General-Purpose AI Code of Practice

What it is

The General-Purpose AI Code of Practice is a voluntary code under Article 56 of the EU AI Act. It was drafted by independent experts through a multi-stakeholder process run by the European Commission’s AI Office, and published on 10 July 2025. The Commission and the AI Board have confirmed it as an adequate voluntary tool for providers to demonstrate compliance with the Act’s general-purpose AI obligations.

A general-purpose AI model is one trained on large amounts of data that can competently perform a wide range of distinct tasks and be integrated into many downstream systems. Large language models and multimodal foundation models are the obvious examples. The Act puts duties on the providers of these models, separately from the duties on the AI systems built from them.

The code turns those duties into concrete commitments. Under Article 53(4), providers can rely on a code of practice to demonstrate compliance until a harmonised standard is published, which gives signatories more legal certainty and a lighter administrative path than proving compliance some other way.

Who it applies to

The code is for providers of general-purpose AI models placed on the EU market, wherever they are established. The Commission’s public list of signatories includes most of the major model developers. Some providers have signed only part of the code and show compliance with the rest by other means.

Organisations that fine-tune or modify a model can become providers themselves, depending on how substantial the modification is. The Commission’s guidelines on the scope of the GPAI obligations set out when that happens.

For everyone else, the code matters indirectly. A company deploying a third-party model, or building a product on one, depends on the provider’s documentation, copyright handling and risk work. Whether a vendor has signed the code, and which chapters, is a reasonable question in AI vendor due diligence.

What it requires

Transparency chapter. Signatories commit to drawing up and keeping current documentation about the model, including through a Model Documentation Form, and making it available to the AI Office and national authorities on request and to downstream providers who integrate the model. This meets the documentation duties in Article 53(1)(a) and (b).

Copyright chapter. Signatories commit to putting in place a copyright policy, respecting machine-readable rights reservations when crawling the web, not circumventing technical protection measures, mitigating the risk of infringing outputs, and providing a point of contact for complaints. This supports Article 53(1)(c). Providers also publish a summary of the content used for training, using the Commission’s template, under Article 53(1)(d).

Safety and Security chapter. This applies only to providers of models with systemic risk. Article 51 presumes systemic risk for models trained with more than 10^25 floating point operations, and the Commission can designate others. Signatories commit to a safety and security framework, systemic risk identification and analysis, assessing whether risk is acceptable before and after release, safety and security mitigations, serious incident tracking and reporting to the AI Office, and allocating responsibility for systemic risk within the organisation. This maps to Article 55.

Key dates

The GPAI obligations in the AI Act have applied since 2 August 2025, and the code was published shortly before, on 10 July 2025. The Commission’s powers to enforce those obligations, including fines on GPAI providers, apply from 2 August 2026. The Digital Omnibus on AI (Regulation (EU) 2026/1744) gave the AI Office further direct supervisory and enforcement powers over GPAI providers from 27 July 2026. Models placed on the market before 2 August 2025 have until 2 August 2027 to comply.

How it relates to other frameworks

The code sits under the EU AI Act and only has meaning in relation to it. It does not cover the high-risk system obligations or the Article 50 transparency duties for AI systems, which fall on whoever builds and deploys the system.

Outside the EU, the G7 Hiroshima Code of Conduct asks developers of advanced AI for similar commitments on risk identification, transparency and incident reporting, with public reporting run by the OECD. The NIST Generative AI Profile gives a US vocabulary for the same risks. A deployer assessing a model vendor can use all three as references for what a well-governed model provider discloses.

For deployers, the useful outputs of the code are the documentation it obliges providers to share downstream. That documentation feeds the deployer’s own risk and impact assessment of the system they build or buy, and its record of which models sit inside which systems.