AI Compliance

The European Union has published a voluntary Code of Practice on general-purpose artificial intelligence (GPAI), aimed at supporting companies in meeting the bloc’s AI regulatory requirements.

Released on Thursday, the measure is intended to act as a preparatory framework for businesses ahead of the formal enforcement of the AI Act’s GPAI provisions from 2026.

The code, developed by a group of 13 independent experts, focuses on three main areas: transparency requirements, copyright protection, and safety and security provisions for advanced AI models. While non-binding, the European Commission has stated that signatories to the code will benefit from legal certainty during the transition period.

It applies to providers of general-purpose AI systems—such as OpenAI’s ChatGPT, Meta’s Llama, Google’s Gemini and Anthropic’s Claude—that underpin a wide range of products and services used across the EU’s 27 Member States. Signatories will be expected to publicly disclose summaries of the datasets used to train their models, refrain from using copyrighted material gathered through web crawlers unless appropriately authorised, and put in place safeguards to prevent infringing outputs.

The code also calls for developers of the most capable GPAI models to implement risk management frameworks that identify and mitigate systemic threats arising from their deployment.

“Today’s publication of the final version of the Code of Practice for general-purpose AI marks an important step in making the most advanced AI models available in Europe not only innovative but also safe and transparent,” said Henna Virkkunen, the Commission’s executive vice-president for tech sovereignty, security and democracy.

The code complements the EU’s AI Act, adopted in 2024 and set to enter into force in stages. Under the Act, AI applications are categorised by risk level, with stricter obligations for high-risk systems and a ban on uses considered unacceptable, such as those that pose a threat to fundamental rights. Violations could incur fines of up to €35 million or 7% of a company’s global annual turnover.

The GPAI rules become legally binding on 2 August 2025, but enforcement by the EU’s AI Office will not begin until August 2026 for models released after that date. Developers of existing GPAI systems will have until 2 August 2027 to bring their technologies into compliance.

Despite its voluntary nature, the Commission has positioned the code as an essential tool for companies to prepare for compliance. Firms declining to sign may be left without legal clarity during the interim period. The document requires formal approval by the Commission and Member States before implementation, which is expected by the end of this year.

The initiative arrives amid mounting industry concern over the EU’s regulatory trajectory on artificial intelligence. In an open letter in June, more than 40 European companies—including Airbus, Mercedes-Benz, Philips, Siemens, and AI start-up Mistral—called for a two-year delay to the GPAI provisions. They cited the need to resolve what they described as “unclear, overlapping and increasingly complex” regulations that could hamper Europe’s competitive standing in global AI development.

Resistance has also come from U.S. firms. Meta and others have raised objections to the feasibility of complying with the EU’s AI framework. Speaking in Paris earlier this year, U.S. Vice President JD Vance warned that excessive regulation could “kill a transformative industry just as it’s taking off.”

Nonetheless, the Commission has given no indication of postponing implementation. Instead, officials argue that the Code of Practice provides a pragmatic and collaborative route to early compliance, reducing risk while supporting innovation.

“Co-designed by AI stakeholders, the Code is aligned with their needs. Therefore, I invite all general-purpose AI model providers to adhere to the Code,” said Virkkunen.

The AI Office, established to supervise enforcement and provide technical guidance, is expected to issue additional documentation over the coming year. The Commission plans to publish a progress review on uptake and implementation in early 2026.

The final version of the Code of Practice is available via the Commission’s website and remains open to stakeholder input ahead of formal adoption.