What the EU's 2025 code of practice asks of general-purpose AI model providers

On July 10, 2025, in Brussels, the European Commission said it had received the final version of the General-Purpose AI Code of Practice. Thirteen independent experts wrote the voluntary code, with input from more than 1,000 stakeholders, to help the companies that make general-purpose AI models meet the rules the EU's Artificial Intelligence Act sets for them. Those rules have applied since August 2, 2025. Since August 2, 2026, the Commission's AI Office has held the powers to enforce them, and the Commission's list of signatories now names 22 companies, plus xAI for one chapter.

Which models the rules cover

The AI Act defines a general-purpose AI model as one that shows significant generality, can competently perform a wide range of distinct tasks and can be built into many downstream systems or applications. Large generative models that produce text, audio, images or video are the typical example, according to the act's recitals. The Commission's guidelines of July 18, 2025, offer a rule of thumb: a model trained with more than 10²³ floating-point operations (FLOP) of compute that can generate language, or images or video from text.

A stricter tier covers models with systemic risk: the most advanced models of the moment, or others with an equivalent impact. The act presumes this above 10²⁵ FLOP of training compute, a threshold the Commission can update, and the Commission can also designate models on criteria such as their number of users. The AI Office said in 2025 that such models were being developed by a handful of companies.

The rules reach any provider that places a model on the EU market, wherever the provider is based and whether the model is sold or given away. A company that fine-tunes another firm's model becomes the provider of a new model only in some cases. The Commission's indicative test is whether the modification used more than a third of the compute that trained the original.

The duties the code helps providers meet

Article 53 of the act applies to every provider. It must document technical information about the model, to hand to the AI Office and national authorities on request and to give to the companies that build the model into their own AI systems. It must also put in place a policy to comply with EU copyright law, and publish a sufficiently detailed summary of the content used to train the model. The Commission published a template for that summary on July 24, 2025. A model released under a free and open-source license, with its weights, architecture and usage information public, is exempt from the documentation duties unless it carries systemic risk.

Article 55 adds duties for models with systemic risk. Their providers must evaluate the model, assess and mitigate the risks, keep track of and report serious incidents, and give the model and its physical infrastructure adequate cybersecurity protection. They must also notify the Commission within two weeks once a model meets the compute threshold, or once it becomes known that it will.

What signing changes

The code creates no new obligations, the Commission says; it sets out one way to meet the act's existing ones. On August 1, 2025, the Commission and the AI Board, made up of the member states, confirmed that the code is an adequate tool for demonstrating compliance. Adherence is a means of showing compliance, not a presumption of conformity, the AI Office's guidance notes. For signatories, the Commission focuses its enforcement on whether they keep to the code, and it may count their commitments as a mitigating factor when it sets a fine.

Providers that do not sign must show compliance by other adequate means and report their measures to the AI Office, for example with a gap analysis against the code. The Commission says they may also face more requests for information and for access to evaluate their models. A signatory that opts out of a chapter loses the code's benefits for that part, and any signatory can withdraw at any time. Breaching the obligations for general-purpose AI models can bring fines of up to €15 million or 3% of total worldwide annual turnover, whichever is higher.

Who has signed

The Commission's code page, last updated on October 7, 2026, lists 22 signatories, among them Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI and OpenAI. xAI signed only the Safety and Security chapter, so it has to show by other adequate means that it meets the transparency and copyright duties. The signatories have set up a taskforce, chaired by the AI Office, to apply the code consistently. Its page lists four meetings in 2026, the latest on July 17.

What applies now

Since August 2, 2026, the AI Office has held enforcement powers over general-purpose AI models. It can ask for technical documentation, carry out model evaluations, order corrective measures and, if necessary, ask a provider to restrict a model's public availability; fines can follow. Models placed on the market before August 2, 2025, have until August 2, 2027, to comply. The AI Omnibus amendments, in force since July 27, 2026, reinforced the AI Office's powers and centralized oversight of AI systems built on general-purpose AI models.

Companies that build another provider's model into their own AI system can file a complaint related to Articles 53 to 55 through a dedicated AI Office channel. At least once every two years, the AI Office will review the code, and any updated version will be put to signatories to sign.

The code is separate from the EU's code of practice on transparency of AI-generated content, which covers marking and labeling AI output; we explain how AI content labels and watermarks work. The act's rules for high-risk AI systems start to apply on December 2, 2027, supported by standards such as EN 18286.