Does signing the GPAI Code of Practice give a presumption of conformity?

No. Articles 53(4) and 55(2) let providers rely on the Code to demonstrate compliance until a harmonised standard is published. The Commission's Q&A says adherence is a means to demonstrate compliance "while not providing a presumption of conformity." Under the Act, compliance with a European harmonised standard is what grants that presumption.

Is the GPAI Code of Practice the same as an AI Act code of conduct?

No. The Code of Practice comes from Article 56 and covers model provider duties in Articles 53 and 55. Codes of conduct come from Article 95 and cover the voluntary application of high-risk requirements to AI systems that are not high-risk. Signing one has no effect on the other.

What happens if a GPAI provider does not sign the Code?

It must demonstrate alternative adequate means of compliance for assessment by the Commission. The Commission's Q&A says non-signers must justify why their means are adequate, for instance with a gap analysis against the Code. The duties themselves are the same either way.

Is there a public list of systemic-risk GPAI models?

Article 52(6) requires the Commission to publish and update one. As of October 20, 2026 we found no such list on the Commission's AI Act pages. Providers must notify the Commission within two weeks once a model meets the threshold, so the list depends on notifications and designations.

EU AI Act GPAI Codes of Conduct: What Signing Gets You

A row of European Union flags in front of a glass office building, representing EU AI regulation Image: Unsplash.

TL;DR: The GPAI Code of Practice lets a model provider show it meets Articles 53 and 55 of the AI Act. It does not give a presumption of conformity, it is not an Article 95 code of conduct, and skipping it means writing your own case for compliance.

People search for "GPAI codes of conduct," but the instrument that matters for general-purpose AI model providers is the General-Purpose AI Code of Practice, published on July 10, 2025. The AI Act also has codes of conduct, under Article 95, and they do something else. Mixing the two up feeds a costly misreading of the Code: treating a signature as a safe harbor.

This guide is for teams that build, fine-tune with significant changes, or release general-purpose AI models in the EU. If you only call someone else's model through an API, the provider duties here are not yours; see what changes if you use rather than provide a GPAI model.

Code of practice, code of conduct, standard: the four routes

Route	Legal basis	Who it is for	What it does for you
GPAI Code of Practice	Article 56; reliance under Articles 53(4) and 55(2)	Providers of GPAI models	A way to demonstrate compliance with Articles 53 and 55 "until a harmonised standard is published"; no presumption of conformity
European harmonised standard	Articles 53(4) and 55(2)	Providers of GPAI models	Presumption of conformity "to the extent that those standards cover those obligations"
Alternative adequate means	Articles 53(4) and 55(2)	Providers that neither sign the Code nor follow a harmonised standard	Your own evidence, assessed by the Commission
Code of conduct	Article 95	Providers and deployers of AI systems other than high-risk ones	Voluntary application of some or all Chapter III, Section 2 requirements; no effect on GPAI duties

Sources: Article 53, Article 55, Article 95, AI Act Service Desk, read October 20, 2026.

Article 95 asks the AI Office and the Member States to encourage codes of conduct that "foster the voluntary application to AI systems, other than high-risk AI systems," of the high-risk requirements. That is a tool for AI system builders who want to follow the high-risk rules without being obliged to. It does not touch Chapter V, which is where the GPAI model duties sit.

What signing the Code actually gets you

The operative text is the same in Article 53(4) for all GPAI providers and Article 55(2) for providers of models with systemic risk:

"Providers of general-purpose AI models may rely on codes of practice within the meaning of Article 56 to demonstrate compliance with the obligations set out in paragraph 1 of this Article, until a harmonised standard is published. Compliance with European harmonised standards grants providers the presumption of conformity to the extent that those standards cover those obligations."

Article 53(4) of the EU AI Act on the AI Act Service Desk, highlighted: providers may rely on codes of practice to demonstrate compliance until a harmonised standard is published; harmonised standards grant the presumption of conformity Screenshot: Article 53(4), AI Act Service Desk, European Commission (taken October 20, 2026).

The Commission spells out the difference in its Q&A on GPAI models: once the Code is assessed as adequate, adherence "becomes a means to demonstrate compliance with the AI Act, while not providing a presumption of conformity with the AI Act." So the Code is evidence you can point to, not a shield that shifts the burden onto the regulator.

The same Q&A lists two further effects. The AI Office may take adherence into account when monitoring compliance under Article 89(1), and it may treat commitments in the Code "as a mitigating factor when fixing the amount of fines" under Article 101(1). The Commission's Code page puts the practical benefit this way: signing "will reduce their administrative burden and give them more legal certainty and trust than if they proved compliance through other methods."

The European Commission's General-Purpose AI Code of Practice page: the code was published on July 10, 2025, and the Commission and the AI Board confirmed it is an adequate voluntary tool Screenshot: "The General-Purpose AI Code of Practice," Shaping Europe's digital future, European Commission (page last updated October 7, 2026; taken October 20, 2026).

The Code has three separately authored chapters: Transparency, Copyright, and Safety and Security. The first two give every GPAI provider a way to meet Article 53. The Safety and Security chapter applies only to providers of models with systemic risk under Article 55. For the chapter-by-chapter commitments, see our Code of Practice walkthrough.

