Our Technology & Artificial Intelligence Alert, analyses some important recent developments in relation to the General-Purpose AI Code of Practice, including:
A. Introduction
B. Background on the AI Act
C. GPAI Models: Definition, Classification and AI Act Obligations
D. GPAI Code
E. Practical Implementation of the Code
F. Timeline of Implementation Regarding GPAI Models
G. Next Steps
A. Introduction
1. The final version of the General-Purpose AI (GPAI) Code of Practice (the Code) was released to the European Commission and made public on 10 July 2025.
2. This Code is a voluntary instrument, developed by 13 independent experts with contributions from over 1,000 stakeholders. It is expected to streamline the implementation of rules for GPAI models under the AI Act1, which are set to come into effect on 2 August 2025.
3. The Code is expected to undergo an adequacy assessment. Once officially approved, all providers of GPAI models are invited to adhere to the Code2.
B. Background on the AI Act
1. The European Union (EU) has enacted the AI Act, establishing a comprehensive regulatory framework for the development, deployment and oversight of artificial intelligence within the EU3.
2. The AI Act implements a phased compliance framework, prescribing distinct obligations for different categories of AI systems, with key provisions coming into force at staggered intervals.
3. A key upcoming milestone is 2 August 2025, when the provisions concerning GPAI models will take effect, alongside other significant developments.
C. GPAI Models: Definition, Classification and AI Act Obligations
1. GPAI models are defined as AI models trained on large-scale datasets, displaying significant generality, capable of performing a wide range of distinct tasks and suitable for integration into various downstream systems or applications4.
2. Starting from 2 August 2025, providers placing GPAI models on the EU market must meet several key obligations5. These include maintaining up-to-date technical documentation to demonstrate compliance, providing relevant information to downstream users to help them fulfil their regulatory duties, implementing and documenting a policy to ensure copyright compliance in training data and publishing a detailed summary of the data used for training, including its sources and types.
3. GPAI models are classified as having systemic risk if they have high-impact capabilities, assessed using technical tools and methodologies, including training compute6. GPAI models may also be designated by the European Commission as having systemic risk based on comparable capabilities or impact7.
4. Providers of these systemic-risk GPAI models face additional obligations8. They must identify and mitigate systemic risks both before and after market placement, conduct and document thorough model evaluations, monitor and report serious incidents to the AI Office and ensure robust cybersecurity measures protect the model and its infrastructure.
D. GPAI Code
1. The AI Act mandates the development of a GPAI Code to assist providers of GPAI and systemic-risk GPAI models to meet their obligations under Articles 53 and 559. The Code was finalised and published on 10 July 2025.
2. The Code was developed through a collaborative, multistakeholder process involving over 1,000 participants, including independent experts, industry leaders, SMEs, academics, rightsholders, and civil society organisations.
3. The Code is organised into three main thematic chapters, the first two involving all providers of GPAI models, and the third being relevant only to a limited number of providers of systemic-risk GPAI models. Each of the chapters corresponds to core regulatory obligations under the AI Act:
a. Transparency: This chapter provides comprehensive technical documentation, including a standardised model documentation form, along with guidance on publishing a detailed summary of the training data, including sources and types. These measures support informed use by downstream providers and oversight by regulators (the AI Office and National competent authorities).
b. Copyright: This chapter aims to assist providers in their obligation to develop, maintain and implement a comprehensive copyright policy. This includes reproducing and extracting only lawfully accessible, copyright-protected content when crawling the world wide web, complying with copyright reservations, mitigating the risk of generating copyright-infringing outputs, designating a point of contact and enabling the lodging of complaints.
c. Safety and Security: Aimed at providers of systemic-risk GPAI models, this chapter concerns measures for identifying and mitigating systemic risks, including risk assessments, model evaluations, serious incident reporting and the implementation of robust cybersecurity measures throughout the model's lifecycle.
E. Practical Implementation of the Code
1. The Code does not impose obligations beyond the AI Act but rather serves as guidance to help providers meet their obligations under the AI Act. Adherence to the Code remains voluntary. Providers may choose alternative compliance methods, provided they are adequate, effective, and proportionate to meet the obligations set out in the AI Act.
2. Nonetheless, the Code offers a recognised and structured pathway for demonstrating compliance to the AI Act obligations, fostering regulatory goodwill and encouraging early engagement with EU supervisory authorities. Voluntary adoption of the Code also offers several practical advantages, including reduced administrative burden and increased legal certainty through standardised documentation and procedures.
F. Timeline of Implementation Regarding GPAI Models
1. Obligations for the providers of GPAI models will take effect on 2 August 202510.
2. However, Article 101 of the AI Act, which concerns the imposition of fines on providers of general-purpose AI models, will not come into force until 2 August 2026. Therefore, during the first year, providers will not be penalised for failing to fully meet all commitments immediately but must be able to demonstrate compliance once enforcement begins after 2 August 2026.
3. Any GPAI models already on the market before 2 August 2025 will benefit from an extended grace period lasting until 2 August 202711.
G. Next Steps
1. Following its publication, the AI Office and the AI Board will conduct a formal assessment of the Code's adequacy in supporting compliance with Articles 53 and 55 of the AI Act.
2. If the Code is deemed sufficient, the European Commission may adopt an implementing act and grant it general applicability across the EU.
3. Further developments are anticipated in the weeks ahead, including the release of the European Commission's guidelines12 on GPAI models complementary to the Code.
4. The key date of 2 August 2025 marks a significant milestone, not only for the provisions concerning GPAI, but also for the broader implementation of EU-wide and national enforcement measures under the AI Act.
Footnotes
1. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act).
2. The AI Office is expected to provide soon details on the adherence process.
3. For further details on the AI Act, please refer to our previous briefings here and here.
4. Article 3(63) of the AI Act.
5. Article 53 of the AI Act.
6. Based on Article 51(2) of the AI Act, a general-purpose AI model shall be presumed to have high impact capabilities when the cumulative amount of computation used for its training measured in floating point operations is greater than 1025.
7. Article 51 of the AI Act.
8. Article 55 of the AI Act.
9. Article 56 of the AI Act.
10. Article 113(3)(b) of the AI Act.
11. Article 111(3) of the AI Act.
12. These guidelines are expected to specify, inter alia, the criteria for classifying an AI model as a GPAI model and therefore assist the companies in assessing whether they fall within the scope of the Code.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
