EU AI Act Rules for General-Purpose AI Models vs the GPAI Code of Practice: Binding Duties vs Voluntary Route

If you build, fine-tune or license a large AI model for the EU market, two documents shape your obligations. The first is the law: Chapter V of the EU AI Act, which has bound providers of general-purpose AI (GPAI) models since 2 August 2025. The second is the General-Purpose AI Code of Practice, a voluntary rulebook published on 10 July 2025 that sets out how providers can meet those legal duties in practice.

The difference has never mattered more. Since 2 August 2026, the Commission's AI Office has had the power to enforce the GPAI rules, and within a month it sent its first formal requests for information to more than 30 AI companies. At the same time, the Digital Omnibus on AI confirmed that the Code gives no formal presumption of conformity. It is an adequate route to compliance, not a legal safe harbour.

This guide explains what the AI Act requires of GPAI providers, what the Code adds, what signing actually gets you, and how to choose between the Code and alternative ways of demonstrating compliance.

The short answer

The AI Act's GPAI rules are mandatory for every provider placing a general-purpose AI model on the EU market. The Code of Practice is optional. It is one way to show you meet those rules, and the Commission and the AI Board have assessed it as adequate. Signing it doesn't change what the law requires, but it changes how the AI Office supervises you: it focuses on whether you follow the Code, rather than examining your own approach from scratch.

Non-signatories must still comply, and must demonstrate it through "alternative adequate means", typically with more documentation and more questions from the AI Office.

What the AI Act requires of GPAI providers

A general-purpose AI model is one that displays significant generality and can competently perform a wide range of distinct tasks. The Commission's guidelines use an indicative criterion of training compute above 10²³ FLOP for models that can generate language, images or video. Obligations fall on the provider, the organisation that develops the model or has it developed and places it on the market under its own name. Fine-tuners can become providers too if they significantly modify a model.

Duties for all GPAI providers (Article 53)

• Technical documentation of the model, including training and testing, kept available for the AI Office and national authorities
• Information and documentation for downstream providers who build AI systems on the model, so they understand its capabilities and limits
• A copyright policy to comply with EU copyright law, including respecting text and data mining opt-outs
• A public summary of training content, using the Commission's template

Providers of models released under free and open-source licences are exempt from the first two duties, unless the model has systemic risk. Providers outside the EU must appoint an authorised representative (Article 54).

Extra duties for systemic-risk models (Article 55)

A model is presumed to have systemic risk if its cumulative training compute exceeds 10²⁵ FLOP, and the Commission can also designate models on other criteria. Providers must notify the Commission within two weeks of meeting the threshold (Article 52) and must:

• Carry out model evaluations, including adversarial testing, using state-of-the-art methods
• Assess and mitigate systemic risks at EU level, including their sources
• Track, document and report serious incidents to the AI Office and national authorities without undue delay
• Ensure adequate cybersecurity for the model and its physical infrastructure

Enforcement is now live

From 2 August 2026, the Commission can request documentation (Article 91), evaluate models (Article 92), require mitigation measures, market restrictions or recalls (Article 93), and impose fines of up to EUR 15 million or 3% of worldwide turnover (Article 101). On 29 August 2026, the AI Office issued its first formal requests for information, covering how providers secure their models, whether independent evaluators have assessed them and how they are monitored after release.

What the GPAI Code of Practice contains

The Code was drafted by independent experts through a multi-stakeholder process facilitated by the AI Office, with input from providers, civil society, rights holders and academics. It has three chapters, and providers can sign some or all of them.

The Safety and Security chapter is the most detailed. Signatories must assess at least four specified systemic-risk categories: chemical, biological, radiological and nuclear (CBRN) risks, loss of control, cyber offence, and harmful manipulation. They must also analyse other risks to public health, safety and fundamental rights, and do this before major deployment decisions.

If you are working out a GPAI compliance route for your models, I post practical breakdowns of the AI Act, the Codes of Practice and ISO 42001 regularly on LinkedIn. Feel free to connect with me there and tell me which route your team is weighing.

Who has signed, and who hasn't

Roughly two dozen providers have signed, including Amazon, Anthropic, Cohere, Google, IBM, Microsoft, Mistral AI and OpenAI, along with smaller European providers such as Aleph Alpha. Two positions stand out:

• Meta declined to sign, saying the Code created legal uncertainty and went beyond the scope of the AI Act. It must show compliance through alternative means.
• xAI signed only the Safety and Security chapter, rejecting the copyright chapter. It must demonstrate compliance with transparency and copyright obligations in other ways.

The Commission updates its signatory list as signatures are confirmed, so counts vary by date. Check the live list before citing a number.

The legal status of the Code after the Digital Omnibus

The Code's legal weight was clarified in 2026. The original AI Act let the Commission approve a code by implementing act, giving it general validity across the EU. The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, removed that power and replaced Article 56(6) with an adequacy assessment.

Its recitals state the position plainly: codes of practice have limited legal effect and, in particular, do not grant a presumption of conformity. That status is reserved for harmonised standards. Providers can still rely on a code assessed as adequate to demonstrate compliance with Articles 53 and 55 until harmonised standards are published.

