GPAI Code of Practice

The General-Purpose AI Code of Practice (abbreviated GPAI Code of Practice or CoP) is a voluntary compliance framework published by the European Commission through its AI Office on 10 July 2025 to help providers of general-purpose AI models demonstrate compliance with the obligations in Chapter V of the EU AI Act.^[1][3] The Commission describes it as "a voluntary tool ... designed to help industry comply with the AI Act's obligations for providers of general-purpose AI models."^[1] It is organised into three chapters covering transparency, copyright, and safety and security, and it became operative on 2 August 2025, the same day the EU AI Act's rules for GPAI model providers entered into application.^[1][9] Signing is optional, but the Commission states that signatories "reduce their administrative burden" and gain "more legal certainty" than providers who demonstrate compliance through other means.^[1]

Drafted by thirteen independent chairs and vice-chairs through a multi-stakeholder process with more than a thousand participants, the Code is one of the most visible instruments of AI governance and AI regulation to emerge in 2025.^[2] The first two chapters apply to all GPAI providers on the EU market; the Safety and Security chapter targets only providers whose models meet the systemic risk threshold defined in Article 51, set at training compute above 10^25 floating-point operations.^[6][8] By August 2025, twenty-six companies had signed at least one chapter, including OpenAI, Anthropic, Google, Microsoft, Amazon, IBM, Mistral AI, Cohere, and Aleph Alpha.^[13] Meta declined publicly on 18 July 2025, and xAI signed only the safety and security chapter, making the Code one of the most visible fault lines in transatlantic AI governance.^[14][16]

What is the GPAI Code of Practice?

The Code is a voluntary instrument that providers of general-purpose AI models can use to show they meet the EU AI Act's obligations.^[1] It does not create new legal duties on its own; rather, it offers a structured, pre-agreed way to satisfy the duties already set out in Articles 53 and 55 of the Act.^[5][6] Adhering to it is not the same as complying with the Act, but the AI Office treats a signatory's adherence as evidence of good-faith compliance, which the Commission says reduces administrative burden and increases legal certainty relative to bespoke alternative arrangements.^[1][9]

The Code lays down twelve commitments in total: one for the Transparency chapter, one for the Copyright chapter, and ten for the Safety and Security chapter (consolidated from sixteen in the third draft).^[8] Each commitment is paired with concrete measures describing how a provider can satisfy it. The framework is open for signature on a chapter-by-chapter basis, so a provider may adopt all three chapters or only the subset that applies to it.^[3]

Background and legal basis

The Code is rooted in Article 56 of the EU AI Act, which directs the AI Office to encourage and facilitate codes of practice at Union level to support proper application of the Regulation.^[7] Article 56 requires the codes to cover the obligations in Articles 53 and 55 and to be developed through a process involving GPAI providers, downstream providers, civil society, academia, and independent experts.^[7]

Article 53 imposes four baseline obligations on every provider that places a GPAI model on the EU market.^[5] Providers must draw up and keep up-to-date technical documentation in accordance with Annex XI; provide information and documentation to downstream system providers per Annex XII; put in place a policy to comply with Union copyright law, in particular by respecting reservations of rights expressed under Article 4(3) of Directive (EU) 2019/790; and make publicly available a sufficiently detailed summary of training content using a template provided by the AI Office.^[5]

Article 55 layers additional obligations on providers of GPAI models with systemic risk.^[6] These providers must perform model evaluation under standardised protocols including adversarial testing; assess and mitigate possible systemic risks at Union level; keep track of, document, and report relevant information about serious incidents to the AI Office without undue delay; and ensure an adequate level of cybersecurity protection for the model and its underlying physical infrastructure.^[6]

Article 56(3) makes the role of codes of practice explicit: providers may rely on a code to demonstrate compliance with Articles 53 and 55 until a harmonised standard is published in the Official Journal.^[7] The Commission may, through implementing acts, approve a code and give it general validity within the Union, an instrument known as an adequacy decision.^[2]

How was the Code drafted?

