European UnionGeneral-Purpose AI Code of Practice (Transparency, Copyright, and Safety and Security chapters)
General-Purpose AI Code of Practice,
Guidance, not a law: the European Commission's reading of AI Act, Article 55 (obligations for providers of general-purpose AI models with systemic risk). It binds nobody by itself; the law it reads does.
Guidance on an AI governance rule, addressed to private bodies.
- Instrument type
- guidance published by a regulator
- Obligation class
- Disclosure, Governance, Reporting, TDM, Security
As of .
What the regulator expects
- If you provide a general-purpose AI model and adhere to the Code, draw up and keep up to date the model documentation described in the Model Documentation Form when you place the model on the market, keep previous versions for 10 years after the model has been placed on the market, and publish contact information for the AI Office and for downstream providers who request the relevant information (Transparency chapter, Commitment 1).
- If you adhere to the Copyright chapter, draw up, keep up to date and implement a copyright policy in a single document for all your general-purpose AI models placed on the Union market, with responsibilities assigned inside your organisation (Copyright chapter, Measure 1.1).
- If you use web crawlers to gather training data and adhere to the Copyright chapter, do not circumvent effective technological measures such as paywalls, and employ crawlers that read and follow robots.txt instructions (Copyright chapter, Measures 1.2 and 1.3).
- If you adhere to the Copyright chapter, implement appropriate and proportionate technical safeguards against your models generating outputs that reproduce protected training content in an infringing manner, and designate a point of contact for rightsholders (Copyright chapter, Measures 1.4 and 1.5).
- If you provide a model with systemic risk and adhere to the Safety and Security chapter, create a state-of-the-art Framework, confirm it no later than four weeks after notifying the Commission under Article 52(1) and no later than two weeks before placing the model on the market, assess it at least every 12 months, and implement it (Safety and Security chapter, Measures 1.1 to 1.3).
- If you adhere to the Safety and Security chapter, implement appropriate safety mitigations and an adequate level of cybersecurity protection for the model and its physical infrastructure (Safety and Security chapter, Commitments 5 and 6).
- If you adhere to the Safety and Security chapter, create a Safety and Security Model Report before placing a model on the market and define clear responsibilities for managing systemic risks across your organisation (Safety and Security chapter, Commitments 7 and 8).
- If you adhere to the Safety and Security chapter, report a serious incident to the AI Office not later than two days after becoming aware of your model's involvement where it disrupted critical infrastructure, five days for a serious cybersecurity breach, 10 days for a death and 15 days for serious harm to health, fundamental rights, property or the environment (Safety and Security chapter, Measure 9.3).
- If you do not adhere to an approved code of practice, demonstrate alternative adequate means of compliance with Articles 53 and 55 for assessment by the Commission; adherence to the Code does not constitute conclusive evidence of compliance (Article 53(4) and Article 55(2) of Regulation (EU) 2024/1689).
What this law does
The General-Purpose AI Code of Practice is a voluntary tool, prepared by independent experts in a multi-stakeholder process, to help providers of general-purpose AI models comply with the obligations of the AI Act. The Code was published on . The Code consists of three separately authored chapters, on Transparency, Copyright, and Safety and Security.
The Commission and the AI Board have confirmed the Code as an adequate voluntary tool for providers of general-purpose AI models to demonstrate compliance with the AI Act. The Commission's Opinion C(2025) 5361 of concludes that the Code adequately covers the obligations in Articles 53 and 55 of the AI Act. The Transparency and Copyright chapters offer all providers of general-purpose AI models a way to demonstrate compliance with Article 53.
The Safety and Security chapter is relevant only to providers of the most advanced models, those subject to the obligations for models with systemic risk under Article 55. The Code states that adherence to it does not constitute conclusive evidence of compliance with the obligations under the AI Act.
The AI Act lets a provider of a general-purpose AI model rely on a code of practice to demonstrate compliance only until a harmonised standard is published, and gives the presumption of conformity to compliance with a European harmonised standard. A provider that does not adhere to an approved code of practice must demonstrate alternative adequate means of compliance for assessment by the Commission.
Under the Transparency chapter a signatory documents at least all the information in the Model Documentation Form when it places a general-purpose AI model on the market. A signatory keeps previous versions of the model documentation for a period ending 10 years after the model has been placed on the market. A signatory publicly discloses contact information for the AI Office and downstream providers to request access to the relevant information in the model documentation.
Under the Copyright chapter a signatory draws up, keeps up to date and implements a policy to comply with Union law on copyright and related rights for all general-purpose AI models it places on the Union market. A signatory that uses web crawlers for text and data mining commits not to circumvent effective technological measures such as paywalls. A signatory employs web crawlers that read and follow instructions expressed in accordance with the Robot Exclusion Protocol (robots.txt).
A signatory implements appropriate and proportionate technical safeguards to prevent its models from generating outputs that reproduce protected training content in an infringing manner. A signatory designates a point of contact for electronic communication with affected rightsholders. The Code states that adherence to it does not constitute compliance with Union law on copyright and related rights.
Under the Safety and Security chapter a signatory creates a state-of-the-art Framework for assessing and mitigating the systemic risks of its models. The Framework is to be confirmed no later than four weeks after the signatory has notified the Commission under Article 52(1) and no later than two weeks before the model is placed on the market.
A signatory assesses its Framework when it has reasonable grounds to believe its adequacy or its adherence to it has been or will be materially undermined, or every 12 months from placing the model on the market, whichever is sooner. A signatory implements safety mitigations that are appropriate, including sufficiently robust under adversarial pressure.
A signatory implements an adequate level of cybersecurity protection for its models and their physical infrastructure along the entire model lifecycle. A signatory reports to the AI Office by creating a Safety and Security Model Report before placing a model on the market. A signatory defines clear responsibilities for managing systemic risks across all levels of its organisation.
A signatory reports a serious incident to the AI Office not later than two days after becoming aware of the involvement of its model, where the model led to a serious and irreversible disruption of the management or operation of critical infrastructure. A signatory reports a serious cybersecurity breach, including the exfiltration of model weights, to the AI Office not later than five days after becoming aware of the involvement of its model.
A signatory reports a death of a person to the AI Office not later than 10 days after becoming aware of the involvement of its model. A signatory reports serious harm to a person's health, an infringement of obligations under Union law intended to protect fundamental rights, or serious harm to property or the environment to the AI Office not later than 15 days after becoming aware of the involvement of its model.
A signatory keeps up to date the additional documentation on the model's architecture, integration and evaluations for the AI Office on request.