Who has signed

The Commission's signatory list (last updated October 7, 2026, when we read it) includes Amazon, Anthropic, Cohere, Google, IBM, Microsoft, Mistral AI and OpenAI, among others. xAI signed only the Safety and Security chapter, which, in the Commission's words, means "it will have to demonstrate compliance with the AI Act's obligations concerning transparency and copyright via alternative adequate means." Meta does not appear on the list; our Meta and Llama deployer guide covers what that means downstream.

The signatory list on the European Commission's General-Purpose AI Code of Practice page, starting with AI Studio Delta, Aleph Alpha, Almawave, Amazon, Anthropic, Black Forest Labs, Bria AI, Cohere, Domyn, Dweve, Fastweb, Google, IBM, LINAGORA, Microsoft and Mistral AI Screenshot: "Signatories of the code of practice," European Commission (taken October 20, 2026).

If your vendor review asks a model provider "have you signed the GPAI Code?", the useful follow-up is "which chapters?" A partial signatory owes the same duties as everyone else for the chapters it skipped.

Does this apply to you?

The Code and Articles 53 and 55 bind providers of general-purpose AI models. Companies that only make minor changes to someone else's model don't become providers; the Commission's guidelines say only "those making significant modifications" take on provider duties.

Systemic-risk status starts with a compute presumption. Article 51(2) presumes high-impact capabilities "when the cumulative amount of computation used for its training measured in floating point operations is greater than 10^25." A provider that meets that condition must notify the Commission within two weeks (Article 52(1)). Article 52(6) then requires the Commission to publish a list of models with systemic risk and keep it up to date. When we checked on October 20, 2026, we found no such list on the Commission's AI Act pages, so don't rely on anyone who claims to quote one.

If you don't sign: what to prepare

Write the gap analysis. The Q&A says non-signers "must be able to justify why their proposed alternative means of compliance are adequate, for instance by carrying out a gap analysis" against the Code. Map each Code measure to your own control or explain why yours is equivalent.
Keep Annex XI and Annex XII documentation. Article 53(1)(a) and (b) require technical documentation for the AI Office and information for downstream providers; these do not change with signature status.
Publish the training-content summary. Article 53(1)(d) requires providers to "draw up and make publicly available a sufficiently detailed summary about the content used for training ... according to a template provided by the AI Office." The Commission published that template on July 24, 2025. You publish it yourself; there is no AI Office register to file it in.
Put a copyright policy in place. Article 53(1)(c) requires "a policy to comply with Union law on copyright and related rights," including honoring rights reservations under Article 4(3) of the text and data mining Directive.
Check the calendar. GPAI obligations have applied since August 2, 2025; the Commission's enforcement powers, fines included, apply from August 2, 2026; models placed on the market before August 2, 2025 have until August 2, 2027. Article 101 caps fines at 3% of worldwide annual turnover or EUR 15 million, whichever is higher.

Signed or not, documents go to the AI Office through the EU SEND platform, per the Commission's GPAI guidelines page. For the step-by-step version with Annex lists, use the GPAI compliance checklist.

What we could not confirm

A published systemic-risk model list. Article 52(6) requires one; we found none as of October 20, 2026. We no longer name models as systemic-risk.
Any harmonised standard for GPAI obligations. The Act refers to them; we did not find one cited for Articles 53 or 55, so the presumption route is not yet something you can plan around.
Court rulings on the Code's weight. We found none. The Commission's Q&A says it is not an official Commission position and that only the Court of Justice can authoritatively interpret the Act.

Our take

Sign if you can live with every chapter that applies to you. The Code is the cheapest evidence you'll find, and the fine-mitigation point is real money. Just don't tell your board it's a safe harbor; the Commission has said in writing that it isn't. If you sign only part of it, as xAI did, treat the rest as if you hadn't signed at all.

Correction (October 20, 2026): Earlier versions said signing the Code gives a presumption of conformity under Article 56, that an AI Office public register lists systemic-risk models (naming GPT-4o, Claude 3, Gemini 1.5 Ultra and Llama 3.1 405B) and holds training-data summaries, that the 10^25 FLOP threshold is not cumulative, and that the Code was finalised in June 2026 with four chapters, 72-hour incident reporting and annual self-assessments. Articles 53(4) and 55(2) let providers rely on the Code to demonstrate compliance; only harmonised standards give a presumption of conformity. Article 52(6) requires the Commission to publish a list, and we found none. Article 51(2) counts cumulative training compute. The Code was published July 10, 2025, in three chapters. We rewrote the post from the Act and the Commission's pages.

References

European Commission, AI Act Service Desk: Article 51, Article 52, Article 53, Article 55, Article 95, read October 20, 2026.
Regulation (EU) 2024/1689, consolidated text (Articles 101, 111 and 113).
European Commission, "The General-Purpose AI Code of Practice", last updated October 7, 2026.
European Commission AI Office, "General-Purpose AI Models in the AI Act: Questions & Answers".
European Commission, "Guidelines for providers of general-purpose AI models".
European Commission, "Explanatory notice and template for the public summary of training content", July 24, 2025.