Floating-Point Operations (FLOP): The EU AI Act's Systemic-Risk Yardstick

A floating-point operation — FLOP — is a single arithmetic calculation on a decimal number: one multiply, one add. On its own it is a unit from computer engineering, not law. But the EU AI Act borrows it for one precise job: it is the metric that decides whether a general-purpose AI (GPAI) model is presumed to carry systemic risk. Under Article 51(2) of Regulation (EU) 2024/1689, a GPAI model is presumed to have high-impact capabilities — and therefore systemic risk — when the cumulative compute used to train it exceeds 10²⁵ FLOP. That number is the Act's single most-cited threshold, and it is the whole reason a glossary term from arithmetic earns a place in a compliance regulation.

This page explains the threshold, what counts toward it, why the legislator chose a compute proxy at all, and the Commission's power to move the line.

The Article 51(2) presumption

Article 51 sets out how a GPAI model becomes a systemic-risk model. Article 51(1) says a model has systemic risk if it has high-impact capabilities (assessed against appropriate methodologies) or is designated by the Commission. Article 51(2) then supplies the bright-line proxy: a GPAI model is presumed to have high-impact capabilities when the cumulative amount of computation used for its training, measured in FLOP, is greater than 10²⁵.

Three features of that wording matter:

• It is a presumption, not an irrebuttable rule. A provider above 10²⁵ FLOP is presumed systemic-risk but may argue, through the Article 52 procedure, that its model does not in fact present high-impact capabilities. The burden sits with the provider.
• It is cumulative training compute — the total across the training run(s), not peak hardware capacity or inference cost.
• Crossing it triggers a notification duty. A provider whose model crosses, or will foreseeably cross, 10²⁵ FLOP must notify the Commission without delay and in any event within two weeks of the threshold being met or of it becoming known that it will be met (Article 52(1)).

The consequence of being a systemic-risk model is the heavier Article 55 obligation set — model evaluation, adversarial testing, serious-incident reporting to the AI Office, and cybersecurity — layered on top of the Article 53 duties that all GPAI providers carry.

What 10²⁵ FLOP actually means

10²⁵ is ten septillion — a 1 followed by 25 zeros. To put it in human terms: a single high-end AI accelerator chip running flat out for a full year produces on the order of 10²² to 10²³ FLOP. Reaching 10²⁵ therefore takes thousands of such chips running for weeks to months — the scale of the very largest foundation-model training runs, the kind operated by a handful of well-funded labs. It is deliberately set high. The legislator's intent was to capture the frontier of the largest models, not ordinary fine-tuning, not the typical enterprise model, and certainly not the systems a small EU company builds on top of someone else's model.

What counts toward the cumulative total

The Act ties the measure to the compute "used for training" the model, accumulated across the development process. In practice the questions providers wrestle with are:

• Pre-training plus subsequent training. The total is cumulative, so the headline pre-training run is the bulk, but compute added through further large-scale training stages counts toward the running total.
• Fine-tuning and adaptation. Most fine-tuning is orders of magnitude smaller than pre-training, so it rarely moves a model across the line on its own. But a provider that performs very large continued-training or repeated retraining should compute the cumulative figure and document the result, because the threshold is about the total, not any single run.
• Estimation, not perfect measurement. Training compute is normally estimated from model architecture, dataset size, and the number of training steps — the well-known approximation of roughly six FLOP per parameter per training token — rather than counted hardware operation by operation. The Act expects a defensible, documented estimate.

The practical compliance point: a provider near the threshold must be able to show its working. The figure, the method, and the assumptions belong in the technical documentation, because the Article 52 process can require the provider to demonstrate whether the threshold applies.

Why a compute proxy at all?

Capability is what the law actually cares about — a model that can materially enable harm at scale. But "capability" has no agreed unit of measurement, and waiting for harm to manifest before regulating a frontier model would defeat the purpose. Compute is an imperfect but measurable, objective, and forward-looking proxy: it correlates with capability, it can be estimated before a model is even released, and it does not depend on a regulator's subjective judgment of how dangerous a model "feels."

The trade-offs are real and the legislator knew them. A compute threshold under-counts models that achieve high capability efficiently — through better data, architecture, or post-training — at lower compute. It can also over-count a large but unremarkable model. That is precisely why Article 51 pairs the FLOP presumption with two corrective routes: the Commission's capability-based designation under Article 51(1) for models below the threshold that nonetheless have high-impact capabilities, and the scientific panel's Article 90 qualified alert for models the threshold would miss. The number is a tripwire, not the whole test.

The Commission can move the threshold

The 10²⁵ FLOP figure is not frozen. Article 51(3) empowers the Commission to adopt delegated acts to amend the thresholds in Article 51, and to supplement benchmarks and indicators, in light of technological developments — such as algorithmic improvements or increased hardware efficiency — so that the threshold continues to reflect the state of the art. As compute becomes cheaper and models more capable per FLOP, the legislator anticipated the line would need to be revisited. So treat 10²⁵ FLOP as the current figure, subject to amendment by delegated act, rather than a permanent constant.

