EU AI Act Scientific Panel: Independent Experts Watching GPAI Models

Why the Regulation Created a Scientific Panel

Supervising frontier AI requires technical judgement that no regulator can maintain alone: evaluating model capabilities, interpreting benchmark results, and recognising emerging risks are research-grade tasks that evolve monthly. Regulation (EU) 2024/1689 answers this with a dedicated institution. Article 68 directs the Commission to establish, by implementing act, a scientific panel of independent experts intended to support the enforcement activities of the AI Office — the Commission body that exclusively supervises providers of general-purpose AI models under Chapter V.

The panel sits alongside the regulation's other governance bodies: the AI Board of Member State representatives, which coordinates national implementation, and the advisory forum of stakeholders. What distinguishes the scientific panel is independence and technical depth — members are selected for up-to-date scientific or technical expertise in AI, must act independently and objectively, may not have financial or other interests conflicting with their duties, and serve in a personal capacity rather than representing organisations or governments.

The Panel's Tasks

Article 68(3) assigns the panel a GPAI-centred mandate. It supports the AI Office in particular by:

• Supporting the implementation and enforcement of the regulation as regards general-purpose AI models and systems, including monitoring developments in the field.
• Alerting the AI Office of possible systemic risks of GPAI models at Union level, through the qualified alert mechanism of Article 90.
• Contributing to the development of tools and methodologies for evaluating the capabilities of GPAI models and systems, including through benchmarks.
• Providing advice on the classification of GPAI models with systemic risk, and on the classification of various GPAI models and systems.
• Supporting the development of tools and templates, and supporting market surveillance authorities and cross-border investigations at their request.

Under Article 69, Member States may also call upon panel experts to support their own enforcement activities, and may be required to pay fees for that support — extending the panel's expertise beyond the GPAI layer into national supervision of AI systems.

The Qualified Alert: Article 90

The panel's sharpest instrument is the qualified alert. Where the panel has reason to suspect that a GPAI model poses a concrete identifiable risk at Union level, or that a model meets the conditions for classification as a model with systemic risk under Article 51, it may provide a qualified alert to the AI Office. Upon such an alert, the Commission, through the AI Office, may exercise its supervisory powers: requesting information and documentation from the provider under Article 91, conducting evaluations of the model under Article 92 — including through independent experts — and, where justified, requesting mitigation measures or ultimately restriction, withdrawal or recall under Article 93.

The alert must be reasoned: it should indicate the point of contact, the facts and reasons grounding the suspicion, and any other relevant information. The mechanism matters because it gives independent scientists a formal channel that bypasses both commercial interests and political mediation — a published capability evaluation, an academic red-teaming result or incident telemetry can travel from the research community into supervisory action through a defined legal route.

Establishment and Composition

The Commission adopted the implementing rules for the panel's establishment and launched the selection of experts during 2025, with the panel designed to comprise several dozen independent members chosen through an open call for expression of interest, balanced across the relevant disciplines — machine learning, safety evaluation, cybersecurity, fundamental rights and domain risk areas — with attention to geographic and gender balance. Members serve fixed renewable terms, declare interests, and are screened for conflicts; the panel adopts rules of procedure and can form working groups on specific risk areas. Providers should treat the panel's published opinions, evaluation methodologies and benchmark work as advance notice of where supervisory expectations are heading.

What the Panel Means for GPAI Providers

For providers of GPAI models, three practical consequences follow. First, classification is not a one-time arithmetic exercise: a model below the 10^25 FLOPs presumption can still reach the systemic-risk list through panel-informed designation under Annex XIII criteria, so capability claims in marketing and technical reports are read by people equipped to test them. Second, the evidentiary bar for rebuttals rises: a provider arguing that its above-threshold model does not present systemic risk argues before a Commission advised by independent evaluators. Third, the research community gains standing: external researchers who find dangerous capabilities or vulnerabilities have a route to the regulator, which strengthens the case for providers to operate serious researcher-access programmes, vulnerability disclosure channels and incident intake — findings reported to the provider first are findings the provider can fix before they become alerts.

The Panel in the Wider Enforcement Architecture

It helps to place the panel within the full GPAI supervisory chain. The AI Office holds the formal powers: information requests under Article 91, model evaluations under Article 92, requests for measures under Article 93, and — through the Commission, from August 2, 2026 — fines of up to 3 percent of worldwide annual turnover or 15 million euros. The scientific panel supplies the technical judgement those powers depend on: which benchmark results matter, whether a provider's adversarial-testing record reflects the state of the art, whether a rebuttal of the systemic-risk presumption is scientifically credible. Codes of practice under Article 56 and future harmonised standards define what good looks like ex ante; the panel helps assess, ex post, whether a given provider met it. For providers this means the practical audience for technical documentation has changed: Annex XI files, safety reports and evaluation records will be read not by generalist officials but by domain experts who run the same benchmarks themselves.

The panel's influence will also be felt through method-setting. Its contributions to evaluation tools and benchmarks under Article 68(3) feed directly into how the AI Office conducts Article 92 evaluations, and over time into harmonised standards. A provider whose internal evaluation suite diverges sharply from the panel-endorsed methodology should expect to explain the divergence.

A Concrete Example

An academic team studying a widely deployed open-weight model demonstrates a reliable technique for eliciting detailed synthesis routes for controlled precursors, despite the provider's safeguards. The team discloses to the provider, which downplays the result. Panel members reviewing the published study judge that the model may present a concrete Union-level risk and submit a qualified alert under Article 90, attaching the evidence. The AI Office requests the provider's evaluation records under Article 91, commissions a targeted evaluation under Article 92 reproducing the elicitation, and the Commission subsequently requests mitigation measures under Article 93 — updated safeguards and restricted distribution of the affected checkpoint — while classification proceedings under Annex XIII criteria begin. For the provider, the difference between this path and a quiet fix six months earlier is the difference between an engineering ticket and a supervisory file.

Common Misunderstandings

The panel is not a licensing body: no provider needs panel approval to release a model. It is not the AI Board: the Board is political coordination among Member States, while the panel is independent technical advice. Its alerts are not sanctions: a qualified alert triggers examination, not liability — though obstructing the examination that follows has consequences of its own. And it is not limited to frontier laboratories' models: any GPAI model that shows concrete Union-level risk, including smaller or open models with dangerous capability profiles, sits within alert range.

Action Plan

Providers should assign someone to track the panel's outputs — methodologies, benchmark frameworks and opinions — and feed them into evaluation roadmaps; align internal capability evaluations with the methods the panel validates, since those will frame any future Article 92 examination; maintain genuine researcher-disclosure channels so external findings arrive internally first; and keep rebuttal evidence current if operating near the classification boundary. The scientific panel institutionalises something providers should want anyway: a supervisory system whose judgements are grounded in current science rather than in headlines.

For the wider ecosystem — downstream providers, deployers and enterprise buyers — the panel is worth watching for a different reason: its published assessments and the Commission's list of systemic-risk models are independent signals about the capability and risk profile of the models on which products are built. Procurement teams that anchor vendor due diligence to panel-validated evaluation methods inherit, at no cost, the most current scientific consensus on what should be tested before an AI product reaches their users. In a field where marketing claims and capability reality routinely diverge, an institution paid to know the difference is worth following closely.

This article is for informational purposes only and does not constitute legal advice. Regulatory requirements change frequently — verify current rules with official sources. Built by Sawai Gyoseishoshi Office, Hiroshima, Japan.