What is the EU AI Act Code of Practice for GPAI?

A voluntary code that providers of general-purpose AI models can sign to show they meet their AI Act duties. It was published on July 10, 2025, and the Commission and the AI Board confirmed it as adequate on August 1, 2025. It has three chapters, Transparency, Copyright, and Safety and Security.

Do GPAI providers have to sign the Code?

No. The obligations in Articles 53 and 55 bind every provider placing a general-purpose AI model on the EU market whether it signs or not. Signing lets a provider show compliance by following the Code, which the Commission says reduces administrative burden and gives more legal certainty than other methods.

What happens if a GPAI provider does not comply?

Since August 2, 2026 the Commission can fine a provider up to 3% of worldwide annual turnover or EUR 15 million, whichever is higher, under Article 101. The same cap covers supplying incorrect or misleading information. The Commission can also require a model to be restricted, withdrawn or recalled.

EU AI Act GPAI Code of Practice: What It Requires

Q: What is the systemic risk threshold for GPAI?

Article 51(2) presumes high-impact capabilities, and so systemic risk, when training compute exceeds 10^25 floating-point operations. The provider must notify the Commission within two weeks. Only these providers use the Code's Safety and Security chapter, which sets serious incident reports within two to 15 days depending on the harm.

Image: Pexels, used under the Pexels License.

Correction (October 19, 2026): This guide said the GPAI Code of Practice was finalised in June 2026 and listed obligations the Code does not contain. The Commission received the final Code on July 10, 2025, and the Commission and the AI Board confirmed it on August 1, 2025; the code finalised on June 10, 2026 is a different one, on transparency of AI-generated content. We removed an "opt-out registry" that the Code doesn't mention, a two-week incident deadline (the Code sets two, five, 10 or 15 days by type of harm; two weeks is the Article 52(1) deadline for notifying a model over the compute threshold), four red-teaming categories the Code doesn't name, an "at least annually" evaluation rule, a separate 1% fine for incorrect information (Article 101 has one cap for all GPAI infringements), a seven-field disclosure template, a list of what "did not change from draft to final" and a line on enforcement priorities, none of which we could source.

If you provide a general-purpose AI model in the EU, the Code of Practice is the shortest route to showing you meet the AI Act, and it has been available since July 2025. It's voluntary: the law binds you either way, and the Code only changes how you prove it. If you build on someone else's model through an API, you're a downstream provider; the Code isn't addressed to you, but its transparency chapter tells you what your model provider owes you.

What the Code is, and the dates that matter

The Code was drawn up by independent experts in a process the AI Office ran with nearly 1000 stakeholders. The Commission received the final version on July 10, 2025, and on August 1, 2025 the Commission and the AI Board confirmed through adequacy decisions that it's an adequate voluntary tool for showing compliance. Providers sign by sending the Commission's Signatory Form to the AI Office.

Signatories include OpenAI, Anthropic, Google, Microsoft, Mistral AI and Cohere. xAI signed only the Safety and Security chapter, so it has to show it meets the transparency and copyright duties by other adequate means.

Don't confuse it with the Code of Practice on Transparency of AI-generated Content, finalised on June 10, 2026, which covers the Article 50 marking and labelling duties, not general-purpose models.

Date	What happens	Source
July 10, 2025	Commission receives the final Code	Commission Code page
August 1, 2025	Commission and AI Board confirm the Code is adequate	Commission Code page
August 2, 2025	GPAI obligations apply	Article 113(b)
August 2, 2026	Commission enforcement powers start, fines included	Article 113, Article 101
August 2, 2027	Deadline for models placed on the market before August 2, 2025	Article 111(3)

What the three chapters ask

The Code has three separately written chapters. Transparency and Copyright cover every GPAI provider's duties under Article 53. Safety and Security matters only to the small number of providers whose models carry systemic risk under Article 55.

AI compliance team reviewing regulatory documents and checklists

Image: Unsplash.

Transparency (every GPAI provider)

Document the model with at least the information in the Code's Model Documentation Form, update it when the model changes, and keep previous versions for 10 years after the model is placed on the market.
Publish contact details through which the AI Office and downstream providers can request that information.
Answer a downstream provider's request within a reasonable time and no later than 14 days, save in exceptional circumstances.

Providers of free and open-source models that meet Article 53(2) are exempt from these documentation duties, unless the model has systemic risk. The separate public summary of training content follows the Commission template published on July 24, 2025, and applies to open-source providers too.

