Compute Thresholds in Regulation, Explained

Several regulatory proposals draw a line at a quantity of computation used to train a model. It is the least intuitive instrument in AI policy and the easiest one to argue about badly, because almost nobody arguing has done the arithmetic that turns the number into hardware.

What a threshold is, mechanically

A compute threshold is a trigger, not a prohibition. Training a model with more than some number of floating-point operations causes a set of obligations to attach — typically notification before or after the run, an evaluation programme, incident reporting, cybersecurity measures around the weights, and documentation. In most drafted regimes it does not mean you may not do it. It means somebody now has to be told, and you now have to be able to show your work.

The number is a proxy for capability, chosen for three properties that have nothing to do with how good a proxy it is: it can be estimated from a training plan before the run rather than measured after; it is hard to cross by accident, so it does not sweep in ordinary developers; and, historically, it correlated with the models people were worried about. Those are administrability properties. Whether the correlation holds going forward is the contested part.

Turning a FLOP count into GPU-hours

For dense transformer pretraining there is a standard approximation that has been in the scaling literature since Kaplan et al.: the training compute is about six floating-point operations per parameter per token — roughly two for the forward pass and four for the backward pass. So with N parameters and D training tokens:

C  ≈  6 · N · D                    training FLOP

accelerator_hours  =  C / (P_peak · U · 3600)

  C        total training FLOP, from above
  P_peak   the accelerator's peak FLOP/s at the training precision
  U        achieved utilisation as a fraction of peak — the term
           everyone forgets, and it is well below 1 in practice
  3600     seconds per hour

cost  =  accelerator_hours  ×  price_per_accelerator_hour

Two of those terms are the reason this page does not quote a dollar figure. P_peak depends on which accelerator and which numeric precision — the same chip is quoted at very different numbers for different formats, and comparing a threshold against a marketing figure in the wrong precision is the most common error in this arithmetic. U depends on the model, the parallelism strategy, the interconnect and the failure rate of a long run; large-scale training reports publish it and it is worth taking from a report rather than assuming. And price_per_accelerator_hour spans an order of magnitude between a spot market, a committed cloud reservation and owned hardware amortised over its life.

Do the substitution with your own numbers and the useful intuition falls out: a threshold is a statement about how many accelerators, for how long, and therefore about roughly how many organisations in the world are in scope. That is really what a legislature is choosing when it picks an exponent.

Four things the proxy does not catch

• Post-training and fine-tuning. Adapting an existing capable model costs a small fraction of pretraining, and published work has repeatedly shown that supervised fine-tuning on a modest number of examples can substantially change a model’s refusal behaviour. A change in behaviour that matters can therefore happen three or four orders of magnitude below the line. Some drafts respond with a separate, much lower fine-tuning threshold; whether that is the right fix is unsettled.
• Distillation. Capability can be transferred from a large model into a much smaller one trained well below the threshold. The compute that produced the capability was spent once, upstream; the model in the world that exhibits it was cheap.
• Inference-time compute. A training threshold says nothing about how much computation the model is permitted to spend when answering. Reasoning models spend a great deal, and spending more at inference is a demonstrated way to raise task performance without touching the weights. This is the gap the proxy has widened into most recently.
• Efficiency drift. The compute needed to reach a given capability falls over time. A fixed threshold therefore loosens every year in real terms: the same number catches fewer of the models a legislature meant to catch. Regimes that anticipate this include a mechanism to move the number by delegated act rather than by fresh legislation, which is a small drafting detail with very large consequences.

A fifth, less discussed: elicitation. A fixed set of weights with tools, retrieval, a scaffold and a long budget is a materially different system from the same weights answering in one shot. The threshold measures the artefact; the risk attaches to the deployed system.

Why regulators use it anyway

The criticisms above are widely accepted, including by people who support thresholds. The defence is comparative rather than absolute: every alternative trigger is worse to administer.

A capability threshold requires a specified evaluation, which must be written down, which makes it a target to optimise against, and which goes stale faster than a number does. “General purpose” and “frontier” have no definition that survives a lawyer. Revenue or user-count thresholds catch deployment scale rather than model capability. A compute threshold, by contrast, can be estimated before the run, is hard to fudge by much without lying about the training plan, and applies to a countable number of organisations that the regulator can actually engage with.

The honest summary is that it is a bad proxy for capability and a serviceable proxy for “organisations large enough that a notification duty is not a burden.” If that is what a legislature wants, the instrument works. If it wants to catch dangerous models, it will need something else alongside it, and nobody has a good candidate yet.

What to check in the actual text

• Is the count cumulative across a training campaign, or per run? Continued pretraining makes this decisive.
• Does it include fine-tuning compute, and is there a separate lower threshold for adaptation?
• Who is the obligated party — whoever performed the training, whoever placed the model on the market, or whoever paid?
• Is there a mechanism to change the number without primary legislation?
• What actually follows from crossing it: notification, evaluation, a pause, or an approval?

Thresholds and their consequences are amended frequently. Treat any specific figure you read anywhere, including in commentary that sounds confident, as something to verify against the current text. This page is not legal advice.