Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The EU AI Act can require companies to document evaluations, assess certain risks and submit to regulatory scrutiny. Those legal duties do not, by themselves, make an evaluation meaningful: that depends on whether suitable tests exist and produce evidence relevant to the risks at hand. The Act is not proven ineffective because testing is difficult, and it does specify evaluations in some cases. The important distinction is between a legal obligation to assess AI and the practical ability to measure what matters.
What does the AI Act require companies to test?
The Act addresses both general-purpose AI (GPAI) models and AI systems. The obligations differ according to what is being regulated and the provider’s role. Under the European Commission’s Q&A, GPAI-model obligations apply to the model regardless of its eventual use, while requirements for an AI system depend on its use context. A company that supplies a model and also integrates it into a system may have duties in both roles.
| Regulatory route | Object | What the duty involves |
|---|---|---|
| Baseline GPAI obligations | The model | Provider documentation that includes training and testing processes and evaluation results, under Article 53 of Regulation (EU) 2024/1689. |
| Additional GPAI obligations for models with systemic risk | The model and risks associated with it | Model evaluations using standardised protocols and state-of-the-art tools; documented adversarial testing; systemic-risk assessment and mitigation; serious-incident reporting; and cybersecurity safeguards, as described by the Commission. |
| High-risk AI system conformity assessment | The system | A conformity-assessment procedure under Article 43, with the applicable route depending on the system category and relevant product and Union harmonisation legislation. |
These routes are related but not interchangeable. Model evaluation under GPAI obligations is not the same legal process as conformity assessment for a high-risk AI system. The applicable Article 43 procedure can also involve harmonised standards or common specifications in relevant cases; it should not be described as one uniform independent laboratory test for every high-risk system.
What does Article 53 say about GPAI testing?
For baseline GPAI obligations, Article 53(1)(a) requires providers to “draw up and keep up-to-date the technical documentation of the model, including its training and testing process and the results of its evaluation.” That is a documentation duty. It calls for an account of the provider’s processes and results, but does not establish one universal test suite suitable for every model and use.
#1 Best Overall
The Commission’s Q&A also says that certain obligations, including documentation of testing and systemic-risk assessment, can concern development before a model is placed on the market. Testing is therefore not necessarily limited to a final pre-release check; providers may need relevant evidence while the model is being developed.
Additional duties for systemic-risk models
The Commission describes a further set of obligations for GPAI models with systemic risk. These include evaluation with standardised protocols and state-of-the-art tools, adversarial testing that is conducted and documented, assessment and mitigation of systemic risks at Union level, reporting serious incidents, and cybersecurity protections for the model and its physical infrastructure. These requirements are not a general description of what every AI system must do.
Why a legal duty does not settle what counts as a good test
Testing is not a single measurement. NIST’s overview of AI measurement and evaluation describes work involving metrics, tasks, challenge problems, testbeds, software tools, datasets and technical gaps. It notes that evaluation has commonly focused on accuracy and robustness, while bias, interpretability and transparency are also subjects of measurement activity. This is useful technical context, not a finding about EU compliance and not a binding EU requirement.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →A result is useful only in relation to the question the test is meant to answer. A benchmark score may say something about performance on its chosen tasks; it cannot automatically establish safety across other contexts, users or failure modes. A meaningful evaluation therefore needs a defined objective, an appropriate test design, evidence that the test addresses the relevant risk, and a clear account of the conditions and limits of the result. Those are practical considerations for producing evidence, not a substitute for the Act’s legal requirements.
This is the force of the headline’s argument: regulation depends on evidence that can be produced and interpreted. It does not follow that no useful AI tests exist, or that the Act cannot be enforced. Rather, legal wording and measurement capability answer different questions. The law can require an evaluation; the test method determines what the evaluation can credibly show.
Can EU regulators evaluate a model themselves?
Yes. Article 92 gives the AI Office authority to evaluate GPAI models to assess provider compliance or investigate systemic risks. If information already gathered is insufficient, the Office may conduct an evaluation; the Commission may appoint independent experts. Access can be requested through APIs or other suitable technical means and tools, including source code. Article 92 also provides for implementing acts setting detailed arrangements for evaluations.
This authority creates a route for regulator-led scrutiny in addition to a provider’s own evidence. It does not mean every model receives the same evaluation, or that a regulator’s ability to request access settles which methods will be adequate for every technical question.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteHow is high-risk system assessment different?
Article 43 covers conformity assessment for high-risk AI systems. The applicable procedure depends on the system category and the relevant product and Union harmonisation legislation; the Article also refers to harmonised standards or common specifications where relevant. The legal route is therefore system-specific. It should not be collapsed into the GPAI model-evaluation regime or portrayed as an identical third-party review for all high-risk systems.
The distinction matters in practice. A provider may need evidence about a GPAI model, while an organisation placing a system into a particular use context may also have system-level obligations. The model and the deployed system raise different questions, and their evidence may need to address different risks.
What the Code of Practice and new assessment frameworks can—and cannot—show
The European Commission says the GPAI Code of Practice was published on 10 July 2025 and involved nearly 1,000 stakeholders in its drafting. That process is evidence of implementation support and stakeholder participation. It does not, by itself, prove that every relevant risk has an adequate test or that every assessment produces comprehensive evidence.
Outside EU law, NIST’s TEVV-Athlon framework offers an example of practical work to structure customized assessments around an organisation’s testing, evaluation, verification and validation objectives. Its four-stage approach uses “Events and Tools” to produce data on measurement concepts. NIST is a US authority, and this framework is not an EU standard or legal requirement. NIST’s public comment period ran from 7 August through 6 October 2026 and had closed by 11 October 2026; the consultation is not proof that the framework’s effectiveness has been validated.
What should an organisation ask before relying on an AI evaluation?
For a developer, provider or public-sector buyer, the useful question is not simply whether a test was run. Ask what its evidence can support:
- What is being assessed? Identify whether the evidence concerns a GPAI model, a high-risk AI system, or both.
- Which obligation applies? Separate baseline GPAI documentation, additional systemic-risk duties and system-level conformity assessment.
- What risk or claim is the test intended to address? A metric or benchmark should be connected to a defined evaluation question.
- What were the test conditions and limits? Record the tasks, data, tools and relevant boundaries so that a result is not treated as broader than it is.
- Can the evidence be scrutinised? Keep documentation sufficiently clear for internal review and, where applicable, regulatory evaluation.
These questions do not replace legal advice or determine whether a particular system complies. They help expose the difference between having a test result and having evidence that answers the compliance or risk question being asked.
The practical verdict
The EU AI Act regulates through obligations, documentation, conformity procedures and authority to evaluate—not through a single test that proves an AI model is safe. Its requirements are real, and some specifically call for standardised evaluation and documented adversarial testing. But their practical force depends on whether the evidence is fit for the model, system, risk and context in question. The central challenge is therefore not that the Act has no rules; it is that rules requiring evaluation cannot make measurement capability appear on their own.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →
