What are codes of conduct under Article 95?

What is the purpose of a code of conduct?

The purpose of a code of conduct under Article 95 is to encourage the voluntary application of specific requirements to AI systems, beyond the mandatory requirements that apply to a system by virtue of its category. A code can apply the high risk requirements, in whole or in part, to a system that is not high risk, can apply ethical guidelines, sustainability, literacy, inclusion and vulnerability protections, and can set objectives and indicators that allow the achievement of those aims to be measured. The code is a commitment device: a provider or deployer that adopts a code commits to the objectives and indicators in the code, and can be assessed against them by customers, by civil society, by authorities and by the public. The code is not a law, and it does not create a legal duty where none exists, but it can create contractual, reputational and procurement consequences where the code is referenced in a contract, a tender or a public commitment. A provider should therefore adopt a code only where it intends to meet the commitments, with the resources and the evidence to do so, and should record the adoption, the version and the indicators in the same way as it records a legal duty. A code adopted for marketing purposes, without the evidence, will be exposed on review.

What elements can a code cover?

Article 95(2) lists, as elements that codes may include, the applicable elements of the Union ethical guidelines for trustworthy AI, assessing and minimising the impact of AI systems on environmental sustainability including energy efficient programming and efficient design, training and use, promoting AI literacy, facilitating inclusive and diverse design including inclusive and diverse development teams and stakeholder participation, and assessing and preventing negative impact on vulnerable persons or groups, including accessibility for persons with a disability, as well as on gender equality. The list is illustrative, introduced by including elements such as, but not limited to, so a code can cover other elements that fit the purpose of voluntary application of specific requirements. Each element should be translated into clear objectives and key performance indicators, as Article 95(1) requires, so that achievement can be measured. An objective that states only that a system will be trustworthy, without indicators, measures or review arrangements, does not meet the Article 95 approach. A code should state the systems covered, the objectives, the indicators, the measurement method, the review interval, the reporting arrangements and the action to be taken where an indicator is not met. The code should be written in plain language, so that the people affected by the system can understand what has been promised.

For the broader regulatory framework, see codes, standards and sandboxes overview.

Who can draw up a code, and how?

Article 95(3) provides that codes of conduct may be drawn up by individual providers or deployers of AI systems or by organisations representing them, or by both, including with the involvement of interested stakeholders and their representative organisations, including civil society organisations and academia. Codes may cover one or more AI systems, taking account of the similarity of the intended purpose of the relevant systems. The drawing up process should therefore involve the people who will be affected by the code, the people who will implement it, and the people who will assess it, and should be documented with the consultation, the comments and the responses. A code drawn up by a single provider, without stakeholder involvement, can still be a code under Article 95, but it will be less credible and less useful as a commitment device than a code drawn up with stakeholders. A sector code drawn up by an industry organisation should state the members covered, the systems covered, the governance, and the monitoring arrangements, so that a reader can tell whether a named provider is covered and how compliance with the code is assessed. The AI Office and Member States facilitate the drawing up of codes, and their facilitation, guidance and any published codes should be checked on the AI Office and national sites.

How are SMEs and SMCs considered?

Article 95(4), as amended by Regulation (EU) 2026/1744, provides that the AI Office and Member States shall take into account the specific interests and needs of SMEs, including startups, and SMCs, when encouraging and facilitating the drawing up of codes of conduct. That provision recognises that a code designed for a large provider, with extensive reporting, auditing and governance requirements, can be disproportionate for a small provider, and that a code that is disproportionate will not be adopted by the firms it is intended to help. A code should therefore be proportionate in its objectives, indicators and reporting, with simplified arrangements for smaller firms where the code provides for them, without reducing the protection the code promises. An SME that adopts a code should check whether the code has SME provisions, whether the reporting is proportionate, and whether the code requires external assessment or only self assessment. It should record the adoption, the provisions relied on, and the evidence, in the same way as for a legal duty, but with the voluntary nature of the code kept clear in the record. An SME should not adopt a code that it cannot meet, and should not present code adherence as legal compliance.

How should a provider use a code in practice?

A provider that adopts a code should integrate the code into its governance, its product development, its documentation and its reporting. It should map each code commitment to the procedure, the owner, the indicator and the evidence, and should review the indicators at the interval the code specifies. It should report on the indicators honestly, including where an indicator is not met, with the action taken. It should state the code adherence in its customer and public material accurately, with the code, the version, the systems covered and the date, and should not state that code adherence shows legal compliance where it does not. It should review the code when the system changes, when the law changes, or when the code is revised, and should update its commitments accordingly. A provider that uses a code as a procurement or tender requirement should state the code, the evidence required, and the assessment method in the tender, so that suppliers can respond on a clear basis. A code that is referenced in a contract becomes a contractual commitment, and the provider should obtain legal advice on the contract wording before signing. The code record should be kept with the governance file, so that a reviewer can follow the commitment to the evidence.

Continue with general purpose AI codes of practice.

What does this guide not decide?

This guide does not decide whether any named code is an Article 95 code, does not reproduce any code, and does not state whether any provider has met a code. Codes are voluntary and varied, and the code text, the objectives, the indicators and the governance must be checked for each code relied on. A provider or deployer that wishes to adopt or rely on a code should check the code text, the AI Office and Member State facilitation material, and the contract or tender wording, with a legal adviser where the code is to be used contractually. This guide explains the Article 95 framework, not the content of any particular code.

Frequently asked questions

Continue through this AI Act cluster

• codes, standards and sandboxes overview
• general purpose AI codes of practice
• innovation measures and SME support
• proportionate duties and support for SMEs
• AI literacy
• governance checklist