Ensuring AI model evaluations provide meaningful risk information without imposing excessive burden is a central regulatory challenge. This Science Policy Forum paper, co-authored by Irregular CEO Dan Lahav, presents a framework for calibrating evaluations under the EU AI Act. It applies the framework to a case study on AI-enabled cyber vulnerability discovery.