European Union · voluntary framework
EU GPAI Code of Practice: what it asks, and the records to keep
The Code is a voluntary tool, drafted by independent experts and assessed as adequate by the Commission and the AI Board, that GPAI model providers can follow to meet AI Act Articles 53 and 55. Signatories include most major model developers; non-signatories must show compliance by other adequate means.
01 / What it asks
What EU GPAI Code of Practice asks
Providers of general-purpose AI models placed on the EU market that choose to sign; the Safety and Security chapter applies only to models with systemic risk.
- 01Transparency chapter: document each model (Model Documentation Form) and supply it to the AI Office and downstream providers on request.
- 02Copyright chapter: adopt a copyright policy, respect machine-readable rights reservations such as robots.txt when crawling, and offer a complaints point.
- 03Copyright chapter: take measures to reduce the risk of the model producing copyright-infringing output.
- 04Safety and Security chapter (systemic-risk models): adopt a safety and security framework and assess and mitigate systemic risks across the lifecycle.
- 05Safety and Security chapter: report serious incidents to the AI Office and maintain cybersecurity protection for the model.
02 / AI work
Where it touches AI work
Applies only to general-purpose AI models and their providers, not to downstream applications. Downstream builders rely on the documentation signatories must supply.
03 / Dates
The dates that matter
Final Code of Practice published
Commission and AI Board confirm the Code is an adequate voluntary tool
AI Act GPAI model obligations start to apply
Commission enforcement powers over GPAI providers, including fines, begin
Deadline for models placed on the market before 2 August 2025
04 / Enforcement
Who enforces it
None for the Code itself. The AI Office enforces the underlying AI Act GPAI duties; fines up to EUR 15M or 3% of global turnover (Art. 101), from 2026-08-02.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01Completed Model Documentation Form per model version
- 02Published copyright policy and crawler rights-reservation handling
- 03Safety and security framework and model reports (systemic-risk models)
- 04Serious incident reports sent to the AI Office
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
Is the EU GPAI Code of Practice mandatory?+
No. The General-Purpose AI Code of Practice, published on 10 July 2025, is voluntary. The AI Act's duties for general-purpose AI model providers are mandatory and have applied since 2 August 2025; the Code is one way to show compliance with them. The Commission and the AI Board have confirmed it as an adequate voluntary tool, which gives signatories more legal certainty, but it does not create a legal presumption of conformity. Providers that do not sign must show compliance by other adequate means. Commission fines for breaches of the GPAI duties became possible from 2 August 2026. Read the full answer
SOURCES
Go back to the source
European Commission
European Commission
EUR-Lex, Publications Office of the EU
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: EU AI Act