The drafting process began in September 2024 when the AI Office issued an open call for expressions of interest.^[2] More than a thousand stakeholders registered, drawn from GPAI model providers, downstream providers, trade associations, academics, independent experts, and civil society organisations.^[2] The Commission appointed thirteen independent chairs and vice-chairs, selected for expertise, independence, geographical diversity, and gender balance, structured around four working groups aligned with the AI Act's GPAI provisions.^[2]

Scroll sideways for more →

The drafting cycle produced four successive drafts between November 2024 and July 2025.^[2] The first draft, published on 14 November 2024, established the broad architecture and an initial taxonomy of systemic risks.^[2] The second draft followed on 19 December 2024, refining evaluation protocols, transparency templates, and copyright provisions.^[2] The third draft, published on 11 March 2025, sharpened obligations around model documentation, incident reporting, and downstream information provision, and introduced a draft public summary template for training data.^[2] The final version was released on 10 July 2025 and ratified by the European Commission and the AI Board through adequacy decisions on 1 August 2025.^[1][13]

Each drafting iteration was accompanied by plenary sessions and dedicated workshops featuring GPAI model providers and a separate workshop for civil society organisations.^[2] Only one representative was permitted per organisation in each working group. By the close of drafting, the AI Office reported reviewing more than 1,600 written submissions and convening approximately 40 workshops.^[2] Industry participation was extensive, including OpenAI, Anthropic, Google DeepMind, Microsoft, Meta, Mistral AI, Cohere, Aleph Alpha, and Stability AI, alongside cloud providers, downstream developers, and civil society organisations such as the Future of Life Institute, Access Now, and European Digital Rights.^[2]

What does the Code cover?

The published Code is organised into three chapters and a set of common technical appendices.^[3] The Transparency and Copyright chapters apply to all providers of general-purpose AI models placed on the EU market, while the Safety and Security chapter applies only to providers whose models present systemic risk.^[1][8]

Transparency chapter

The Transparency chapter applies to all GPAI providers and operationalises Article 53(1)(a) and (b).^[5] It centres on a single Model Documentation Form that consolidates Annex XI and Annex XII disclosures.^[1] Signatories commit to populate the form for each model placed on the EU market, to keep it up to date, and to make relevant sections available to the AI Office on request and to downstream providers. The form covers model architecture, modalities, parameter counts, training compute, training data sources by category, energy consumption, intended and prohibited uses, known limitations, evaluation results, and recommended integration practices.^[1]

Copyright chapter

The Copyright chapter operationalises Article 53(1)(c).^[5] Signatories commit to put in place a copyright policy that complies with Union law, with particular attention to honouring rights reservations under Article 4(3) of the Copyright in the Digital Single Market Directive.^[5] Specific measures include respecting machine-readable opt-outs such as the Robots Exclusion Protocol and the TDM Reservation Protocol, taking reasonable measures not to crawl content from systematically infringing sources, mitigating downstream infringing outputs, designating a rightholder point of contact, and providing a complaints mechanism.^[8] Rightholders have argued that the opt-out provisions are too permissive, while several model providers have argued the chapter goes beyond Article 53 by imposing substantive duties.^[10]

Safety and security chapter

The Safety and Security chapter is the longest and applies only to providers of GPAI models with systemic risk.^[6][8] It is structured around a Safety and Security Framework that each signatory must adopt and update for every qualifying model, and it sets out ten of the Code's twelve commitments.^[8] Key commitments include structured risk identification across a taxonomy covering chemical, biological, radiological, and nuclear (CBRN) misuse, offensive cybersecurity, harmful manipulation, loss of control, and other large-scale risks; capability and risk thresholds with pre-defined mitigations; state-of-the-art model evaluations and adversarial testing; model and risk reports published prior to market placement; internal governance with board-level oversight, an independent reviewer for systemic risk assessments, and whistleblower protections; cybersecurity protections covering model weights, training data, and compute infrastructure; and reporting of serious incidents and near misses to the AI Office without undue delay.^[8][17]

Scroll sideways for more →

The Code also contains a set of technical appendices that elaborate on definitions, evaluation criteria, and templates.^[3] These appendices are intended to be updated by the AI Office in light of evolving practice without reopening the substantive text of the Code, an arrangement designed to keep the framework current as model capabilities advance.

Who signed the Code?

