GPAI Code of Practice – Analysis

Catelijne Muller and Alice Teilhard De Chardin

Link to full analysis: GPAI COP Policy Analysis

As the EU AI Act’s obligations for General-Purpose AI (GPAI) providers come into effect on August 2, 2025, the GPAI Code of Practice (COP) has emerged as the main instrument for demonstrating compliance with the AI Act. While it is voluntary and not legally binding, signing the COP can bring benefits of potentially fewer audits, lower regulatory friction, and easier information requests.

The COP is structured into three sections:

  • Transparency
  • Copyright
  • Safety & Security (for models with systemic risk)

While all GPAI providers must address Transparency and Copyright, the Safety and Security section applies only to providers of GPAI models with systemic risk. ALLAI actively contributed to shaping this section through a series of consultations and working group contributions, where Catelijne Muller participated as an expert, advocating for stronger protections of fundamental rights and robust risk governance. 

Safety & Security Section Key Elements:

Signatories commit to a state-of-the-art Safety and Security Framework to manage systemic risks ranging from cybersecurity and CBRN threats to fundamental rights violations. This includes:

  • Identifying systemic risks from a pre-determined list 
  • Analyzing the potential systemic risks posed by the model via analyses such as model evaluations and post-market monitoring
  • Determining risk acceptability before deployment
  • Implementing mitigations where risks exceed acceptable thresholds

Signatories must also submit a Model Report to the AI Office and follow incident reporting requirements which include timelines for critical accidents. 

ALLAI’s Take

Strengths:

  • Market Incentives for Safety: Signatory status encourages providers to treat responsible AI development as an advantage rather than a mere regulatory burden.
  • Internal Risk Governance: Signatories must embed risk management responsibilities throughout their organizations.
  • Recognition of fundamental rights impacts as systemic risks: The final COP removed language that downplayed fundamental rights and now requires GPAI providers to take them into account when identifying systemic risks.
  • External Evaluations: Independent assessments are now required, although potential loopholes remain.
  • Transparency Commitments: Publishing frameworks and reports, albeit potentially redacted, sets a precedent for public accountability.

Weaknesses:

  • Industry-Dominated Process: Despite public consultation, final decisions leaned heavily on existing corporate practices and frameworks.
  • ‘Acceptable’ Systemic Risks: Allowing a new scheme of ‘risk tiers’ where some systemic risks can be considered ‘acceptable’ (decided by the GPAI provider) introduces a new category to the AI Act, leaves too much room for interpretation, presents a dangerous sliding scale of acceptance of systemic risks and could downplay the need for rigorous mitigation.
  • Limited Precautionary Measures: The COP doesn’t mandate model-specific approval before deployment and fails to address risks from internal models.
  • Outdated Risk Thresholds: Relying on ≥10²⁵ FLOP to trigger systemic risk obligations risks ignoring powerful but smaller models especially as architectures and algorithmic efficiencies improve.

To conclude, despite its weaknesses, we view the COP as a broadly positive step forward in ensuring AI safety and trustworthiness in the EU and in advancing the practical implementation of the AI Act. Its long-term impact will depend on how rigorously signatories uphold their commitments and whether additional GPAI model providers join as signatories. 

Looking ahead, we do urge the implementation of a rigorous ‘updating’ process to improve the COP and keep pace with technological developments. 

the EU AI Office will have the authority to monitor the market, request information, and initiate investigations and we urge it do take this authority very seriously. 

Read the full analysis, prepared by Catelijne Muller and Alice Teilhard De Chardin here: GPAI COP Policy Analysis