Do most MedTech companies need to worry about systemic risk obligations directly?

Rarely as a direct obligation, since very few MedTech companies train foundation models at the 10^25 FLOP compute scale that triggers the systemic-risk presumption; most are consumers of such models rather than trainers. What matters practically for MedTech is understanding how a systemic-risk model they integrate handles its own Article 55 obligations, particularly incident tracking and reporting, so the device manufacturer can incorporate relevant upstream information into its own vigilance and post-market surveillance processes.

What should a device manufacturer do if it builds on a GPAI model later designated as posing systemic risk?

The manufacturer should establish a clear information flow from the GPAI provider's incident tracking and evaluation reporting into its own device-level post-market surveillance and vigilance systems, since a systemic-risk incident at the model layer could manifest as a safety issue in the downstream device. This typically requires contractual provisions with the model provider ensuring timely notification of relevant safety information, evaluations, or incidents that could affect the device's risk profile.

Can a model lose its systemic-risk designation over time?

The AI Act framework anticipates that systemic-risk designation, whether by the compute presumption or Commission decision, is tied to the model's capabilities and characteristics rather than being permanent regardless of context, so changes to a model's training, scale, or capabilities could in principle affect its designation. In practice, manufacturers relying on a designated model should treat the designation as a factor to monitor over the model's lifecycle rather than a one-time classification, particularly as the provider updates or retrains the underlying model.

All terms

RegulatoryRegulated Pathways AI / ML in Devices Quality System

Systemic Risk (GPAI)

Additional AI Act tier for GPAI models above a compute threshold or otherwise designated as posing systemic risk.

Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed July 25, 2026

Definition

Article 51 designates a GPAI model as posing systemic risk when it has high-impact capabilities, presumed where the cumulative amount of computation used for training exceeds 10^25 FLOPs, or when so designated by the Commission. Article 55 then requires model evaluation, adversarial testing, tracking and reporting of serious incidents, and adequate cybersecurity protections at the model layer.

What the regulation says

Regulation (EU) 2024/1689 (EU AI Act), adopted on 13 June 2024, entered into force on 1 August 2024. Its GPAI provisions apply from 2 August 2025 under Article 113. Article 51 classifies GPAI models as presenting systemic risk where they have high-impact capabilities, presumed when cumulative training computation exceeds 10^25 FLOPs. The Commission may also designate models with equivalent capabilities or impact, considering Annex XIII criteria. Under Article 111(3), providers of GPAI models placed on the market before 2 August 2025 must comply by 2 August 2027. Article 55 requires providers to perform and document model evaluations, including adversarial testing; assess and mitigate systemic risks at Union level; and ensure adequate cybersecurity for the model and its physical infrastructure. Providers must also track, document and report relevant information about serious incidents and possible corrective measures, without undue delay, to the AI Office and, as appropriate, national competent authorities. These duties attach to the GPAI model provider, not automatically to every downstream MedTech manufacturer. Manufacturers using such models should distinguish upstream systemic-risk obligations from their own applicable device-level risk management, post-market surveillance and vigilance duties; compliance at the model layer does not replace those duties.

What this means in practice

MedTech products rarely train models at this scale, but they frequently consume them. When a device relies on a designated systemic-risk GPAI, the manufacturer should map how upstream incident reporting and evaluation flow into the device's own post-market surveillance and vigilance obligations.

Examples

A MedTech device uses a third-party GPAI model for diagnostic image analysis; if this GPAI model is designated as posing systemic risk, the device manufacturer must incorporate the model's incident reports into their own vigilance system.
When a surgical robot's AI-powered navigation relies on a systemic-risk GPAI model, the manufacturer must ensure that any adversarial testing conducted on the GPAI model is considered in the device's risk management file.
A medical monitoring system utilizing a designated systemic-risk GPAI for predictive analytics needs to establish clear pathways for receiving information on the GPAI's ongoing model evaluations and cybersecurity status to inform the device's own safety updates.

Common pitfalls

•Confusing systemic-risk designation (a property of the model) with high-risk status (a property of the AI system's use case).

Frequently asked questions

Systemic risk under Article 51 is a property of a general-purpose AI (GPAI) model itself, presumed when cumulative training computation exceeds 10^25 FLOPs or when the Commission otherwise designates the model, and it triggers model-level obligations like evaluation, adversarial testing, and incident tracking under Article 55. High-risk status under Article 6, by contrast, is a property of how a specific AI system is used, such as being a safety component of a regulated medical device. A device can be high-risk without ever touching a systemic-risk GPAI model, and a systemic-risk model can be embedded in many different downstream systems that are not medical devices at all.

Grouped by theme

Editor's picks

· Hand-selected related concepts

Regulatory

General-Purpose AI Model(GPAI)

AI model trained on broad data at scale that displays significant generality and can be integrated into many downstream systems.

Regulatory

High-Risk AI System (EU AI Act)

AI systems captured by Article 6 of the EU AI Act because they are safety components of regulated products or listed in Annex III.

More in Regulatory

· Same category

Regulatory

510(k) Premarket Notification(510(k))

FDA submission demonstrating a device is substantially equivalent to a legally marketed predicate.

Regulatory

510(k) Summary vs 510(k) Statement

Two alternative disclosure mechanisms in a 510(k) submission, a Summary is public on FDA's website; a Statement promises to share Safety & Effectiveness info on request.

Regulatory

513(g) Request for Information(513(g))

Formal mechanism to ask FDA whether a product is a device and, if so, its likely classification.

Regulatory

Abbreviated 510(k)

510(k) variant that relies on FDA guidance, special controls, or recognized consensus standards.

Cited by

Where this term appears across MedTech Terms.

Ecosystems (3)

Latest in MedTech

Sources

3 sources

Every citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

Tier 1Binding law and standards· 1Tier 2Regulator guidance and consensus· 1Tier 4Trade press and expert commentary· 1

Link health: 3 verified· last checked 2026-06-20

EUR-Lex·1RAPS·1FDA·1

Inline markers like [1] jump to the matching reference above.

My progress

All terms0 / 513

Regulatory0 / 101

Saved on this device, and to your account when signed in. View studied terms

Full glossary

Browse all terms A to Z, each with a short definition.

On this term

Category: Regulatory
Sources: 3
Updated: 7/25/2026

Compare with another term

Learn in 60 seconds

Additional AI Act tier for GPAI models above a compute threshold or otherwise designated as posing systemic risk.

·MedTech products rarely train models at this scale, but they frequently consume them.
·Article 55 then requires model evaluation, adversarial testing, tracking and reporting of serious incidents, and adequate cybersecurity protections at the model layer.

Remember this

Watch out: Confusing systemic-risk designation (a property of the model) with high-risk status (a property of the AI system's use case).

Related terms

You may also need

Auto-suggested from Regulatory and shared keywords.

All Regulatory terms

From the Blue Goat network

Related resources and services on this topic.