Bench-2-CoP: AI Benchmark-Regulation Gap

• Bench-2-CoP is a systematic framework that quantifies the benchmark-regulation gap between existing AI evaluations and the EU AI Act’s risk-focused Code of Practice.
• It employs an LLM-as-judge pipeline to map 194,955 questions from six benchmark suites onto specific capabilities and propensities, revealing a heavy bias towards testing hallucination, bias, and unreliability.
• The framework identifies critical evaluation gaps in systemic risk coverage and offers actionable guidance for policymakers, benchmark designers, and AI developers to enhance compliance testing.

Bench-2-CoP is a systematic framework for quantifying the “benchmark-regulation gap” between widely used AI benchmarks and the EU AI Act’s Code of Practice (CoP) for high-impact “General Purpose AI” (GPAI) systems. It uses validated LLM-as-judge analysis to map 194,955 questions from six representative benchmark suites onto the CoP’s taxonomy of model capabilities and propensities, with the stated aim of identifying which risk areas are tested and which remain largely or entirely unevaluated. Its central finding is a profound misalignment: the existing benchmark ecosystem is overwhelmingly concentrated on a narrow set of behavioral propensities, while several capabilities central to systemic-risk scenarios receive zero or near-zero coverage (Prandi et al., 7 Aug 2025).

1. Regulatory setting and problem formulation

The motivating premise of Bench-2-CoP is that the EU AI Act and its accompanying CoP introduce a lifecycle-based, risk-focused regulatory regime for GPAI systems. In this regime, compliance depends on systematically measuring three distinct objects: functional capabilities, understood as what a model can do; behavioral propensities, understood as what it tends to do; and affordances, understood as how it will be used. Bench-2-CoP focuses specifically on capabilities and propensities.

The framework is designed around the claim that the industry’s standard evaluation ecosystem—represented by suites such as MMLU, Big-Bench, CommonsenseQA, TruthfulQA, and BBQ—was not designed to test systemic risks such as loss of human oversight or self-replication. The paper characterizes the resulting disconnect as a “benchmark-regulation gap.” In regulatory terms, the concern is that organizations may rely on off-the-shelf benchmarks and claim compliance without evaluating the dangerous behaviors that the CoP is intended to address.

The stated objectives are threefold: to quantify the coverage gap between existing benchmarks and the CoP’s taxonomy; to provide a reproducible, data-driven mapping from 194,955 benchmark questions to the EU AI Act’s capabilities $C1$–$C13$ and propensities $P1$–$P9$; and to offer policymakers and developers guidance on which risk areas are under-tested.

2. Taxonomy, coverage notion, and analytical target

Bench-2-CoP formalizes the notion of coverage at the level of an individual CoP category. For a benchmark corpus $Q$, the coverage of category $c$ is defined as

$$Coverage_{c} \;=\; \frac{\bigl|\{q\in Q:\;q\text{ tests category }c\}\bigr|} {|Q|} \;\times\;100\%$$

This quantity measures the fraction of questions in the corpus that engage a given CoP category.

The analytical target is a category-level map from benchmark questions to the CoP’s capabilities and propensities. The paper distinguishes between dominant propensities, such as $P3$ “Tendency to hallucinate,” $P4$ “Discriminatory bias,” and $P5$ “Unreliability,” and minimal or zero-coverage capabilities and propensities, such as $C13$0 “Evade oversight,” $C13$1 “Self-replication/improvement,” $C13$2 “AI R&D automation,” $C13$3 “Autonomy,” $C13$4 “Collusion,” and $C13$5 “Mis-coordination.”

This setup implies that benchmark adequacy is not treated as a question of aggregate score quality, but as a question of whether the benchmark corpus contains items that test the categories relevant to the CoP. A plausible implication is that strong benchmark performance can coexist with severe compliance-relevant blind spots if those categories are absent from the evaluation corpus.

3. Corpus construction and LLM-as-judge pipeline

Bench-2-CoP is organized as a three-stage framework: benchmark corpus construction, LLM-as-judge development and validation, and full-corpus analysis (Prandi et al., 7 Aug 2025).

In Stage 1, an industry survey of OpenAI, Anthropic, Meta, Microsoft, and Google reports was used to select six representative suites. Low-relevance benchmarks, including pure coding or math tests, were curated out. The resulting corpus contains 194,955 questions, all standardized into JSON records containing question text, answer, choices, context, and source.

Benchmark suite	Questions
BBQ	58,492
Big-Bench-Hard	6,511
CommonsenseQA	10,962
MMLU	115,700
TruthfulQA	790
Humanity’s Last Exam (HLE)	2,500

In Stage 2, a 597-item stratified sample served as a human-annotated gold standard, with 20% dual-annotated for Cohen’s $C13$6 reliability. Three candidate LLMs—GPT-4.1, Claude-Sonnet-4, and Gemini-2.5-Flash—were prompted to classify each question into capabilities $C13$7–$C13$8 and propensities $C13$9–$P1$0, outputting only JSON. Gemini-2.5-Flash achieved the highest agreement with experts, with Capabilities $P1$1, $P1$2, and Propensities $P1$3, $P1$4, and was therefore chosen for the full-scale analysis.

