An Open Pipeline and Dashboard for Systemic-Risk Evidence under the EU AI Act's Code of Practice
Authors: Jacob T. Emmerson, Phuong-Anh Nguyen-Le, Ronan Romano, Wilber Sean V. Anterola, Yann Billeter, Zhijing Jin
Organizations: Vector Institute · EuroSafeAI · University of Maryland · Purdue University · Brown University · ETH Zurich · MPI for Intelligent Systems, Tübingen · University of Toronto
Claims about AI safety reach audiences well beyond the AI community, yet many rely on opaque evidence or static assessments, when supporting evidence is accessible at all. We present the Systemic Risk Index, an open evaluation pipeline and dashboard built to make empirical evidence more transparent and traceable to the public. Our work organizes 19 public benchmarks into four systemic-risk categories defined by the EU GPAI Code of Practice---CBRN, cyber offense, harmful manipulation, and loss of control---and evaluates models using harm-preserving perturbations and simulated deployment contexts. The interactive dashboard lets users alternate between average and worst-case aggregation, vary how model capability affects the aggregate score, and trace each risk rating to its benchmark evidence. Across 18 models, scores fall by 14 to 37 points under worst-case aggregation, highlighting information that can be hidden by an average assessment of model risk. LLM judges show agreement with human graders comparable to human--human agreement (κ=0.78–0.82), and a blind audit finds that 83% of sampled transformations preserve the original harm. In a survey (N=21), most participants report that scores are easy to understand and that the dashboard encouraged them to view model evaluations under different settings
Figures & tables
Figure 1: Dashboard Overview. The dashboard summarizes model or provider results across four systemic-risk categories. Users can switch between provider- and model-level views, compare average and worst-case aggregation, adjust capability weighting, and expand each risk to inspect benchmarks. Row expansion is in Figure 5 , with the fully expanded dashboard in the Appendix (Figure 6 ).
Figure 2: Evaluation Pipeline. For each benchmark item, we evaluate a baseline, harm-preserving perturbations, and a generated scenario. We score each model response using the benchmark criterion and aggregate the resulting evidence into mean or per-item worst-case risk scores. Appendix C provides the complete example.
Figure 3: Average vs. Worst-Case Aggregation. Switching the aggregation rule can change both model ratings and ordering. The worst-case view highlights individual weak responses that may be obscured by an average.
Figure 4: Capability Weighting. Users can vary how strongly model capability contributes to the aggregate score.
Figure 5: Benchmark Drop-down. Expanding a systemic-risk row reveals the benchmarks contributing to that score. Each benchmark includes a short description of what it measures and a link to the original source.
Construct
Mean
SD
4–5 ( n )
Score interpretation
Score meaning
4.33
0.58
20
Direction
4.62
0.59
20
Evidence level
4.19
1.25
16
Accessible encodings
3.90
0.94
13
Assumptions and sensitivity
Table 1: Questionnaire results after free exploration of the dashboard ( N=21 ). Each construct corresponds to one statement rated on a 5-point scale. We report means, sample standard deviations, and counts of ratings of 4 or 5. Groups organize related design goals.
Model
Baseline
Perturbations
Agentic Scenarios
Average
Worst-case
Δ
Claude Sonnet 5
85.76
84.99
90.70
87.85
73.09
-14.76
Claude Haiku 4.5
86.95
86.68
93.15
89.92
73.22
-16.70
GPT-5.6 Luna Pro
83.76
82.95
88.32
85.64
68.49
-17.15
GPT 5.6 Sol
79.87
79.29
88.10
83.70
65.35
-18.35
GPT-oss-120b
83.82
83.36
83.68
83.52
65.94
-17.58
Gemini 3.6 Flash
75.52
75.17
72.30
73.74
53.27
-20.47
Table 2: Systemic Risk Index. These are the expanded results from our evaluation pipeline. Average is the mean of the Perturbations and Agentic Scenarios columns; Δ is Worst-case minus Average; bold marks the lowest of the three stages. Worst-case is unlikely to match any individual column because it takes the worst-case result for any individual sample, while each column averages across its own stage.
GPT–Sonnet
Human–GPT
Human–Sonnet
Human–Human
Cluster
κ
n
κ
n
κ
n
κ
n
CBRN
0.86
1884
0.84
15
1.00
5
0.84
15
Cyber
0.76
3000
0.89
25
0.84
25
0.78
25
Loss of control
0.78
550
1.00
5
1.00
4
1.00
5
Manipulation
0.84
6605
0.66
50
0.71
49
0.79
50
All
0.83
12039
0.78
95
0.79
83
0.82
95
Table 3: Judge Agreement. Agreement is measured using Cohen’s κ . GPT-Sonnet is between the two judges ( GPT-5.6-Luna and Claude-Sonnet-4.5 ) over every sample that received grading from both models. Human–{GPT, Sonnet} are the agreements between the LLMs and two blind human raters on 96 items (5 per evaluation schema).
Family
CBRN
Cyber Offense
Loss of Control
Harmful Manipulation
All
Paraphrase
0.875
0.875
1.000
0.500
0.813
Register
0.875
0.875
1.000
0.500
0.813
Scenario
0.625
1.000
0.875
1.000
0.875
All
0.792
0.917
0.958
0.667
0.833
Table 4: Harm Consistency. We pass a subsample of perturbations to a blind human judge to determine whether the harm-intent is consistent with the baseline prompt. Cells represent the fraction of perturbations judged to be consistent with the original query (8 pairs per cell, 96 in total); all is the average over the three families.
