On 14 November 2024 the European Commission’s AI Office published the first draft of the General-Purpose AI Code of Practice. The draft was built on a multi-stakeholder consultation and a series of workshops with providers of general-purpose AI models, and it is the instrument intended to give practical content to the AI Act’s obligations for those models.
Why a code rather than more rules
The AI Act sets obligations for general-purpose AI models in general terms — transparency, documentation, copyright policy, risk assessment for systemic models — and leaves the operational detail to a code. This design choice has a consequence companies should notice early: compliance will be judged against documented practice, not against a checklist in the statute. A provider that can show its internal process, its evaluation records and its change history is in a stronger position than one that simply asserts conformity. The adopted version is discussed in our note on the GPAI Code of Practice 2025.
What the draft asks for
The draft’s chapters track the underlying obligations, covering transparency and documentation, copyright-related policy, and technical risk assessment and mitigation for models above the systemic threshold. Read alongside the GPAI obligations that take effect under the AI Act and the AI Act transparency rules, it shows the compliance surface a model provider actually faces.
Two adjacent workstreams fill in the picture. The draft second code on AI content labelling handles how generated material is marked, and the European Parliament position on the AI Act omnibus shows how the timeline and scope may still shift. The scientific panel that advises on systemic models is set out in the AI Act scientific panel regulation.
Practical steps for model providers
Start by identifying which obligations attach to your model — general-purpose status and the systemic-risk threshold are the two gateways. Then treat documentation as a product artefact rather than a legal annex: training data summaries, evaluation results and incident records need to be produced continuously, not assembled before a deadline.
For non-EU providers, distribution in the EU through APIs, hosted services or downstream integrations is usually enough to bring a model into scope, so the assessment should begin with the distribution channel rather than with the entity’s place of establishment.
This article is based on the European Commission AI Office’s first draft of the General-Purpose AI Code of Practice and public information and is for reference only; it does not constitute legal advice.