A Crack in the Framework: Risk Management and the Governance of General-Purpose AI with Systemic Risks

Abstract

Risk-based regulation has become the default European response to general-purpose AI (GPAI). Systemic risk, however, has been translated into different duties of identification, assessment, and mitigation across the Digital Services Act, the EU AI Act, and its operational interpretation in the safety and security chapter of the GPAI Code of Practice. This paper argues that the risk-management frameworks (RMFs) that underwrite that translation cannot, on their own, accommodate systemic risks from frontier AI. To show this, I situate the rise of risk-based regulation in the late twentieth-century de-regulatory turn and recover the industrial provenance of the risk equation. I then conduct a comparative analysis of the three principal EU definitions of systemic risk (DSA Article 34; EU AI Act Article 3(65) and Recital 110; and Appendix 1 of the Safety and Security Code of Prac-tice) and show that they make a divergent treatment of fundamental rights, individual harm, and intentional misuse. Finally, I identify four structural reasons why RMFs strain when applied to systemic AI risk: the cate-gorical heterogeneity of systemic risks; AI's inverted du-al-use trajectory (civilian-to-military rather than mili-tary-to-civilian); the complex regulatory geometry that produces multiple incommensurable thresholds; and the asymmetry between actors who accept risk and actors who bear its consequences.