Under Article 56, the AI Office is to encourage and facilitate the drawing up of codes of practice at Union level to contribute to the proper application of the Regulation. The codes are intended to cover at least the obligations in Articles 53 and 55, to set out clear objectives, commitments and measures with indicators where appropriate, and to be assessed by the AI Office and the Board. Signing or following a code does not replace the statutory duties, but an adequate code can be a practical route to demonstrating how those duties are met.
What is a code of practice under Article 56?
A code of practice is a Union-level instrument drawn up with the involvement of general-purpose AI model providers, national authorities and other stakeholders, including civil society, industry, academia, downstream providers and independent experts. The AI Office encourages and facilitates the work, and the AI Office and the Board aim to ensure that the codes cover the relevant obligations and set out specific objectives with commitments or measures. A code is therefore a collective, voluntary instrument with a public assessment step, rather than a private checklist or a single provider's policy. Readers should check which code is being discussed, who drew it up, whether it has been assessed as adequate, and what its scope is, because the label code of practice on its own does not establish any of those facts.
What should codes cover for Articles 53 and 55?
Article 56 states that the AI Office and the Board shall aim to ensure that codes cover at least the obligations in Articles 53 and 55. For Article 53, that includes keeping the information in the technical documentation and downstream pack up to date in light of market and technological developments, and the adequate level of detail for the summary of training content. For Article 55, it includes identifying the type, nature and sources of systemic risks at Union level and setting out proportionate measures, procedures and modalities for assessing and managing those risks, including documentation. A code that addresses only one of those areas, or that states aspirations without measures and indicators, will be of limited practical use. Providers should map each code commitment to the statutory duty it is intended to support and record any duty that the code does not address.
For the broader regulatory framework, see General-purpose AI models overview.
How are codes assessed and monitored?
Participants in a code are expected to report regularly on the implementation of their commitments, using indicators that reflect differences in size and capacity where relevant. The Commission and the Board monitor and evaluate whether the objectives of a code are being achieved, and the Commission publishes its assessment. The AI Office also promotes review of the codes and assessment against standards. That assessment step is what gives a code its practical weight: a code that has been assessed as adequate, with a published assessment, stands differently from a draft or an unassessed commitment. Providers should keep the assessment, the version of the code they signed or followed, and their own reports together, and should note any change in the code or in the assessment that affects their reliance on it.
What happens if no adequate code is ready?
Article 56 provides a timetable for codes to be ready, and provides that if a code is not finalised or is deemed inadequate by a specified date, the Commission may adopt common rules for the implementation of the relevant obligations by implementing act. The practical point for providers is that the absence of an adequate code does not suspend the underlying duties in Articles 53 and 55. A provider should carry out the duties directly from the consolidated legal text, record the approach taken, and revisit the position when a code or common rules become available. Relying on the expectation of a future code, without doing the underlying work, leaves the provider without evidence if a supervisor asks how the duties were met in the meantime.
How should a provider use a code in practice?
A provider using a code should start with a mapping exercise: list each statutory duty, the code chapter or commitment that addresses it, the internal owner, the evidence produced, and the review date. The mapping should distinguish between commitments the provider has signed, commitments it follows without signing, and areas where it relies on its own measures instead. Staff who produce documentation, evaluation evidence or incident reports should know which code commitments affect their work and where the code sits in the document set. The provider should also plan for code updates, because a code is a living instrument and a commitment that was adequate at signing may need new work when the code is revised. The mapping file is the bridge between the voluntary code and the statutory file.
Continue with Article 53 duties for model providers.
What does this guide not decide?
This guide does not decide whether any particular code of practice is adequate, whether a provider has met a code commitment, or whether following a code demonstrates compliance for a specific model. It does not assess a signatory list, interpret a code chapter, or predict a Commission assessment. Those questions depend on the code text, its version, the published assessment, and the provider's own evidence. A provider should confirm the status of the code it relies on with a competent authority or legal adviser, keep the mapping and evidence current, and treat the code as an aid to the statutory duties rather than a substitute for them.
Frequently asked questions
Are codes of practice mandatory?
Codes of practice are voluntary instruments facilitated under Article 56. The underlying duties in Articles 53 and 55 are statutory and apply whether or not a provider signs a code. A code can help a provider demonstrate how it meets those duties, but it does not create an alternative legal regime on its own.
Who draws up the codes?
The AI Office encourages and facilitates the drawing up of codes, and may invite general-purpose AI model providers and national competent authorities to participate. Civil society organisations, industry, academia, downstream providers and independent experts may support the process. The AI Office and the Board aim to ensure coverage of Articles 53 and 55 and assess achievement of the codes' objectives.
What should a provider record about a code?
Record the code version, the chapters or commitments relied on, the mapping to statutory duties, the owners and evidence for each commitment, any published adequacy assessment, and the review trigger for code updates. Keep that record with the Article 53 and Article 55 files so the connection between the code and the duties is visible.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗Commission AI Act Service Desk timeline ↗European Commission AI Act overview ↗