The GPAI Code of Practice: what is in it and who is it for?

Short answer: The Code of Practice for general-purpose AI (GPAI) is a voluntary code, facilitated by the AI Office under Article 56 of the AI Act. Providers of GPAI models can use it to demonstrate that they meet their legal obligations. It is therefore not an extra obligation, but a route to compliance.

What it is — and what it is not

The AI Act (Regulation (EU) 2024/1689) places obligations on providers of GPAI models. The Code of Practice is a tool to help meet them, not a separate law. Article 56 tasks the AI Office with facilitating such codes, together with industry and other stakeholders.

Voluntary, but useful. Signing is not mandatory. Providers who follow the code gain a presumption of conformity and greater legal certainty. Providers who do not follow it must demonstrate by other means that they meet the same legal requirements.

Not the same as the marking code. Do not confuse this GPAI code with the separate code of practice on detectably marking AI-generated or AI-manipulated content (tied to the transparency duties for providers and deployers of AI systems). That is a different instrument, for a different purpose.

The three chapters

The code is built around three parts that map onto the legal duties:

• Transparency and documentation. Supports the duties under Article 53: technical documentation, information for downstream providers, and a public summary of the training data used.
• Copyright. Helps providers put in place a policy that respects EU copyright law, including honouring opt-outs against text and data mining.
• Safety and security. Aimed at providers of models with systemic risk and supports the additional duties under Article 55, such as risk assessment, mitigation and incident reporting.

The first two chapters are relevant to all GPAI providers; the third only to models designated as posing systemic risk.

Who is this for?

If you provide GPAI — that is, you develop and place a model on the market — the code is directly relevant. It gives a concrete, structured way to meet Article 53 (and Article 55 where there is systemic risk) and to demonstrate this to the AI Office.

If you procure GPAI — that is, you use an existing model — you do not sign the code yourself. But it is worth knowing whether your supplier follows it: that tells you something about the documentation, the copyright policy and the risk management you may rely on as a customer. Ask about it during procurement and capture it contractually where needed.

Read more: AI Act: timeline of obligations. Take the scan.