soft power," the Code sets "concrete, quasi-binding procedures for any company wishing to access the EU market," backed by "deterrent mechanisms."⁵ The clean bind under 55(1)(c) is this: a pipe carrying a serious incident to a regulator who can act, which no house policy answering to its own board supplies.

The route is genuinely optional, and one major provider took the exit. Meta declined; its Joel Kaplan wrote that "Meta won't be signing it," calling the Code a source of "legal uncertainties" with "measures which go far beyond the scope of the AI Act."⁶ Most of the frontier signed: the AI Office register records OpenAI, Anthropic, Google, Microsoft, Amazon, IBM, and Mistral, with xAI joining only the Safety and Security chapter.⁷ Meta's refusal changes what it must file as its "alternative adequate means." It does not lift the Article 55 duties, which bind signatory and refusenik alike.

What the lever leaves standing

Run the lever as written and measure what gets through. Start with the calendar, because a fine that cannot be levied is not a penalty. The Article 55 duties applied on 2 August 2025, but Article 113(b) applies the regime "with the exception of Article 101,"¹ so the specific fine power against these providers rejoins only on 2 August 2026. A law firm reading the text for clients confirms the gap: the Office can fine "up to 3% global annual turnover or €15 million ... when it comes into force on 2 August 2026," and models on the market before 2 August 2025 "have until 2 August 2027."⁸ For a year the duty exists and the tailored fine does not.

The penalty, once live, is smaller than the Act's own ceiling and larger than it first reads. Because the fine is the higher of 3% of turnover or €15 million, that €15 million is a floor for a large provider, not a cap. Yet 3% sits below the 7% and €35 million the Act reserves for prohibited practices under Article 99,¹ a full tier under the conduct it treats as worst. And a fine is worth the audit behind it: the Commission will run "a collaborative and risk-based enforcement model" in which good-faith signatories "may benefit from ... potentially lower fines,"² the posture of a regulator rationing scarce inspection.

Stack the softness and it is not in the reporting duty. The compute trigger is a proxy the law calls provisional; the classification runs on the provider's own estimate; two of the four duties hold only to a best-effort standard; the tailored fine waits until 2026. Every weakness sits at the gate that decides who is covered or at the standard of care, and none touches Article 55(1)(c). The duty to report a serious incident to the AI Office survives the compute critique, the self-classification critique, and the best-effort critique intact, because it depends on none of the things they undermine. A frontier lab in the EU market now owes a regulator the news when its model does something dangerous, and that much the statute makes real. What it cannot reach is the judgment, made by the lab, about which of its models it is talking about.