Why most SMEs are nowhere near this

For the small and mid-sized EU companies that make up Confir's core audience, this threshold is almost always academic — and that is worth stating plainly, because the 10²⁵ figure is widely misread as a general AI-Act trigger. It is not. It governs who trains frontier GPAI models. If your company deploys ChatGPT, builds a product on the OpenAI API, fine-tunes a mid-sized open model, or runs a vendor's model in your workflow, you are not crossing 10²⁵ FLOP and the systemic-risk presumption does not touch you. Your obligations come from a different place entirely — your role as provider or deployer of an AI system, classified by its use under Article 6, not by training compute.

Worked example: a SaaS team checking whether the threshold bites

Tessadat GmbH, a German analytics-SaaS company with about 55 employees and roughly €11M turnover, fine-tunes a mid-sized open-weights language model on its own customer-support transcripts to power an in-product assistant. Its compliance lead asks the right question: does the 10²⁵ FLOP threshold make Tessadat a systemic-risk GPAI provider?

The arithmetic answers it. The base model's pre-training was performed by a third party; Tessadat's fine-tune consumed on the order of 10²⁰ FLOP — five orders of magnitude below 10²⁵. Even cumulating every training run Tessadat has ever done, the total is nowhere near the line. So Article 51(2) does not apply, there is no Article 52 notification, and there are no Article 55 systemic-risk duties. Tessadat's actual obligations flow from its role: it is a downstream provider of an AI feature, it classifies the assistant by its use under Article 6 (a support chatbot is typically limited-risk, with an Article 50 disclosure that users are interacting with AI), and it meets provider duties for what it ships. The compliance lead documents the FLOP estimate and the not-applicable conclusion — recorded, not silently assumed — and moves on to the duties that genuinely apply.

How Confir helps

Confir's rule-based engine scopes whether your organisation sits at the GPAI model layer at all, so a downstream provider or deployer is never mis-routed into systemic-risk territory it does not occupy. Where the question is genuinely live, the engine flags the Article 51(2) threshold and the Article 52 notification path; where it is not, it routes you cleanly to your real provider or deployer duties. The logic is deterministic: the same intake produces the same finding, and the rule that fired is human-readable.

Frequently Asked Questions

What is the FLOP threshold in the EU AI Act?

Under Article 51(2), a general-purpose AI model is presumed to have high-impact capabilities — and so systemic risk — when the cumulative compute used to train it exceeds 10²⁵ floating-point operations (FLOP). Crossing it presumes the model into the systemic-risk category, triggers an Article 52 notification to the Commission, and adds the Article 55 obligations on the model's provider. The presumption can be rebutted through the Article 52 procedure.

Does the 10²⁵ FLOP threshold apply to my company if I just use or fine-tune a model?

Almost certainly not. The threshold is the scale of the largest frontier training runs — thousands of accelerators over weeks. Using a model, building on an API, or fine-tuning a mid-sized model consumes compute many orders of magnitude below 10²⁵ FLOP. Your obligations come from your role as provider or deployer of an AI system, classified by its use under Article 6 — not from training compute.

Is the FLOP threshold the same as being high-risk?

No. The 10²⁵ FLOP presumption concerns systemic-risk GPAI models under Chapter V (Articles 51–55). High-risk classification concerns AI systems under Article 6 and Annex III. They are separate regimes with different subjects, deadlines, and obligation sets. A compute figure has no bearing on whether a recruitment or credit-scoring system is high-risk — that turns on use.

What counts toward the cumulative training compute?

The total compute used to train the model, accumulated across training stages. Pre-training is normally the bulk; large continued-training or repeated retraining adds to it; ordinary fine-tuning is usually too small to move a model across the line on its own. The figure is estimated from model size, dataset size, and training steps rather than counted operation by operation, and the estimate and its method belong in the technical documentation.

Can the Commission change the 10²⁵ FLOP threshold?

Yes. Article 51(3) lets the Commission adopt delegated acts to amend the thresholds and supplement benchmarks in light of technological developments — for example as algorithms and hardware become more efficient. So 10²⁵ FLOP is the current figure, not a permanent one. Providers near the line should track amendments rather than assume the threshold is fixed.

What happens if a model crosses 10²⁵ FLOP?

The provider must notify the Commission under Article 52 without delay, and in any event within two weeks of the threshold being met or of it becoming known that it will be met. The model is then presumed to have systemic risk, and the provider takes on the Article 55 obligations — model evaluation, adversarial (red-team) testing, serious-incident reporting to the AI Office, and cybersecurity — on top of the baseline Article 53 GPAI duties. The provider may attempt to rebut the presumption through Article 52.

Related guides

• Systemic risk — definition and obligations — the category the FLOP threshold presumes a model into
• Article 51 — systemic-risk classification — the full presumption, designation, and Commission-decision mechanism
• General-purpose AI model — the only category the FLOP threshold applies to
• Scientific panel of independent experts — the body that can flag capable sub-threshold models
• GPAI compliance — the practical Chapter V programme
• Provider vs deployer — the role distinction that actually governs most companies