The Code is open for signature on a chapter-by-chapter basis, meaning providers may sign all three chapters or a subset.^[3] By 1 August 2025, twenty-six companies had signed at least one chapter, according to Euronews and the AI Office.^[13] The signatories include most providers of frontier general-purpose models marketed in the European Union, with the notable exceptions of Meta and Chinese providers.^[13][14]

Scroll sideways for more →

The most-watched holdout is Meta. On 18 July 2025, Joel Kaplan, Meta's chief global affairs officer, announced on LinkedIn that the company would not sign, writing that the Code "introduces a number of legal uncertainties for model developers, as well as measures which go far beyond the scope of the AI Act."^[14][15] Kaplan further argued that the EU's implementation of the law would "throttle the development and deployment of frontier AI models in Europe" and would stunt European companies looking to build businesses on top of them.^[15] Meta's refusal coincided with a broader transatlantic political dispute over digital regulation and a parallel open letter signed by chief executives of more than forty European companies asking the Commission to delay parts of the AI Act.^[10]

xAI, by contrast, signed only the Safety and Security chapter, while stating in its accompanying note that it viewed the Transparency and Copyright chapters as detrimental to innovation.^[16]

Scroll sideways for more →

Chinese providers, including DeepSeek, Alibaba, Baidu, and Zhipu, did not sign the Code.^[16] Several have not yet placed models on the EU market, and others have indicated that they will demonstrate compliance through other means.

Is the Code mandatory? Relationship to Articles 53 and 55

The Code occupies a deliberately middle position in EU AI law. Adhering to it is not the same as complying with the AI Act, and the AI Office has emphasised that signatories must still comply with the Act on its own terms.^[9] Conversely, signing creates a strong presumption of compliance with the corresponding articles, subject to the AI Office's view of the signatory's actual implementation, and the Commission states that this route reduces administrative burden and increases legal certainty.^[1]

For non-signatories, the route to compliance is open but more onerous. Providers must produce equivalent documentation, evaluations, and governance arrangements and engage more intensively with the AI Office bilaterally.^[9] Non-signatories may face additional regulatory scrutiny, though scrutiny does not amount to a sanction in itself.

The Code is intended to operate until a harmonised standard adopted under Regulation (EU) 1025/2012 is published.^[7] Drafting of such standards by CEN and CENELEC under mandate JT 21 is expected to take several years, so the Code is the primary practical reference for GPAI compliance in the meantime.^[10]

Timeline: when did the Code and the GPAI rules take effect?

The drafting and enforcement timeline interweaves several distinct dates under the AI Act and the Code. The most consequential are summarised below.

Scroll sideways for more →

The staggered enforcement scheme reflects compromises struck during the AI Act's trilogue negotiations in late 2023 and early 2024.^[4] Providers of models already on the market before 2 August 2025 are granted an additional two years to bring their models and documentation into compliance, while new entrants must comply from day one.^[9] Enforcement actions, including potential fines, may be brought only after 2 August 2026, giving providers a one-year buffer to adjust to the application of the obligations.^[9][20]

Enforcement and penalties

Under Article 101 of the AI Act, the Commission, acting through the AI Office, has exclusive enforcement jurisdiction over GPAI model providers, in contrast to the high-risk AI system regime in which national market surveillance authorities take the lead.^[19] From 2 August 2026, the Commission may impose fines of up to 3 percent of annual total worldwide turnover in the preceding financial year or EUR 15 million, whichever is higher.^[9][19]

Grounds for fines include failure to comply with documentation or information requests under Article 91, failure to comply with measures under Article 93, and failure to provide the Commission with access to a model for evaluation under Article 92.^[19] Procedural safeguards include a right to be heard, access to file, and judicial review by the Court of Justice of the European Union. The Commission may also adopt mitigation measures short of fines, such as ordering corrective action, recall of a model from the market, or production of additional documentation. The July 2025 guidelines emphasise that fines will be used as a last resort and that the AI Office expects cooperative enforcement in the early years.^[19]

How did industry and civil society react?

The signatories generally welcomed the Code as a workable compliance instrument while emphasising areas of disagreement.^[13] OpenAI said signing reflected its longstanding commitment to safety and transparency. Anthropic described the Code as a coherent baseline for compliance with Articles 53 and 55 that is consistent with its Responsible Scaling Policy. Google described the Code as a constructive framework while reserving its position on parts of the Copyright chapter. Microsoft framed its signature as a commitment to responsible AI development, and Mistral AI presented its signature as a demonstration of European leadership on AI governance.