Appendix figures & tables4 assets
Supplementary material from the paper’s appendix.
Appendix
Table 10Table 11
Figure 6: Fully Expanded Leaderboard. The leaderboard with every risk row expanding to its corresponding benchmarks. Benchmarks marked as diagnostic are not included in the grading as they do not reflect the risk being measured (MITRE False Refusal measures false refusal rates; a model that refuses to write any code would be viewed as perfectly safe on Cyber Offense).
Construct
Survey statement
Mean
SD
4–5 ( n )
Score interpretation
Score meaning
I understand what the displayed score represents.
4.33
0.58
20
Direction
It is clear whether a higher score indicates better or worse performance.
4.62
0.59
20
Evidence level
I can distinguish evidence about an individual model from evidence about an organization.
4.19
1.25
16
Accessible encodings
I can interpret grades or status labels without relying on color alone.
3.90
0.94
13
Assumptions and sensitivity
Appendix
Table 5: Full questionnaire and item-level results after free exploration of the dashboard ( N=21 ). Each construct was operationalized through one statement rated on a 5-point scale. We report means, sample standard deviations, and counts of ratings of 4 or 5. All items received 21 responses. Statement groups are not composite scales and do not reproduce the original questionnaire order. Responses reflect self-reported understanding and perceived interface support only and not observed performance.
Institutions that deploy large language models in regulated settings often need technical evidence of responsible AI practices before approving a deployment. COMPL-AI provides a technical interpretation of the EU AI Act that organises this evidence under six principle groups and eighteen technical requirements, twelve of which current benchmarks can measure. The benchmark suites that produce this evidence are typically operated from a command line, while the staff who approve deployments are non-engineers. We present VERA, an open-source self-hosted dashboard deployed to facilitate responsible AI processes within a large European bank. A reviewer selects a model and runs public benchmarks against it. VERA scores the twelve requirements that current benchmarks can measure and instruments the energy consumed by each evaluation, adding run-level evidence for environmental impact. We run four served open-weight models through the requirement pipeline, and the dashboard displays a score for each measurable requirement. A within-subject study then compares how participants read these benchmark results: from the raw output files in one condition, and through the VERA dashboard in the other. The dashboard reduced the time needed to perform the responsible AI assessment, reducing the time required from 56 seconds using raw files to 30 seconds using our dashboard, on average. Our dashboard scored highly (4.36 out of 5) on usefulness in the survey conducted within the organization. The dashboard and the study material are released publicly to promote replicability and reproducibility in different organisational contexts.
Robin Quériaux, Solveig Bachellery, Léa Déléris +4
BNP Paribas, France · Dalhousie University, Halifax, Canada
The rapid deployment of AI systems across high-stakes domains has created urgent demand for standardized evaluation, yet the field remains fragmented across competing risk taxonomies that catalog risks without showing how an audit is executed. At least 74 AI risk taxonomies exist, and almost all stop at the catalog. The hard part of auditing is not naming a risk but operationalizing it: turning it into a test run against a real system, a measured value, a calibrated severity, and a defensible grade. This paper leads with that bridge. We present the operationalization layer Eticas has built and run, shown end to end on a single risk (PII leakage) against a public benchmark, and then the open taxonomy that makes the method scale. On GPT-4-0314, a disclosure risk that seven external frameworks require be controlled is measured at 0%, 51%, and 84% disclosure as adversarial conditioning increases, mapping through calibrated severity bands to a subcategory grade of E with a SYSTEMIC pattern. Around this example, the Eticas AI Risk Taxonomy v2.0.0 organizes 76 active subcategories across 10 categories and 20 sub-groups, with mappings to 18 external frameworks across compliance, reference, and academic tiers. Its category and sub-group layer is published under CC BY 4.0 as open semantic infrastructure with stable URIs and SKOS/JSON-LD distributions, and a worked subcategory example shows the operational layer down to its severity thresholds. The contribution is the demonstrated bridge from concept to graded finding, anchored by a clean separation of risks from the mechanisms by which they surface, and framed by an open-core model in which the conceptual scaffold is open and the methodology calibration is the practitioner layer. This is the infrastructure the AI auditing field needs: shared, open, and demonstrably operable.
Due to ambiguity in the wording of the EU AI Act, we examine the question of to what extent frontier biological foundation models such as ESM3 are subject to obligations for general-purpose AI models with systemic risk under the EU AI Act. In this paper, we map ESM3 to the biorisk chain, and conclude that it would be desirable if the providers of ESM3 and similar biological models were subject to these obligations, which would require them to assess and mitigate dual-use risks from their models. We then perform an analysis, comparing the attributes of ESM3 to the classification criteria in the AI Act and the supporting material. We conclude that at this time, ESM3 does not appear to be meaningfully regulated by the Act. We then propose remedies to correct the situation.
Taro Qureshi, Jacob Griffith, Koen Holtman +3
Northeastern University London · London School of Economics and Political Science · AI Standards Lab +2