The Case for ESM3 as a General-Purpose AI Model with Systemic Risk Under the EU AI Act

TL;DR

This paper analyzes whether biological foundation models like ESM3 fall under the EU AI Act's regulations for systemic risk, highlighting regulatory gaps and proposing remedies.

Contribution

It maps ESM3 to the biorisk chain, assesses its regulatory status under the EU AI Act, and suggests policy improvements.

Findings

ESM3 is currently not meaningfully regulated by the EU AI Act

Providers should be subject to obligations to assess dual-use risks

Proposes remedies to improve regulation of biological models

Abstract

Due to ambiguity in the wording of the EU AI Act, we examine the question of to what extent frontier biological foundation models such as ESM3 are subject to obligations for general-purpose AI models with systemic risk under the EU AI Act. In this paper, we map ESM3 to the biorisk chain, and conclude that it would be desirable if the providers of ESM3 and similar biological models were subject to these obligations, which would require them to assess and mitigate dual-use risks from their models. We then perform an analysis, comparing the attributes of ESM3 to the classification criteria in the AI Act and the supporting material. We conclude that at this time, ESM3 does not appear to be meaningfully regulated by the Act. We then propose remedies to correct the situation.