On 10 July 2025 the European Commission published the General-Purpose AI Code of Practice. The document creates no new legal obligations, yet it will shape how general-purpose model providers prove their compliance over the coming year and more.
Why a “code” rather than a “regulation”
The AI Act sets transparency, copyright and safety obligations for general-purpose AI (GPAI) models, but the provisions are goal-oriented and leave considerable room for interpretation. The code’s role is to translate those goals into concrete, demonstrable actions.
For providers, signing the code is not an exemption, but it can serve as presumptive evidence of compliance: in assessing a provider, regulators will treat adherence to the code as important evidence that the corresponding obligations have been met. This is a common EU governance technique in fast-moving fields — using a soft instrument to fill the gaps in hard rules.
Three chapters for three sets of obligations
The code is organised in three chapters, each corresponding to one core requirement the AI Act imposes on general-purpose models:
Transparency. Providers must maintain and publish a summary of training data and explain the model’s intended uses and capability limits. This has parallels with China’s filing-and-disclosure approach. See our note on generative AI filing and registration in local batches.
Copyright. Providers must adopt a copyright policy, identify and respect rights holders’ reservations of rights, and avoid infringing outputs. See our note on the GEMA v OpenAI ruling in Munich.
Safety and security. For the most advanced models posing systemic risk, providers must also carry out model evaluations, adversarial testing and serious-incident reporting.
What the signatory pattern signals
The first signatories included several leading European and US model and cloud providers, and some companies that had previously held back also made commitments in the safety chapter. Signing is organised by chapter and staged, which is itself a form of graduated compliance: the stronger the capability and the higher the risk, the more obligations a provider is expected to bear.
For Chinese companies going global, the key question is whether a model or application aimed at EU users requires an EU representative and brings the company within the code’s system. See our note on the California SB 53 frontier AI transparency act.
Connecting to the 2 August effective date
The GPAI obligations took effect on 2 August 2025, and the code’s publication left just enough of a transition window. See our note on the effective date of the EU AI Act’s GPAI obligations.
Notably, the EU is simultaneously advancing a simplification and deferral agenda, and the timetable for high-risk systems has been repeatedly debated. See our note on the EU digital omnibus AI proposal. That means companies cannot plan their compliance calendar on the original timetable alone; they must track the legislative developments.
Where companies can start
First, build a ledger of training data and copyright, preparing evidence for both transparency disclosure and copyright defence.
Second, map the code’s chapters onto internal policies, checking line by line whether existing processes cover them.
Third, watch the code’s version iterations, because compliance requirements change as the detail is updated after signing.
The code matters because it turns abstract obligations into a checkable list. Whoever can move that list into process holds the initiative in the evidence stage. See our note on the EU AI Act transparency rules.
This article is based on public information on the European Commission’s General-Purpose AI Code of Practice and is for reference only; it does not constitute legal advice.