Defense · EU GPAI Code of Practice
EU GPAI Code of Practice for defense AI workflows
EU GPAI Code of Practice in defense AI workflows: what compliance requires, who asks for evidence, and the records to keep.
01 / The rule
What EU GPAI Code of Practice requires
Providers of general-purpose AI models placed on the EU market that choose to sign; the Safety and Security chapter applies only to models with systemic risk.
- 01Transparency chapter: document each model (Model Documentation Form) and supply it to the AI Office and downstream providers on request.
- 02Copyright chapter: adopt a copyright policy, respect machine-readable rights reservations such as robots.txt when crawling, and offer a complaints point.
- 03Copyright chapter: take measures to reduce the risk of the model producing copyright-infringing output.
- 04Safety and Security chapter (systemic-risk models): adopt a safety and security framework and assess and mitigate systemic risks across the lifecycle.
- 05Safety and Security chapter: report serious incidents to the AI Office and maintain cybersecurity protection for the model.
02 / In this sector
In a defense AI workflow
Applies only to general-purpose AI models and their providers, not to downstream applications. Downstream builders rely on the documentation signatories must supply.
Program office leads and ATO-package owners.
NIST AI RMF · DoW RAI · OMB M-25-21.
03 / Records
Records to keep
- 01Completed Model Documentation Form per model version
- 02Published copyright policy and crawler rights-reservation handling
- 03Safety and security framework and model reports (systemic-risk models)
- 04Serious incident reports sent to the AI Office
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
European Commission
European Commission
EUR-Lex, Publications Office of the EU
RELATED
Related: EU GPAI Code of Practice: the full guide · EU GPAI Code of Practice for medicine · EU GPAI Code of Practice for law · EU GPAI Code of Practice for education