What signing actually gets you

The Commission has set out the practical benefits for signatories:

Non-signatories face a different relationship. They must explain how their own measures meet each obligation, and the AI Office may ask more questions to assess whether those measures are adequate. For providers with mature internal safety and copyright programmes, that can be workable. For most others, the Code is the cheaper route.

Binding duties vs the voluntary route: side by side

How the timelines fit together

• 1 Aug 2024

  AI Act enters into force.

• Sep 2024

  Drafting of the GPAI Code of Practice begins.

• 10 Jul 2025

  Final GPAI Code of Practice published.

• 18 Jul 2025

  Commission publishes guidelines on the scope of GPAI obligations.

• 24 Jul 2025

  Commission publishes the training-data summary template.

• 1 Aug 2025

  Commission and AI Board confirm the Code is adequate; first signatory list published.

• 2 Aug 2025

  GPAI obligations apply to new models.

• 27 Jul 2026

  Digital Omnibus on AI replaces Article 56(6) and confirms codes give no presumption of conformity.

• 2 Aug 2026

  Commission enforcement powers and fines for GPAI providers apply.

• 29 Aug 2026

  AI Office issues its first formal requests for information to GPAI providers.

• 2 Aug 2027

  Deadline for models placed on the market before 2 August 2025.

How to choose your compliance route: 6 steps

1. Confirm whether you are a GPAI provider

   Check each model against the Commission's guidelines: generality, the indicative compute criterion, and whether your fine-tuning or modification makes you a provider. Downstream deployers of someone else's model generally aren't.

2. Check the systemic-risk threshold

   Calculate cumulative training compute. If it exceeds 10²⁵ FLOP, notify the Commission within two weeks and plan for Article 55 duties, including the Safety and Security chapter if you sign.

3. Decide chapter by chapter

   You can sign some chapters and not others, as xAI did. Weigh each chapter's commitments against your existing transparency, copyright and safety processes.

4. If you sign, implement and evidence it

   Complete the Model Documentation Form, set up the copyright policy and complaints contact, and for systemic-risk models, publish a safety and security framework and file model reports.

5. If you don't sign, document alternative means

   Map each Article 53 and 55 obligation to your own controls and evidence, and expect detailed AI Office questions. Keep the mapping current.

6. Prepare for information requests

   Assign an owner for AI Office correspondence, keep documentation ready to send, and rehearse answers on model security, external evaluations and post-release monitoring, the topics of the first requests.

Common mistakes to avoid

• Treating the Code as optional law: signing is voluntary, the GPAI duties are not
• Claiming a presumption of conformity from signing the Code
• Forgetting the training-data summary, which sits outside the Code
• Assuming legacy models are exempt, when they must comply by 2 August 2027
• Assuming that fine-tuning never makes you a provider

A prompt to assess your GPAI obligations and Code route

Paste in your model details to get a first-draft compliance assessment. Your legal and AI safety leads should review it.

You are an EU AI regulatory specialist with deep knowledge of
AI Act Chapter V (Articles 51 to 55, 91 to 93 and 101), the
Commission's GPAI guidelines, the training-data summary template,
the General-Purpose AI Code of Practice, and the Digital Omnibus
on AI (Regulation (EU) 2026/1744).

Our model(s):
[model name; whether we trained it or modified someone else's
model and how; estimated cumulative training compute (FLOP);
modalities; licence (proprietary or open-source); date placed on
the EU market; whether we are established in the EU; current
documentation, copyright and safety processes]

Produce:
1. Whether each model is a GPAI model and whether we are its
   provider, with reasons.
2. Whether the model is presumed to have systemic risk, and any
   notification duty.
3. A table of applicable Article 53 and 55 obligations, with
   current evidence and gaps.
4. For each Code chapter: what signing would require of us, and
   the pros and cons of signing or using alternative means.
5. Our deadline (2 August 2025 or 2 August 2027) and a plan to
   meet it.
6. Draft answers to likely AI Office questions on model security,
   external evaluation and post-release monitoring.

Use only what I provide and mark uncertain points UNKNOWN.

The AI Act tells model providers what they must achieve. The Code of Practice shows them one well-lit road to get there. You can take another road, but you'll be asked to prove it leads to the same place. — Kumail Mehdi

Frequently asked questions

Working through GPAI obligations for your models? Let's connect on LinkedIn. I'm always glad to compare notes on AI model governance.

Sources

• EUR-Lex — Regulation (EU) 2024/1689 (AI Act)
• European Commission — The General-Purpose AI Code of Practice
• AI Act Explorer — Digital Omnibus on AI text and recitals
• Modulos — Commission guidance on GPAI models and the new Article 56(6)
• Cambridge Commentary — Article 56: codes of practice
• Matheson — The Commission's first use of AI Act investigatory powers
• Allegiance Law — Commission sends first information requests to AI companies
• Veritome — The GPAI Code of Practice one year on
• Securing.ai — GPAI model security and the signatory list
• Wikipedia — General-Purpose AI Code of Practice