Oxford Martin memo proposes how the EU AI Office can define the state of the art in general-purpose AI risk management

A memo by seventeen named authors, including Luise Eder and Robert Trager, examines how the EU AI Office could decide what counts as the state of the art in managing risk from the most powerful general-purpose AI models. It concerns the General-Purpose AI Code of Practice, which converts the EU AI Act's duties into specific steps on safety and security, transparency and copyright.

The issue sits in the Code's Safety and Security chapter, which covers only models with systemic risk. Signatories must reach the state of the art on several central provisions, a moving benchmark meant to let regulation keep pace with technology. The memo notes that neither the Act nor the Code explains how to decide which measures qualify, how to resolve rival claims, or when to revise expectations as evidence changes.

The authors contend that the state of the art is the product of a process, not something fixed by what providers happen to do. They see it emerging from scientific debate among a wide expert community of academics, civil society and independent specialists. For consistent and comparable assessments they propose three criteria drawn from EU legal precedent: availability, meaning technically feasible rather than aspirational; proportionality, which weighs how well a measure works against the load it imposes; and verifiability, meaning independent parties can examine it.

For the institutional process the memo suggests three steps: monitoring gaps in current risk management, letting any actor in the ecosystem contribute innovations and evidence, and having the AI Office, backed by the Scientific Panel, carry out and announce the formal assessment.