Managing Biological Risks from General-Purpose AI Models under the EU AI Act

GovAI published a technical report on October 19, 2026 arguing that EU AI Act systemic-risk provisions leave GPAI providers 'considerable discretion' over how biological risks are evaluated, documented, and communicated to the EU AI Office, creating three oversight gaps: evaluations are hard to compare across providers, trusted-access deployments receive less attention than standard external deployment, and post-deployment monitoring, escalation, and incident reporting are opaque. The report, authored by Bhuvana Sudarshan, Zaheed Kara, Matthew van der Merwe, John Halstead and others, sets out nine recommendations across five priority areas — evaluate biological risks of trusted-access deployments; establish post-deployment monitoring, escalation, and incident-reporting processes for biorisk; report evaluations of safeguard performance and robustness against biological misuse; map capability thresholds to named responses; and report biological uplift from models in a standardized format.

With the AI Office now enforcing GPAI obligations and the General-Purpose AI Code of Practice informing compliance, this is a concrete, expert-developed baseline for what regulators are likely to expect on biorisk assessment — directly relevant to frontier-lab EU compliance strategy and to any enterprise assessing frontier GPAI vendors in the EU.

For GPAI providers or enterprise buyers relying on systemic-risk models in the EU, compare current biorisk evaluation and reporting practices against the report's nine recommendations ahead of Code of Practice signatory reviews.