Overview of the General-Purpose AI Code of Practice
The General-Purpose AI (GPAI) Code of Practice is a voluntary compliance tool published by the European Commission on July 10, 2025. It provides structured guidance for providers of general-purpose AI models to meet obligations under the EU Artificial Intelligence Act (AI Act), particularly Articles 53 and 55. The Code is designed to reduce administrative burdens and enhance legal certainty for providers by offering a recognized pathway to demonstrate compliance with transparency, copyright, and safety and security requirements.
The Code was developed through a multi-stakeholder process involving 13 independent experts and contributions from nearly 1,000 stakeholders, including AI developers, academics, civil society organizations, and national authorities. It underwent three iterations before its final publication, reflecting extensive input and refinement.
Most major AI model providers, including Amazon, Anthropic, Google, IBM, Microsoft, and OpenAI, have signed the Code. However, some providers, such as xAI, have opted to sign only specific chapters, such as the Safety and Security chapter, while others, like Meta, have declined to sign entirely. Chinese AI companies, including Alibaba, Baidu, and Deepseek, have also not signed the Code to date.
Key Obligations and Scope of the Code
The GPAI Code of Practice is divided into three chapters: Transparency, Copyright, and Safety and Security. The Transparency and Copyright chapters apply to all providers of general-purpose AI models, addressing obligations under Article 53 of the AI Act. These chapters provide practical solutions for documenting model capabilities, limitations, and training data summaries, as well as ensuring compliance with EU copyright law.
The Safety and Security chapter is specifically tailored for providers of the most advanced models, those classified as presenting systemic risk under Article 55 of the AI Act. These models are defined as those trained with more than 10^25 floating-point operations (FLOPs) or those designated by the Commission as having equivalent impact or capabilities. This chapter outlines rigorous risk management practices, including model evaluations, risk mitigation, incident tracking, and cybersecurity measures.
Providers of models with systemic risk must conduct comprehensive risk assessments before deploying or substantially updating their models in the EU market. The Code mandates that signatories identify, analyze, and mitigate risks across four specified categories: CBRN (chemical, biological, radiological, and nuclear), loss of control, cyber offense, and harmful manipulation. Additional risks to public health, safety, and fundamental rights must also be considered.
Implementation and Compliance Mechanisms
Signatories to the GPAI Code of Practice commit to adhering to the outlined practices, which are designed to align with the AI Act’s requirements. The Transparency chapter includes a Model Documentation Form to streamline compliance with transparency obligations, while the Copyright chapter provides guidelines for mitigating risks of copyright-infringing outputs. The Safety and Security chapter requires signatories to establish robust risk management frameworks, including independent external model evaluations.
The Code emphasizes continuous risk management throughout the model lifecycle, including post-market monitoring and incident reporting. Signatories must document their safety and security frameworks and ensure organizational governance structures are in place to oversee risk management. This includes promoting a culture of risk awareness, whistleblower protections, and mechanisms for internal challenges to decisions related to systemic risk management.
Providers that do not sign the Code remain obligated to comply with the binding requirements of the AI Act. The European Commission has indicated that it may take enforcement actions against companies that fail to demonstrate compliance through alternative means. The Signatory Taskforce, chaired by the AI Office, facilitates collaboration among signatories to ensure consistent application of the Code’s provisions.
Practical Tools and Resources
The GPAI Code of Practice includes practical tools to assist providers in meeting their obligations. The Transparency chapter provides a Model Documentation Form (DOCX) to help providers document model capabilities, limitations, and points of contact. The Copyright chapter offers solutions for aligning with EU copyright law, such as policies to mitigate risks of copyright-infringing outputs.
For providers of systemic-risk models, the Safety and Security chapter outlines state-of-the-art practices for managing risks. This includes requirements for independent external evaluations, risk acceptance criteria, and continuous monitoring. The Code also references additional resources, such as the training data summary template, to further support compliance efforts.
Providers can sign the Code by completing the Signatory Form and submitting it to EU-AIOFFICE-CODE-SIGNATURES@ec.europa.eu. The European Commission maintains an updated list of signatories, which is continuously reviewed and published. Questions regarding the signing process can be directed to the same email address, with additional details available in the dedicated Q&A section.
Required actions
- Transparency chapter: maintain model documentation and provide it to the AI Office and downstream providers - Copyright chapter: adopt a copyright policy, honour machine-readable opt-outs and avoid infringing outputs - Safety and security chapter (systemic-risk models): adopt a safety and security framework, evaluate and mitigate systemic risks, report serious incidents and protect model weights