Meta's public refusal was the most consequential industry reaction.^[14] Meta argued that the systemic risk chapter required excessive disclosure of proprietary training data and evaluation methods and imposed governance structures that did not exist in any other jurisdiction.^[15] Meta indicated that it would seek to comply with Articles 53 and 55 through alternative documentation and evaluation arrangements.

Civil society reactions were mixed. The Future of Life Institute and Access Now welcomed the Safety and Security chapter as a meaningful instrument for managing frontier risks, while criticising the Transparency and Copyright chapters as insufficiently demanding.^[17] Rightholders' associations including CISAC criticised the Copyright chapter for not requiring explicit licences or sufficiently specific training data disclosures.^[10] The Open Source Initiative welcomed targeted exemptions for open-weight models but warned that the systemic risk threshold could capture some open-weight providers.^[8]

A further line of industry critique came from European chief executives. In July 2025, a letter signed by chief executives of more than forty European companies including ASML, Airbus, BNP Paribas, and Carrefour asked the Commission to delay parts of the AI Act by at least two years.^[10] The Commission did not delay the GPAI rules but did postpone certain high-risk AI obligations in an omnibus proposal in October 2025.^[10]

How does the Code compare with other frameworks?

The GPAI Code of Practice is the first jurisdiction-specific framework targeting frontier general-purpose AI models, and it has invited comparison with a series of contemporaneous regulatory initiatives.^[17]

Scroll sideways for more →

California Senate Bill 53, signed into law on 29 September 2025, is the closest functional analogue to the Code's Safety and Security chapter.^[17] Both require frontier developers to publish safety frameworks, perform structured risk assessments, report critical incidents, and maintain whistleblower protections. The Code is voluntary in form but binding through its link to Articles 53 and 55, while SB 53 is mandatory for covered developers. The Code's systemic risk threshold sits at training compute above 10^25 floating-point operations, while SB 53 combines training compute above 10^26 with cumulative annual gross revenue above USD 500 million.^[8] The Code is enforced by the Commission through the AI Office; SB 53 is enforced by the California Attorney General. SB 53's fines are capped at USD 1 million per violation, far below the AI Act's potential fines.

The Code can also be compared to the voluntary commitments brokered by the Biden administration in July 2023, the UK AI Safety Institute's evaluation MoUs, the G7 Hiroshima Process Code of Conduct, and the Seoul Frontier AI Safety Commitments adopted in May 2024.^[17] These instruments are purely voluntary and lack any binding link to a statute, giving the GPAI Code a distinctive position as the only soft-law instrument that operates within a hard-law sanction regime. With the Trump administration's January 2025 revocation of the Biden executive order on AI and a federal shift toward deregulation, the GPAI Code and California SB 53 together define the de facto floor of frontier AI compliance for providers operating in the European Union or California.^[17]

Open questions and outlook

Several substantive and procedural questions remain open. The AI Office is expected to issue additional guidance in 2026 on the public training data summary template, the criteria for classifying systemic risk models, and expectations associated with state-of-the-art evaluations.^[19] The relationship between the Code and forthcoming harmonised standards being developed under CEN-CENELEC JT 21 is also unsettled.^[10]

The AI Office's approach to enforcement after 2 August 2026 will be a major determinant of the Code's long-term influence.^[9] Cooperative enforcement is likely to retain industry buy-in, while aggressive use of fines could prompt providers to withdraw signatures or exit the EU market. Meta's continued refusal creates an alternative compliance path that other providers will watch closely.^[14]

The Code's influence is also likely to extend beyond the European Union through a Brussels effect.^[17] Non-EU regulators in the United Kingdom, Japan, South Korea, and Singapore have indicated that they are studying the Code closely. Multinational providers face incentives to standardise compliance practices globally, which may lead to convergence around the Code's documentation and evaluation templates even in jurisdictions without an analogous binding instrument.

ELI5: the Code in plain terms

The European Union passed a big law called the EU AI Act that says companies building powerful, general AI models have to follow certain rules: explain how their model works, respect copyright, and (for the most capable models) prove the model is safe. Those rules can be hard to follow because the law is long and general. So the EU wrote a kind of checklist, the GPAI Code of Practice, that says, in practical terms, "do these specific things and we will treat you as following the law." Companies do not have to sign the checklist, but if they do, paperwork is easier and they have more certainty that they are doing it right. Most big AI companies (OpenAI, Anthropic, Google, Microsoft, Mistral) signed it. Meta said no, arguing the checklist asks for too much.

