GPAI Code of Practice
The Code is the de facto rulebook for frontier model providers in Europe — its safety-and-security commitments (model evaluations, incident reporting, cybersecurity) preview how binding GPAI supervision will work, and signature status signals a lab's regulatory posture.
What it is
A voluntary code operationalizing the AI Act's GPAI chapter across transparency, copyright and safety/security. Major model providers signed; signatories received a one-year enforcement grace period that ended 2 August 2026.
Who is affected
The Code is the de facto rulebook for frontier model providers in Europe — its safety-and-security commitments (model evaluations, incident reporting, cybersecurity) preview how binding GPAI supervision will work, and signature status signals a lab's regulatory posture.
Key obligations
- Model documentation forms and transparency to downstream providers
- Copyright policy including TDM opt-out compliance and complaint handling
- Safety & security chapter for systemic-risk models: frontier evaluations, risk thresholds, incident reporting
Recent signals
EU AI Act transparency obligations become applicable
Chatbot disclosure, machine-readable AI-content marking and deepfake labeling duties now apply EU-wide; the GPAI Code of Practice enforcement grace period ends the same day.
Digital Omnibus on AI enters into force, delaying high-risk deadlines
Regulation (EU) 2026/1744 pushes high-risk AI Act obligations to Dec 2027 (Annex III) and Aug 2028 (Annex I) and simplifies documentation duties — the EU's first formal AI Act correction.
EU AI Act GPAI model obligations become applicable
General-purpose model providers must maintain technical documentation, publish training-content summaries and comply with EU copyright law; systemic-risk models face safety duties.
EU publishes General-Purpose AI Code of Practice; major labs sign
The voluntary code operationalizes GPAI duties across transparency, copyright and safety — with a one-year enforcement grace period for signatories.
Related instruments
- EUEU AI ActThe world's first comprehensive, risk-based AI law. It bans a set of unacceptable practices (social scoring, manipulative AI, most…
- EUEU Digital OmnibusThe first formal simplification of the AI Act. Adopted July 2026, it delays high-risk obligations to December 2027 (standalone Ann…
- EUGDPR × AIThe EU's data-protection regime remains a primary AI constraint: legal bases for training data, automated-decision rights (Art. 22…
- EUAI Liability DirectiveThe Commission withdrew its proposed AI Liability Directive in February 2025, citing no foreseeable agreement. Civil liability for…
- ITItaly AI LawItaly became the first EU member state with a national AI law, layering sector rules (healthcare, work, justice, public administra…
Related reading
- Issue 10The clause is the policyThe world's largest buyer of AI cannot show that its own contracts carry the provisions its own policy requires. That is not an audit failure. It is a diagnosis.
- Issue 05The sovereign-AI trilemmaEvery state pursuing AI sovereignty in 2026 is making the same trade-off — usually without admitting it.