Copyright (every GPAI provider)

Draw up, keep up to date and apply a copyright policy.
When crawling the web, don't circumvent paywalls or other technical protection, and exclude websites that courts or public authorities in the EU and EEA have recognised as persistently and repeatedly infringing copyright on a commercial scale; the EU is to publish a list of those sites.
Use crawlers that follow robots.txt as specified in IETF RFC 9309, and comply with other appropriate machine-readable opt-out protocols.
Designate a point of contact for rightsholders and let them file complaints electronically.

There is no opt-out registry in the Code. Opt-outs are read from robots.txt and other machine-readable signals.

Safety and Security (systemic-risk models only)

A model is presumed to have systemic risk when its training compute exceeds 10^25 floating-point operations (Article 51(2)), and the provider must notify the Commission within two weeks of meeting that threshold (Article 52(1)). Signatories then commit to:

A Safety and Security Framework, reassessed every 12 months from placing the model on the market, or sooner when there are grounds to think it's no longer adequate.
Assessing the four specified systemic risks in Appendix 1.4: chemical, biological, radiological and nuclear; loss of control; cyber offence; and harmful manipulation.
Reporting serious incidents on fixed timelines, through the EU SEND platform the Commission uses for GPAI documents.
Security measures that cover insider threats, keep a registry of every location where model weights are stored, and decrypt weights only into non-persistent memory.

Appendix 1.4 of the Safety and Security chapter of the General-Purpose AI Code of Practice listing the specified systemic risks: chemical, biological, radiological and nuclear; loss of control; cyber offence; harmful manipulation

Screenshot: General-Purpose AI Code of Practice, Safety and Security chapter, Appendix 1.4, European Commission (July 2025).

The incident timelines run from when the provider becomes aware of its model's involvement: two days for a serious and irreversible disruption of critical infrastructure, five days for a serious cybersecurity breach, 10 days for a death and 15 days for other serious harm. Intermediate reports follow at least every four weeks, and a final report within 60 days of the incident being resolved.

Measure 9.3 of the Safety and Security chapter of the General-Purpose AI Code of Practice: initial serious incident reports within two, five, 10 or 15 days depending on the harm, intermediate reports at least every four weeks, a final report within 60 days of resolution

Screenshot: General-Purpose AI Code of Practice, Safety and Security chapter, Measure 9.3, European Commission (July 2025).

Fines, and why signing matters for them

Article 101 lets the Commission fine a GPAI provider up to 3% of its worldwide annual turnover or EUR 15 million, whichever is higher. One cap covers every case in the article: infringing the GPAI rules, ignoring a request for documents or supplying incorrect, incomplete or misleading information, failing to carry out a measure the Commission requested, or refusing access for an evaluation. The Commission can also require a model to be restricted, withdrawn or recalled (Article 93).

When it sets the amount, the Commission takes into account commitments made in a code of practice. That is the practical reason to sign: a signatory that follows the Code has a documented record the Commission has already called adequate.

Steps for a GPAI provider

Confirm you're a provider. A general-purpose model displays significant generality (Article 3(63)). If you only modify someone else's model, you become a provider only with significant modifications, per the Commission's guidelines. Our GPAI provider self-test walks through it.
Check the compute threshold. Above 10^25 floating-point operations, notify the Commission and plan for the Safety and Security chapter.
Decide whether to sign. If you do, send the Signatory Form to the AI Office. If you don't, write down how you meet each Article 53 and 55 duty another way.
Fill in the Model Documentation Form and publish the contact point for the AI Office and downstream providers.
Publish the training content summary on the Commission template.
Write the copyright policy and check your crawlers' robots.txt handling and the piracy-site exclusion.
For systemic-risk models, adopt the Framework, set up incident reporting through EU SEND, and apply the security commitments.

Obligations have applied since August 2, 2025, so for a model released after that date these steps are overdue, not upcoming. Models already on the market before then have until August 2, 2027.

What downstream providers can ask for

If you build an AI system on a GPAI model through an API, the AI Act calls you a downstream provider. Article 53(1)(b) and Annex XII oblige the model provider to give you enough information to understand the model's capabilities and limitations and to meet your own duties, including the input and output formats and their maximum size, such as the context window length. Under the Code, a signatory answers your request within 14 days. If your provider can't, flag it in your vendor review.

What the Code does not cover

Marking and labelling AI-generated content under Article 50: that's the separate June 2026 transparency code.
High-risk AI systems under Annex III, which apply from December 2, 2027.
Your duties as a deployer or downstream provider, which come from what your system does, not from Chapter V.

What we could not confirm: whether the EU list of piracy websites the Copyright chapter refers to has been published; the Code says it will be made available on an EU website.

For the full GPAI checklist with Annex XI and XII lists, see the GPAI compliance checklist.