Microsoft and OpenAI file EU compliance plan, accept “systemic risk” obligations for GPT-4-class models under AI Act
Enzo Reno ·
Microsoft and OpenAI submitted a joint compliance plan to the European Commission on Wednesday in Brussels, stating their GPT-4 class meets the general-purpose AI systemic risk threshold under the EU AI Act and detailing how they will meet new obligations, according to a filing seen by TechGlobal.news. The plan covers independent model evaluations, safety incident reporting, and disclosures on training compute and energy use for models offered through OpenAI’s API and Microsoft’s Azure OpenAI Service.
The timing matters because the AI Act’s obligations for general-purpose AI with systemic risk begin phasing in over the next year, and the EU’s AI Office has begun formal reviews of providers that cross the law’s compute threshold of 10^25 floating point operations. Acknowledging systemic risk status puts Microsoft and OpenAI at the front of the enforcement queue.
What Microsoft and OpenAI committed to The filing says OpenAI will commission external red teams to test high-risk capabilities and will publish summary evaluation results and mitigations. Microsoft committed to expose equivalent safety controls and provenance features in Azure OpenAI Service, including C2PA-based content credentials on eligible outputs, and to provide enterprise customers with model and system cards for each generally available release.
Both companies said they will report significant safety incidents to the AI Office and relevant national authorities within the required timelines. They also pledged to disclose model training compute and associated energy use using a methodology aligned to the AI Act’s transparency articles and to provide researchers with controlled access for reproducible testing.
Why this matters now Microsoft has invested more than 10 billion dollars in OpenAI, a figure widely reported since 2023, to underwrite compute and distribution through Azure. Microsoft said in January 2024 that over 53,000 organizations used Azure OpenAI Service, a scale that brings the firm directly into the EU’s compliance regime as a distributor and partner.
The AI Office opened its first probes into compliance approaches in March 2024 after the law’s adoption, and regulators have flagged content provenance, red-teaming, and incident reporting as early priorities. Analysts at Bernstein and CCS Insight have said the largest providers will likely set the tone for auditability and disclosures that smaller developers then mirror.
Industry context and rival pressure Google, Anthropic, and Meta have each published model cards and watermarking approaches and are members of the C2PA coalition, which includes Adobe and Microsoft. Google announced its first Arm-based Axion CPUs for its cloud in April 2024, part of a broader push to optimize AI cost and power, which ties directly into the Act’s new energy disclosure focus.
Nvidia’s data center revenue jumped in fiscal 2024 as GPU demand surged for training and inference, which has amplified regulatory scrutiny of compute concentration and reporting. The Commission has said it will update systemic risk thresholds as hardware efficiency improves.
If the AI Office signs off on Microsoft and OpenAI’s plan, it could become the de facto checklist for general-purpose AI compliance in Europe. That would influence product roadmaps, partner contracts, and procurement standards across cloud and enterprise software, as AI capability, safety, and energy reporting become table stakes in large deals.