EU Commission Publishes GPAI Code of Practice Under AI Act, July 2025

The European AI Office received the final General-Purpose AI (GPAI) Code of Practice on July 10, 2025, following a multi-round drafting process that engaged nearly 1,000 participants. The European Commission and the AI Board approved the Code via Adequacy Decisions on August 1, 2025. Although Article 56(1)-(3) of Regulation (EU) 2024/1689 (the EU AI Act) required the Commission to finalize the Code by May 2, 2025, the delayed publication was accompanied by GPAI guidelines and an enforcement roadmap. The Code entered operation as Chapter V obligations for GPAI models took effect on August 2, 2025.

The Code addresses three pillars under the EU AI Act. Under Article 53(1)(c), GPAI providers must establish a copyright policy, crawl only lawfully accessible content, respect copyright reservations, and designate a contact point for rights-holder complaints. Under Articles 53(1)(a), (b), and (2), and Annexes XI and XII, providers must produce and maintain comprehensive model documentation. For GPAI models posing systemic risk — defined as models trained with more than 10^23 floating-point operations — Articles 55 and 56 require providers to establish a safety and security framework, conduct systemic risk assessments, implement mitigation strategies, produce model-specific safety reports, and report serious incidents. The Code also applies to entities that substantially modify and re-release GPAI models.

The Code is voluntary but carries direct regulatory weight. GPAI providers who become signatories may rely on the Code to demonstrate good-faith compliance and gain regulatory clarity during the AI Office's first year of collaborative enforcement. All GPAI models entering the EU market on or after August 2, 2025 must comply with applicable AI Act obligations immediately. Models available before that date must achieve compliance by August 2, 2027. The Commission's full enforcement powers become applicable from August 2, 2026. Open-source GPAI models may qualify for exemptions under conditions set out in the accompanying guidelines.

The enforcement posture during August 2025 to August 2026 is transitional: the AI Office committed to collaborative rather than punitive enforcement. Questions remain open on the systemic-risk threshold for models trained in hybrid configurations and on whether material modifications of pre-August 2025 models reset the compliance deadline to August 2027. The practical scope of signatory benefits for non-EU providers has not been formally resolved.

Our firm advises GPAI providers, downstream deployers, and open-source model developers on EU AI Act Chapter V obligations; we maintain a dedicated partner network covering EU AI Office engagement, signatory submissions, and GPAI compliance programs. We welcome inquiries on all aspects of this area. Representative matters include GPAI systemic risk assessments, model documentation under Annexes XI and XII, copyright policy drafting, AI Act compliance reviews, and EU-wide AI governance strategy.

Source: European AI Office, "Drawing-up a General-Purpose AI Code of Practice," European Commission, https://digital-strategy.ec.europa.eu/en/policies/ai-code-practice, confirmed March 23, 2026; Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 (EU AI Act), Arts. 53-56, OJ L 2024/1689, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R1689, confirmed March 23, 2026.

The information provided is not legal, tax, investment, or accounting advice and should not be used as such. It is for discussion purposes only. Seek guidance from your own legal counsel and advisors on any matters. The views presented are those of the author and not any other individual or organization. Some parts of the text may be automatically generated. The author of this material makes no guarantees or warranties about the accuracy or completeness of the information.