Z.ai shipped GLM-5.3 on 14 August with the same base model it shipped last month. Every automatic trigger in the AI Act saw nothing happen.
Same 743B base as GLM-5.2. Z.ai's own framing: every reported gain comes from scaled post-training — more task environments, longer training.
Then the numbers.
ExploitBench went 24.4% to 54.4%. CyberGym 77.2% to 84.5%. Terminal-Bench 3.0 4.6 to 28.3. Z.ai held the open weights back about two weeks for safety hardening — its own call, no regulator asked. A Z.ai researcher says a GLM-5.3 run found a "potentially serious vulnerability" in Cursor, disclosed privately and unconfirmed by Cursor — the vendor's claim, not a finding.
Now the European part.
Article 51 gets read as a compute test. It is not one. 51(1)(a) classifies a model as systemic-risk where it has "high impact capabilities evaluated on the basis of appropriate technical tools and methodologies, including indicators and benchmarks". The 10^25 FLOP figure in 51(2) is a presumption of that. A proxy, not the definition.
Look at what the proxy watches. Annex XIII lists seven criteria: parameters, dataset size, computation, modalities, benchmarks and evaluations, market reach, end-users.
Four did not move this month. Parameters: 743B, unchanged. Dataset: unchanged. Compute: post-training counts cumulatively, but it is small change against the pre-training run. Modalities: unchanged.
The one that moved thirty points was the benchmarks.
Article 52(1) wants notification within two weeks of meeting the requirement — and the requirement is the compute threshold. A capability jump delivered entirely by post-training produces no notification event. Article 51(3) already obliges the Commission to amend those thresholds for "algorithmic improvements". This release is the argument for that delegated act, written in benchmark scores.
What I'd do Monday:
1. Log the model version beside every agent run, not the family. 5.2 and 5.3 share a base and do not share a threat model. 2. Re-run your own evaluations on point releases. A vendor's delta is the vendor's harness. 3. Emit a FLOP count on your own post-training. You will be asked for the denominator. 4. Stop reading absence from a systemic-risk list as absence of capability.
The threshold measures what a model cost. The risk is what it can do. For three years those were close enough to the same number.
Which model version answered your last agent run — the family, or the point release?
#AgenticAI #EUAIAct #AIEngineering #AISecurity #Berlin
AI disclosure: the narration voice, the cover art and the brand ident animation in this video are AI-generated. The script, the claims and the source checks are mine.