Voluntary but vital: the EU’s General Purpose AI Code of Practice finalised

Last Thursday, the European Commission announced that the General Purpose AI Code of Practice (the “Code”) is now in final form and will come into effect on 2 August 2025.  The Code is intended to supplement the EU’s AI Act as a compliance tool, setting out the parameters of general purpose AI (“GPAI”) models and how they are to be developed and deployed.  While the Code itself remains a voluntary framework that AI providers may choose to opt into, the Commission – amongst other stakeholders involved in its creation – hope that the Code will encourage greater transparency, accountability and preservation of fundamental rights, ultimately to protect the end-users of AI models.

Regulation (EU) 2024/1689, more commonly known as the EU’s AI Act (the “Act”) was published back in July 2024.  Article 56 of the Act mandated that the EU’s AI Office “encourage and facilitate the drawing up of codes of practice at Union level in order to contribute to the proper application of this Regulation, taking into account international approaches”.  The purpose of this provision is obvious – to ensure that AI that is designed, developed and distributed across the EU is transparent and safe for end-users to interact with.  And so in June 2024, the European Artificial Intelligence Office within the European Commission (the “AI Office”), together with 13 independent experts from different member states, launched an international consultation requesting input from over 1,000 stakeholders in the industry on how AI, specifically GPAI, should be defined, implemented and regulated.  The AI Office recognised that the vast majority of AI models used in the EU are borne from, and continue to heavily rely on, GPAI models.  Without adequate regulation of these foundational systems,  the associated risks would permeate and proliferate through the growth of specific purpose AI models.

The various stakeholders, including AI developers, academics, industry bodies and civil society, worked with the AI Office and the 13 independent experts to review the fundamentals of GPAI and provide feedback (via three rounds of consultations, 40 workshops and over 1,600 written submissions).  This input was then reviewed and distilled by the AI Office and the experts into the Code, its final iteration being published on 10 July 2025.  The Code includes provisions relating to disclosure, copyright protections and in relation to those more advanced GPAI models, independent risk assessments.  It should be noted however that the Code does not reach beyond the scope of the Act; rather it is intended to provide further context and clarity on how GPAI providers should comply with the terms of the Act.

Structurally, the Code is split into three core sections – Transparency, Copyright, and Safety and Security:

• The Transparency chapter provides a template ‘Model Documentation Form’, which sets out the key information providers should record and maintain in relation to their model and keep readily available to provide to the AI Office, national competent authorities or downstream providers as requested.
• The Copyright chapter includes some suggested policy points for providers to consider and implement in relation to EU copyright law.
• The Safety and Security chapter sets out how providers should assess, record and mitigate any systemic risks associated with their model (being predominantly risks to fundamental rights and the safety of end-users).

While the Transparency and Copyright chapters are applicable to any and all GPAI models, only the most advanced GPAI models will be subject to those rules within the Safety and Security chapter.  If an AI provider subject to the Code is deemed to be developing a GPAI model that meets a particular risk threshold, they will be required to notify the AI Office of the details of their GPAI model and the associated systemic risks without delay.

Of course, the Achilles heel of the Code is that compliance will be optional.  While the Act is intended to be binding across EU member states (and not in the UK of course), the Code will be a voluntary codification of GPAI model guidance, that AI providers and developers must choose to opt into and comply with.  To combat this, the Commission have encouraged EU member states to offer AI providers in their jurisdiction incentives to sign up to the Code, including reduced administrative requirements and increased legal certainty surrounding the regulation of their models.  Whether AI providers, particularly those with extensive consumer interest and overflowing pockets, are influenced by these incentives is yet to be seen.

What can we expect?  Subject to EU member states approving this final version, the Code is due to take effect next month and AI providers that choose to subscribe to it will be expected to comply in order to demonstrate adherence to the rules and restrictions of the AI Act. The AI Office, which has been granted enforcement powers under the Act, will oversee compliance with both the Act and the Code.

The AI Office is clearly aware that GPAI providers will be reluctant to sign up, and have therefore introduced a one-year collaboration period. During this time, they have offered to work closely with GPAI providers to help test the Code in practice and support these providers in placing their models in the EU market with limited complexity and administrative burden.  Going one step further, the Commission has also confirmed that if these providers are unable to fully adhere to the Code during the relevant period, the AI Office and the national authorities of each member state will not consider their actions to be a violation of the Code.  Instead, these bodies will work with those AI providers to help them rectify any breaches and ensure compliance going forwards. Note though that this leniency will only last two years for existing providers of GPAI models and one year for providers of new GPAI models.  Once these time periods lapse, non-compliance will result in fines.

Query, then, whether the benefits of subscribing to the Code (reduced administrative burdens and greater legal certainty) will be sufficient to encourage GPAI providers to opt in. These incentives appear to have worked for OpenAI, who publicly committed to signing up to the Code the day after the final version was published. Their early endorsement may well set the tone for other major players in the GPAI space.  Conversely, it remains entirely plausible that for smaller or emerging GPAI providers, the looming threat of enforcement and regulatory scrutiny may have the opposite effect and discourage participation altogether.  It won’t be long before the market direction becomes clearer, and whether compliance or caution takes precedence.

In the meantime, the Commission confirmed that they, alongside the various representatives of EU member states, will assess the adequacy of the Code.  The AI Office have also stated that it is the Commission’s responsibility to provide further guidelines that sit alongside the Code to further clarify:

• when a model is a GPAI model;
• when a model is a GPAI model with systemic risk; and
• who is considered a provider of a GPAI model.

Of course, the AI Office and those independent experts have drafted the Code with one eye on the future, hoping that it will withstand future technological developments.  However, in the exponentially evolving world of AI, it would be naïve to assume that no further updates to the Code will be needed.  As such, the AI Office has committed to reviewing the Code at least every two years, ensuring it evolves in step with global developments in the scope, use and risks associated with AI.

This piece was written by Alina Merchant-Mohamed.  If you would like advice on the General Purpose AI Code of Practice, the EU AI Act or would like to further understand how these new developments could impact your business, please don’t hesitate to contact a member of the HLaw team.

All the thoughts and commentary that HLaw publishes on this website, including those set out above, are subject to the terms and conditions of use of this website.  None of the above constitutes legal advice and is not to be relied upon.  Much of the above will no doubt fall out of date and conflict with future law and practice one day.  None of the above should be relied upon.  Always seek your own independent professional advice.

Humphreys Law