See also

• EU AI Act
• AI regulation
• AI governance
• California SB 53
• OpenAI
• Anthropic
• Google DeepMind
• Mistral AI
• Meta AI
• European Commission

References

1. European Commission, "The General-Purpose AI Code of Practice," Shaping Europe's digital future, 10 July 2025. https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai ↩
2. European Commission, "Drawing-up a General-Purpose AI Code of Practice," Shaping Europe's digital future, accessed 2026. https://digital-strategy.ec.europa.eu/en/policies/ai-code-practice ↩
3. Code of Practice for General-Purpose AI Models, Final Version, 10 July 2025. https://code-of-practice.ai/ ↩
4. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), Official Journal of the European Union, 12 July 2024. ↩
5. Artificial Intelligence Act, Article 53: Obligations for Providers of General-Purpose AI Models. https://artificialintelligenceact.eu/article/53/ ↩
6. Artificial Intelligence Act, Article 55: Obligations for Providers of General-Purpose AI Models with Systemic Risk. https://artificialintelligenceact.eu/article/55/ ↩
7. Artificial Intelligence Act, Article 56: Codes of Practice. https://artificialintelligenceact.eu/article/56/ ↩
8. "An Introduction to the Code of Practice for General-Purpose AI," EU Artificial Intelligence Act, 2025. https://artificialintelligenceact.eu/introduction-to-code-of-practice/ ↩
9. Latham and Watkins, "EU AI Act: GPAI Model Obligations in Force and Final GPAI Code of Practice in Place," 2025. https://www.lw.com/en/insights/eu-ai-act-gpai-model-obligations-in-force-and-final-gpai-code-of-practice-in-place ↩
10. Taylor Wessing, "The final GPAI Code of Practice: Key insights, unresolved questions, and parallel regulatory tracks," July 2025. https://www.taylorwessing.com/en/insights-and-events/insights/2025/07/update-ai-act ↩
11. Wilson Sonsini, "EU Releases Final Code of Practice for General-Purpose AI Models," 2025. https://www.wsgr.com/en/insights/eu-releases-final-code-of-practice-for-general-purpose-ai-models.html
12. A&O Shearman, "EU Artificial Intelligence Office publishes the final version of the GPAI Code of Practice," 2025. https://www.aoshearman.com/en/insights/ao-shearman-on-data/eu-artificial-intelligence-office-publishes-the-final-version-of-the-gpai-code-of-practice
13. Euronews, "Some 26 tech companies sign up to EU Commission's AI Code," 1 August 2025. https://www.euronews.com/next/2025/08/01/some-26-tech-companies-sign-up-to-eu-commissions-ai-code ↩
14. TechCrunch, "Meta refuses to sign EU's AI code of practice," 18 July 2025. https://techcrunch.com/2025/07/18/meta-refuses-to-sign-eus-ai-code-of-practice/ ↩
15. CNBC, "Meta says it won't sign Europe AI agreement, calling it an overreach that will stunt growth," 18 July 2025. https://www.cnbc.com/2025/07/18/meta-europe-ai-code.html ↩
16. Wikipedia, "General-Purpose AI Code of Practice." https://en.wikipedia.org/wiki/General-Purpose_AI_Code_of_Practice ↩
17. Center for Security and Emerging Technology (CSET), "AI Safety under the EU AI Code of Practice: A New Global Standard?," 2025. https://cset.georgetown.edu/article/eu-ai-code-safety/ ↩
18. EU AI Act Service Desk, "Article 55: Obligations of providers of general-purpose AI models with systemic risk." https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-55
19. WilmerHale, "European Commission Issues Guidelines for Providers of General-Purpose AI Models," 24 July 2025. https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20250724-european-commission-issues-guidelines-for-providers-of-general-purpose-ai-models ↩
20. DLA Piper, "Latest wave of obligations under the EU AI Act take effect: Key considerations," August 2025. https://www.dlapiper.com/en-us/insights/publications/2025/08/latest-wave-of-obligations-under-the-eu-ai-act-take-effect ↩