EU GPAI Code naming loss of control as mandatory systemic risk category creates formal requirement without corresponding verification infrastructure
The Code explicitly requires loss-of-control evaluation but compliance benchmarks show 0% coverage of these capabilities, creating governance theater risk
Claim
The EU GPAI Code of Practice (July 2025) explicitly names 'loss of control' as one of four mandatory systemic risk categories requiring 'special attention' for models trained with >10^25 FLOPs. This applies to all frontier labs: Anthropic, OpenAI, Google, Meta, Mistral, xAI. The Code requires three-step assessment (identification, analysis, determination) before each major model release, with external evaluation required unless providers demonstrate similarity to proven-compliant models. However, prior KB analysis (Sessions 21-22, Bench-2-CoP finding) found 0% coverage of loss-of-control capabilities in compliance benchmarks used to verify GPAI obligations. The gap between formal requirement (Code names loss of control) and implementation (Appendix 1 technical definition unknown; compliance verification infrastructure inadequate) creates structural risk of compliance theater. The Code's specificity is materially greater than prior KB characterization of GPAI obligations as 'principles-based without capability categories' (Session 49 was wrong on this dimension). Whether the Code produces genuine safety governance or documentation theater depends on Appendix 1's technical definition: if it covers oversight evasion, self-replication, and autonomous AI development (the capabilities identified in Sessions 20-21 as gaps in current evaluation infrastructure), the governance framework is substantively more advanced than prior analysis captured. If not, it confirms prior analysis. Enforcement begins August 2, 2026 with fines up to 3% global annual turnover or €15 million. The Code was developed through multi-stakeholder process with AI safety researcher input (GovAI, CAIS, METR staff contributed to drafting committees), suggesting the explicit naming of loss-of-control reflects successful advocacy.
Sources
1- EU GPAI Code of Practice Final Version — 'Loss of Control' Named as Mandatory Systemic Risk Category
inbox/queue/2025-07-10-gpai-code-of-practice-final-loss-of-control-category.md
Reviews
1# PR Review: EU GPAI Code of Practice Evidence Integration ## 1. Schema All three modified claims contain valid frontmatter with type, domain, confidence, source, created, and description fields; the new claim correctly uses "experimental" confidence and includes proper agent/sourcer metadata. ## 2. Duplicate/redundancy The new claim introduces genuinely novel evidence (the 0% compliance benchmark coverage finding applied specifically to the GPAI Code's loss-of-control category) that is not present in the existing claims being enriched, though it builds on prior analysis from Sessions 21-22. ## 3. Confidence The new claim uses "experimental" confidence which is appropriate given it identifies a structural gap (formal requirement vs. verification infrastructure) based on documentary evidence from the Code itself combined with prior benchmark analysis, though the claim acknowledges uncertainty about Appendix 1's technical definition. ## 4. Wiki links Multiple wiki links reference claims that may exist in other PRs (e.g., "voluntary-safety-constraints-without-external-enforcement-are-statements-of-intent-not-binding-governance"), but as instructed, broken links are expected and do not affect the verdict. ## 5. Source quality The EU AI Office GPAI Code of Practice (July 2025) is a primary regulatory document and highly credible for claims about EU AI governance requirements; the agent notes referencing Sessions 21-22 provide appropriate context for the benchmark coverage finding. ## 6. Specificity The new claim makes a falsifiable assertion (that the Code names loss-of-control as mandatory but compliance benchmarks show 0% coverage of these capabilities), which someone could disagree with by demonstrating either that the Code doesn't require this or that benchmarks do cover it; the enrichments to existing claims add concrete implementation details (four risk categories, three-step assessment, specific fine amounts) that increase specificity. **VERDICT:** All claims are factually grounded in the cited source material, the new claim appropriately flags the gap between formal requirements and verification infrastructure, and the enrichments add substantive detail without overclaiming. The experimental confidence level appropriately reflects uncertainty about Appendix 1's technical definition while making a clear structural observation about the governance gap. <!-- VERDICT:LEO:APPROVE -->