AIAcademy · AIAcademy · 2026-05-16
GPAI Code of Practice (European Commission)
The General-Purpose AI Code of Practice is the European Commission's bridge between an AI Act that took political effect in August 2024 and the GPAI provisions that begin generating fines on 2 August 2026. It is technically voluntary. Signing is treated, in practice, as the path of least resistance to compliance presumption.
Three chapters. The Code has exactly three: Safety & Security, Copyright, and Transparency. Each chapter exists because the underlying AI Act article needed operational detail before regulators could enforce it.
Safety & Security applies only to providers of GPAI models with "systemic risk" — the 10²⁵ FLOP threshold inherited from Article 51. Signatories commit to a Safety and Security Framework, model-level risk assessments before deployment, serious-incident reporting to the AI Office, and post-market monitoring. The chapter reads like a less prescriptive cousin of the Anthropic Responsible Scaling Policy or OpenAI's Preparedness Framework — same shape, fewer numeric triggers.
Copyright is the chapter that produced the most negotiation. Signatories commit to a copyright policy, technical measures to honour opt-outs (the TDM reservation under Article 4 of the 2019 DSM Directive), a designated point of contact for rightsholders, and a complaint mechanism. Notably, the Code does not require disclosure of specific training datasets — that requirement lives in the separate template under Article 53.
Transparency requires a model documentation template covering training data summary, intended uses, evaluation methodology, energy consumption, and known limitations. The template is the operational form of the much-discussed "training data summary" requirement.
The signatories. Anthropic, Google, OpenAI, Microsoft, Amazon, IBM, Mistral, and Cohere signed; Meta and xAI did not. Non-signatories face the same obligations under the Act itself but lose the "presumption of conformity" benefit.