The EU’s Code of Practice for GPAI models is a blueprint for how democratic societies can steer the development of AI technologies toward accountability, legality, and human-centricity.

The EU AI Act’s Code of Practice for General-Purpose AI Models – A Landmark Step Toward Accountable AI

by ChatGPT-4o

The recent release of the Code of Practice for General-Purpose AI Models (GPAI), structured under the EU AI Act, marks a pivotal development in the global regulation of artificial intelligence. As reported in Luiza Jarovsky’s widely shared LinkedIn post, the Code offers a voluntary yet influential roadmap for AI providers to demonstrate compliance with Articles 53 and 55 of the AI Act. It is composed of three detailed chapters focusing on Transparency, Safety and Security, and Copyright, each designed to address the unique compliance needs and ethical obligations of GPAI developers.

Key Elements of the Code

1. Transparency Chapter

This chapter provides a Model Documentation Form to standardize disclosure across the industry. It enables AI providers to document crucial aspects such as model architecture, dependencies, training methodologies, distribution channels, and update history. These disclosures are meant to be shared with downstream providers, the EU AI Office, and national authorities, subject to confidentiality protections under Article 78 of the AI Act.

Why it matters:
It bridges the current information asymmetry between model providers and downstream users, ensuring that those who integrate or regulate AI systems understand their capabilities and limitations. It lays a strong foundation for traceability, reproducibility, and accountability.

2. Safety and Security Chapter

Targeting GPAI models with systemic risk, this chapter mandates providers to adopt a lifecycle-based risk management framework, perform systemic risk evaluations, engage in post-market monitoring, and implement both safety and cybersecurity mitigations.

Why it matters:
In a landscape where frontier AI models can have unpredictable or harmful impacts, this chapter institutionalizes precautionary, iterative, and science-based safety checks—especially critical for models with emergent behaviors or high societal impact. It also encourages cooperation with external researchers and civil society.

3. Copyright Chapter

Arguably the most immediately consequential for content owners, this chapter mandates GPAI developers to implement a copyright compliance policy. Key commitments include:

• Only mining lawfully accessible content.

• Respecting robot.txt files and machine-readable rights reservations.

• Excluding sites repeatedly found to infringe copyright.

• Engaging in the development of standardized rights expression protocols.

Why it matters:
It operationalizes EU copyright law in the AI training context, demanding that developers proactively identify and respect content usage restrictions—a landmark shift from prior industry norms of scraping first and litigating later.

Personal Assessment

The Code of Practice represents a historic milestone in AI governance. It shifts the burden of proof toward AI providers, compels transparency, and raises the bar for ethical and lawful behavior. Importantly, it balances regulatory stringency with innovation-friendly flexibility by offering a voluntary path to demonstrate compliance ahead of formal standardization.

However, the Code is not without limitations:

• Voluntariness could limit uptake, especially by non-EU-based companies.

• Enforcement depends heavily on the readiness and resourcing of national AI authorities and the European AI Office.

• Ambiguities remain around systemic risk thresholds, liability allocation, and the interoperability of documentation across jurisdictions.

Still, this initiative rightly recognizes that the future of AI cannot be left to corporate goodwill alone.

Recommendations

For AI Providers:

• Adopt the Code proactively, especially the Transparency and Copyright chapters, to gain regulatory goodwill and avoid future compliance shocks.

• Invest in compliance infrastructure, including documentation tools, data provenance systems, and red-teaming protocols.

• Engage with standardization efforts, particularly around rights reservations and watermarking technologies.

For Content Owners and Publishers:

• Monitor crawler activity and ensure your robots.txt and metadata standards reflect rights reservations in machine-readable formats.

• Participate in EU-facilitated discussions to help shape practical, enforceable copyright protocols.

• Push for global harmonization of text and data mining exceptions and licensing frameworks.

For Regulators and Policymakers:

• Ensure swift operationalization of the European AI Office and competent national authorities.

• Publish the accompanying templates and guidelines for training data summaries and risk tiering to ensure uniform implementation.

• Offer incentives or mandates to encourage adoption, especially by major U.S. and Chinese AI firms operating in the EU.

For Civil Society and Academia:

• Serve as watchdogs and knowledge brokers by testing model outputs, assessing systemic risk claims, and contributing to public model evaluations.

• Push for meaningful transparency, not just compliance formalism—particularly around training data and potential societal harms.

Conclusion

The EU’s Code of Practice for GPAI models is a blueprint for how democratic societies can steer the development of AI technologies toward accountability, legality, and human-centricity. While voluntary for now, it sets a global benchmark that will likely shape industry norms and legislative developments far beyond Europe’s borders. Its success hinges on adoption, enforcement, and adaptation—and all stakeholders have a role to play in that unfolding story.