An Open Pipeline and Dashboard for Systemic-Risk Evidence under the EU AI Act's Code of Practice
Authors: Jacob T. Emmerson, Phuong-Anh Nguyen-Le, Ronan Romano, Wilber Sean V. Anterola, Yann Billeter, Zhijing Jin
Organizations: Vector Institute · EuroSafeAI · University of Maryland · Purdue University · Brown University · ETH Zurich · MPI for Intelligent Systems, Tübingen · University of Toronto
Claims about AI safety reach audiences well beyond the AI community, yet many rely on opaque evidence or static assessments, when supporting evidence is accessible at all. We present the Systemic Risk Index, an open evaluation pipeline and dashboard built to make empirical evidence more transparent and traceable to the public. Our work organizes 19 public benchmarks into four systemic-risk categories defined by the EU GPAI Code of Practice---CBRN, cyber offense, harmful manipulation, and loss of control---and evaluates models using harm-preserving perturbations and simulated deployment contexts. The interactive dashboard lets users alternate between average and worst-case aggregation, vary how model capability affects the aggregate score, and trace each risk rating to its benchmark evidence. Across 18 models, scores fall by 14 to 37 points under worst-case aggregation, highlighting information that can be hidden by an average assessment of model risk. LLM judges show agreement with human graders comparable to human--human agreement (κ=0.78–0.82), and a blind audit finds that 83% of sampled transformations preserve the original harm. In a survey (N=21), most participants report that scores are easy to understand and that the dashboard encouraged them to view model evaluations under different settings
Figures & tables
Figure 1: Dashboard Overview. The dashboard summarizes model or provider results across four systemic-risk categories. Users can switch between provider- and model-level views, compare average and worst-case aggregation, adjust capability weighting, and expand each risk to inspect benchmarks. Row expansion is in Figure 5 , with the fully expanded dashboard in the Appendix (Figure 6 ).
Figure 2: Evaluation Pipeline. For each benchmark item, we evaluate a baseline, harm-preserving perturbations, and a generated scenario. We score each model response using the benchmark criterion and aggregate the resulting evidence into mean or per-item worst-case risk scores. Appendix C provides the complete example.
Figure 3: Average vs. Worst-Case Aggregation. Switching the aggregation rule can change both model ratings and ordering. The worst-case view highlights individual weak responses that may be obscured by an average.
Figure 4: Capability Weighting. Users can vary how strongly model capability contributes to the aggregate score.
Figure 5: Benchmark Drop-down. Expanding a systemic-risk row reveals the benchmarks contributing to that score. Each benchmark includes a short description of what it measures and a link to the original source.
Construct
Mean
SD
4–5 ( n )
Score interpretation
Score meaning
4.33
0.58
20
Direction
4.62
0.59
20
Evidence level
4.19
1.25
16
Accessible encodings
3.90
0.94
13
Assumptions and sensitivity
Table 1: Questionnaire results after free exploration of the dashboard ( N=21 ). Each construct corresponds to one statement rated on a 5-point scale. We report means, sample standard deviations, and counts of ratings of 4 or 5. Groups organize related design goals.
Model
Baseline
Perturbations
Agentic Scenarios
Average
Worst-case
Δ
Claude Sonnet 5
85.76
84.99
90.70
87.85
73.09
-14.76
Claude Haiku 4.5
86.95
86.68
93.15
89.92
73.22
-16.70
GPT-5.6 Luna Pro
83.76
82.95
88.32
85.64
68.49
-17.15
GPT 5.6 Sol
79.87
79.29
88.10
83.70
65.35
-18.35
GPT-oss-120b
83.82
83.36
83.68
83.52
65.94
-17.58
Gemini 3.6 Flash
75.52
75.17
72.30
73.74
53.27
-20.47
Table 2: Systemic Risk Index. These are the expanded results from our evaluation pipeline. Average is the mean of the Perturbations and Agentic Scenarios columns; Δ is Worst-case minus Average; bold marks the lowest of the three stages. Worst-case is unlikely to match any individual column because it takes the worst-case result for any individual sample, while each column averages across its own stage.
GPT–Sonnet
Human–GPT
Human–Sonnet
Human–Human
Cluster
κ
n
κ
n
κ
n
κ
n
CBRN
0.86
1884
0.84
15
1.00
5
0.84
15
Cyber
0.76
3000
0.89
25
0.84
25
0.78
25
Loss of control
0.78
550
1.00
5
1.00
4
1.00
5
Manipulation
0.84
6605
0.66
50
0.71
49
0.79
50
All
0.83
12039
0.78
95
0.79
83
0.82
95
Table 3: Judge Agreement. Agreement is measured using Cohen’s κ . GPT-Sonnet is between the two judges ( GPT-5.6-Luna and Claude-Sonnet-4.5 ) over every sample that received grading from both models. Human–{GPT, Sonnet} are the agreements between the LLMs and two blind human raters on 96 items (5 per evaluation schema).
Family
CBRN
Cyber Offense
Loss of Control
Harmful Manipulation
All
Paraphrase
0.875
0.875
1.000
0.500
0.813
Register
0.875
0.875
1.000
0.500
0.813
Scenario
0.625
1.000
0.875
1.000
0.875
All
0.792
0.917
0.958
0.667
0.833
Table 4: Harm Consistency. We pass a subsample of perturbations to a blind human judge to determine whether the harm-intent is consistent with the baseline prompt. Cells represent the fraction of perturbations judged to be consistent with the original query (8 pairs per cell, 96 in total); all is the average over the three families.
Appendix figures & tables4 assets
Supplementary material from the paper’s appendix.
Appendix
Table 10Table 11
Figure 6: Fully Expanded Leaderboard. The leaderboard with every risk row expanding to its corresponding benchmarks. Benchmarks marked as diagnostic are not included in the grading as they do not reflect the risk being measured (MITRE False Refusal measures false refusal rates; a model that refuses to write any code would be viewed as perfectly safe on Cyber Offense).
Construct
Survey statement
Mean
SD
4–5 ( n )
Score interpretation
Score meaning
I understand what the displayed score represents.
4.33
0.58
20
Direction
It is clear whether a higher score indicates better or worse performance.
4.62
0.59
20
Evidence level
I can distinguish evidence about an individual model from evidence about an organization.
4.19
1.25
16
Accessible encodings
I can interpret grades or status labels without relying on color alone.
3.90
0.94
13
Assumptions and sensitivity
Appendix
Table 5: Full questionnaire and item-level results after free exploration of the dashboard ( N=21 ). Each construct was operationalized through one statement rated on a 5-point scale. We report means, sample standard deviations, and counts of ratings of 4 or 5. All items received 21 responses. Statement groups are not composite scales and do not reproduce the original questionnaire order. Responses reflect self-reported understanding and perceived interface support only and not observed performance.