The EU Commission announces the publication of general purpose AI code of practice

March 12, 2025 |

The European Commission has released the third draft of the General-Purpose AI Code of Practice. It includes commitments by providers of general-purpose artificial intelligence (AI) models, including:

  • documentation: the signatories commit to drawing up and keeping up-to-date model documentation, including ensuring quality, security, and integrity of the documented information and providing it to providers of AI systems and to the AI Office upon request; and
  • copyright policy

Providers of general-purpose AI models with systemic risk must commit to :

  • adopting and implementing a Safety and Security Framework that will apply to the AI models with systemic risk, as well as detail the systemic risk assessment;
  • conducting systemic risk assessment systematically at appropriate points along the entire model lifecycle;
  • selecting and further characterizing systemic risks;
  • determining the acceptability of the systemic risks;
  • implementing technical safety mitigations along the entire model lifecycle of the model, and ensuring they are proportionate and state-of-the-art;
  • mitigating systemic risks that could arise from unauthorized access to unreleased models;
  • reporting to the AI Office on the safety and security of the models;
  • carrying out adequacy assessments;
  • implementing systemic risk responsibility allocation;
  • obtaining independent external systemic risk assessments, including model evaluations;
  • keeping track of, documenting, and reporting serious incidents to the AI Office and, as appropriate, to national competent authorities;
  • ensuring protections on non-retaliation against any worker providing information about systemic risks;
  • notifying the AI Office of relevant information and the implementation of commitments;
  • carrying out documentation, as prescribed by the code of practice and the Artificial Intelligence Act (AI Act); and
  • implementing public transparency on systemic risks stemming from their AI models with systemic risk.

The AI Office will:

  • report on the feedback received from stakeholders on the template for an adequate public summary of the training data under Article 53(1)d) of the AI Act and outline the next steps for adopting the template; and
  • publish guidance clarifying the scope of the AI Act rules for general-purpose AI, including information on:
    • the definitions of general-purpose AI models;
    • placement of models on the market and providers;
    • exemptions for models provided under free and open-source licenses; and
    • the effects of the AI Act on models placed on the market before August 2025.

The press release provides:

The Chairs and the Vice-Chairs of the General-Purpose AI Code of Practice present the third draft of the Code.

This kicks off the last drafting round as the Code will be finalised based on stakeholder feedback to this proposal. Compared to the previous two drafts, this version of the Code features a more streamlined structure with refined commitments and measures.

The draft is based on a concise list of high-level commitments and provides more detailed measures to implement each commitment. These are 2 Commitments related to transparency and copyright for all providers of general-purpose AI models, and further 16 Commitments related to safety and security only for providers of general-purpose AI models classified as general-purpose AI models with systemic risk.

The improvements are based on the feedback received on the second draft published on 19 December 2024. Together with the third draft, the Chairs and Vice-Chairs also propose a dedicated executive summary and interactive website. This facilitates stakeholders to provide feedback to the draft in writing and in the upcoming discussions in working groups and dedicated workshops. The final Code should be ready in May, as a tool for general-purpose AI model providers to demonstrate compliance with the AI Act, incorporating state-of-the-art practices.

Details of the third draft

The first two sections of the draft Code detail transparency and copyright obligations for all providers of general-purpose AI models, with notable exemptions from the transparency obligations for providers of certain open-source models in line with the AI Act. Related to transparency, Chairs have included a user-friendly Model Documentation Form which allows signatories to easily document the necessary information in a single place. The section on copyright contains core measures from the second draft but in a simplified and clearer form.

The third section of the Code is only relevant for a small number of providers of most advanced general-purpose AI models that could pose systemic risks, in accordance with the classification criteria in Article 51 of the AI Act. Here the Code outlines measures for systemic risk assessment and mitigation, including model evaluations, incident reporting, and cybersecurity obligations.

In light of the evolving state of the art, Chair stress the need to balance clear commitments with the flexibility to adapt as technology evolves, next to the need for further development of ecosystems for AI governance and risk management.

Complementary actions by the AI Office/the Commission

In parallel and independently from the Code, regarding the template for an adequate public summary of the training data envisaged in Article 53(1)d) AI Act, the AI Office outlined earlier this year a preliminary approach for its possible content and structure. During the Code of Practice working group, the AI Office will report on the feedback received from stakeholders and outline next steps for the adoption of the template.

Furthermore, the AI Office is dedicated to ensuring a holistic understanding of the AI Act rules for general-purpose AI, complementing the drawing-up of the Code. Therefore, the AI Office will publish guidance in due time, clarifying the scope of the rules. This can be expected to relate to the definitions of general-purpose AI model, placing of models on the market and provider, including clarifications to responsibilities along the value chain, such as to what extent rules apply to downstream actors modifying or fine-tuning a general-purpose AI model. In addition, the guidance will address the exemption for models provided under free and open-source license, the effects of the AI Act on models placed on the market before August 2025 and possibly other elements of importance for providers to obtain clarity necessary for the future implementation of the rules for general- purpose AI models.\

For now, the AI Office provides clarifications in the dedicated Q&A, which has been updated with the third draft of the Code.

Background

Each draft of the Code of Practice is a work in progress and reflects the views of stakeholders participating in the Code of Practice Working Groups and Provider Workshops, consisting of around 1000 stakeholders, including EU Member State representatives and European and international observers.

Next steps

In addition to the written feedback received by Sunday, 30 March 2025, Chairs and Vice-Chairs will participate in further discussions in line with the tentative timeline published by the AI Office, which will be updated with specific dates as soon as possible.

All stakeholders in the Code of Practice Plenary will have the opportunity to participate in the respective Working Group discussions. Dedicated workshops will be offered to general-purpose AI model providers and Member State representatives in the AI Board Steering Group

In addition, the Chairs plan to invite civil society organisations and downstream industry to additional workshops to allow for even more targeted interactions.

Leave a Reply