Managing Biological Risks from General-Purpose AI Models under the EU AI Act

Providers of general-purpose AI (GPAI) models with systemic risk must assess and mitigate biological risks under the EU AI Act. The voluntary General-Purpose AI Code of Practice specifies how signatories can meet these obligations and informs the European Commission’s assessment of alternative compliance approaches adopted by non-signatories. However, existing requirements grant providers considerable discretion over how biological risks are evaluated, documented, and communicated to the EU AI Office (“Office”).

This creates three challenges for effective oversight: 

1. Biological risk evaluations are difficult to compare across providers because methods, baselines, and reporting formats differ. 
2. Evaluations have largely focused on standard external deployment, while other contexts that may materially change a model’s biological risk profile – such as trusted access programs – receive less consistent attention.
3. There is limited visibility into how providers monitor, escalate, and respond to emerging biological risk findings before and after deployment.

These challenges make it harder to determine whether a model’s biological risks have been adequately assessed and whether its safeguards remain effective after deployment. To address them, this report presents nine recommendations to make biological risk assessments more comprehensive, comparable, and useful for regulatory oversight. We identify five priority areas:

1. Evaluate biological risks associated with trusted access deployments
2. Establish post-deployment monitoring, escalation, and incident-reporting processes for biological risk
3. Report evaluations of safeguard performance and robustness against biological misuse
4. Map capability thresholds to named responses
5. Report biological uplift from models in a standardized format

Developed by a group of experts in AI safety, governance, and biosecurity, the recommendations in this report describe how providers can meet the requirements set out in general terms by the Code of Practice. Some recommendations also depend on further action by the Office, such as new guidance or a revised Code.