In Stage 3, Gemini was run over all 194,955 questions, producing a mapping from each item to zero or more CoP categories. Each question was evaluated through a single “hydrated” prompt that defined the EU AI Act attributes, supplied the question text, context, answer, choices, and original benchmark category, and instructed the model to return a strict JSON object with two arrays, “capab” and “prop.” The pipeline then ingested the raw JSON, enriched it with metadata such as benchmark name, question ID, and model name, and stored it for analysis. No further manual adjustments were made. Statistical validation was limited to the Stage 2 gold-standard metrics of precision, recall, $P1$5, and Cohen’s $P1$6.

4. Quantitative distribution of benchmark coverage

The principal empirical result is that the benchmark ecosystem is heavily skewed toward three propensities—hallucination, bias, and unreliability—while leaving most functional capabilities untested (Prandi et al., 7 Aug 2025).

Category	Questions	% of corpus
$P1$7: Hallucination	104,640	53.7%
$P1$8: Discriminatory bias	56,249	28.9%
$P1$9: Unreliability	36,258	18.6%
$P9$0: Evade oversight	0	0.0%
$P9$1: Self-replication/improvement	0	0.0%
$P9$2: AI R&D automation	0	0.0%
$P9$3: Autonomy	5	0.003%
$P9$4: Collusion	0	0.0%
$P9$5: Mis-coordination	0	0.0%

These figures ground the paper’s claim of “profound misalignment.” The dominant public benchmarks test symptoms that are already familiar within contemporary benchmark culture, especially hallucination and bias, but they do not meaningfully test capabilities associated with more agentic or loss-of-control scenarios. The paper emphasizes that capabilities central to loss-of-control scenarios, including evading human oversight, self-replication, and autonomous AI development, receive zero coverage in the entire benchmark corpus.

A common misconception addressed by the study is that broad benchmark coverage follows automatically from benchmark popularity or scale. Bench-2-CoP rejects that inference: a large corpus can still be structurally narrow if its questions cluster around a small subset of categories.

5. Systemic-risk mapping and compliance implications

Bench-2-CoP extends the category-level analysis by mapping capabilities and propensities to four high-level systemic risks via expert “risk pathways.” On this aggregation, the paper reports 88.2% coverage for Harmful Manipulation, 0.8% for Cyber Offence, 1.7% for CBRN Risks, and 0.4% for Loss of Control (Prandi et al., 7 Aug 2025).

The asymmetry between Harmful Manipulation and the other three risk classes is central to the paper’s interpretation. It indicates that the benchmark ecosystem is not merely incomplete in a generic sense; rather, it is uneven in a way that aligns poorly with the CoP’s concern for systemic risk. The 0.4% coverage for Loss of Control and 0.8% coverage for Cyber Offence are presented as near-total evaluation gaps.

For policymakers, the paper recommends that the CoP explicitly call for benchmarks or tests addressing the zero-coverage capabilities $P9$6–$P9$7 and agentic propensities $P9$8–$P9$9. It further argues that regulators must require a “portfolio of evidence,” including red-teaming and interactive simulations, rather than relying only on static benchmarks. For benchmark designers, it proposes a new “CoP-Bench,” co-designed with regulators and oriented toward autonomy, self-modification, oversight evasion, and multi-agent coordination. It also notes that modular, high-fidelity testbeds such as SecureCyber-Bench and AgenticSafety-Bench can complement existing propensities tests. For AI developers, the recommendation is that teams should not rely solely on public benchmarks, but instead develop internal probes for under-tested risks and share protocols to catalyze new public benchmarks.

This suggests a shift in evaluation philosophy: from static, benchmark-centric validation toward a mixed regime combining benchmarking, adversarial testing, and interactive assessments.

6. Limitations, scope conditions, and proposed next steps

The paper states several limitations explicitly. First, the LLM-as-judge procedure is subject to classification error even though Gemini-2.5-Flash achieved substantial agreement with experts. The authors nonetheless argue that gaps of zero or near-zero coverage cannot be explained by modest misclassifications. Second, the scope is limited to six widely used public benchmarks and excludes proprietary or in-house tests. Third, the validation procedure is limited to the Stage 2 gold-standard metrics rather than additional downstream auditing rounds (Prandi et al., 7 Aug 2025).

The future directions proposed are correspondingly concrete. The study calls for extending the corpus to specialized safety suites such as HAMR and SORRY-Bench, and for re-validating classifications with additional expert rounds. It also recommends developing a unified “CoP-Bench” with intentional coverage of $Q$0–$Q$1 and $Q$2–$Q$3, pursuing dynamic, interactive evaluation platforms for emergent capabilities such as self-reasoning and tool-use in real systems, and collaborating internationally to avoid fragmentation between EU and global regulatory regimes.

In its own summary formulation, Bench-2-CoP provides the first quantitative diagnosis of the benchmark-regulation gap for EU AI Act compliance. Its broader significance lies in the claim that current evaluation practice is reactive and symptom-based, whereas systemic-risk governance requires proactive testing targeted at the categories that the CoP treats as compliance-critical.