EU publishes the General-Purpose AI Code of Practice under the AI Act

The European Commission published the final General-Purpose AI Code of Practice on 10 July 2025. It is a voluntary document that model providers can sign to demonstrate they meet the AI Act's obligations for general-purpose AI models.

What it is

Thirteen independent experts drafted the code with input from over 1,000 stakeholders. It arrived later than the April 2025 finish the Commission had projected when the act entered into force. The code has three separately authored chapters: Transparency, Copyright, and Safety and Security. Signatories that follow it can use adherence as their route to showing compliance, which the Commission says brings less administrative burden and more legal certainty.

What it requires

The Transparency and Copyright chapters speak to every general-purpose model provider. The Safety and Security chapter applies only to the few providers whose most advanced models carry systemic risk under Article 55 of the act. The Commission noted that the AI Office can enforce these rules one year after 2 August 2025 for new models and two years after for models already on the market. One provider, xAI, signed only the Safety and Security chapter and must show transparency and copyright compliance by other adequate means.

What security leaders should do

If your products rely on a third-party foundation model, check the Commission's public signatory list and record which chapters your provider signed. A provider that signed the Safety and Security chapter has committed to a documented approach for systemic risk, which gives your supplier assessment something concrete to request. Ask for the model documentation the Transparency chapter produces, and file it with the contract.