Article 56 requires the AI Office to facilitate the drawing up of codes of practice to contribute to the proper application of the obligations for general purpose AI models in Articles 53 and 55, with the involvement of providers, authorities, civil society and experts. The General Purpose AI Code of Practice, published by the AI Office in July 2025, is the voluntary instrument for that purpose, with chapters on transparency and copyright and on safety and security. Providers may rely on codes of practice to demonstrate compliance with Articles 53 and 55 until a harmonised standard is published, and adherence to an approved code can support a presumption of compliance to the extent the code covers the obligations. A provider that does not adhere to an approved code, or does not comply with a harmonised standard, must demonstrate alternative adequate means of compliance for assessment by the Commission. Signing a code is not the same as complying with the Regulation, and the signatory position must be checked on the AI Office site.
What does Article 56 require?
Article 56 provides that the AI Office shall facilitate the drawing up of codes of practice at Union level to contribute to the proper application of the Regulation, taking account of international approaches, with the aim of enabling providers of general purpose models to demonstrate compliance with the obligations in Articles 53 and 55. The codes are to be drawn up with the involvement of providers of general purpose models, national competent authorities, civil society, academia and other relevant stakeholders, and the AI Office is to publish the codes and assess their adequacy. Article 56 also provides for the Commission to approve a code by implementing act, and for the code to be taken into account in the assessment of compliance. The Article 56 process is therefore a facilitated, multi stakeholder process, not a standardisation process and not a legislative process. A code of practice is a voluntary instrument, but it has legal significance where the Act gives it effect, through the demonstration of compliance route in Articles 53 and 55 and through the Commission assessment. A provider should read Article 56 in full, with Articles 53 and 55, to understand the effect of a code for its model, rather than relying on a summary that describes codes as guidance.
What does the July 2025 Code contain?
The General Purpose AI Code of Practice was published by the AI Office in July 2025, after a multi stakeholder drafting process with several draft iterations. It contains, in outline, a transparency chapter covering technical documentation, information to downstream providers, copyright policy and the training content summary, and a safety and security chapter covering systemic risk identification and assessment, model evaluation and adversarial testing, serious incident tracking and reporting, and cybersecurity protection. The Code sets out commitments, measures and documentation expectations for signatories, with a focus on systemic risk models in the safety and security chapter. The Code is a voluntary instrument, and its chapters apply differently to providers of models with and without systemic risk. A provider should read the Code chapters that apply to its model, record the version and the commitments it has adopted, and map each commitment to the Article 53 or 55 obligation it supports. A provider that signs the Code in general terms, without adopting the chapter commitments and without the documentation the Code requires, has not shown compliance through the Code. The Code text, the signatory list and the AI Office assessment material should be checked on the Commission and AI Office sites, with the date recorded.
For the broader regulatory framework, see codes, standards and sandboxes overview.
How does code adherence support compliance?
Articles 53(4) and 55(2) provide that providers may rely on codes of practice within the meaning of Article 56 to demonstrate compliance with the obligations in those Articles, until a harmonised standard is published. Compliance with a European harmonised standard grants a presumption of conformity to the extent the standard covers the obligations. Providers that do not adhere to an approved code of practice or do not comply with a harmonised standard must demonstrate alternative adequate means of compliance for assessment by the Commission. The Code therefore provides one route to demonstrating compliance, not the only route, and not a guarantee of compliance. Adherence to the Code is assessed by the AI Office and the Commission, with monitoring, reporting and, where relevant, enforcement attention focused on Code adherence for signatories. A provider that adheres to the Code should keep the evidence of adherence, including the documentation, the evaluations, the incident records and the reports, in a form that can be produced to the AI Office. A provider that does not adhere should keep the evidence of its alternative means, with the reasoning that the alternative is adequate, in the same form. The record should state the route chosen, the code or standard version, and the evidence, for each obligation.
What is the signatory position, and why must it be checked?
The signatory position for the Code is a matter of public record on the AI Office and Commission sites, and it changes as providers sign, sign only part of the Code, or do not sign. Reporting checked for this guide described signatories including several large general purpose model providers, and described some providers as not signing, or as signing only the safety and security chapter, with the position as at mid 2025. That reporting is given here only as a prompt to check the current signatory list, not as a statement of the current position, because signatory status can change and because a provider can sign after the reporting date. A downstream provider that relies on a model provider Code adherence should check the signatory list, the chapters signed, and the AI Office taskforce or monitoring material for that provider, on the date of reliance, and should record what was found. A downstream provider should not assume that a model provider is a signatory because it is large, or that a signatory has met every commitment, without checking the monitoring material. The signatory list is a checking route, not a compliance certificate.
How should a downstream provider use the Code?
A downstream provider that integrates a general purpose model into an AI system should use the Code indirectly, through the information the model provider provides under Article 53 and through the Code commitments that affect that information. The downstream provider should check the model provider documentation, the copyright policy, the training summary, the capabilities and limitations information, and the systemic risk information where relevant, and should record what was received, what was missing, and what was asked for. It should not treat the model provider Code signature as a substitute for its own system duties, including classification, risk management, human oversight and transparency for the system it provides. Where the model provider is not a signatory, the downstream provider should ask for the alternative adequate means evidence that the model provider relies on, and should record the answer. Where the model provider is a signatory, the downstream provider should still test the information against its own system use, because a model that is documented for general use may not be documented for the specific downstream use. The downstream record should show the model, the version, the provider, the Code position and the information received, with dates.
Continue with open source general purpose models.
What does this guide not decide?
This guide does not decide whether any named provider has complied with the Code, does not reproduce the Code, and does not state the current signatory list. The Code text, the signatory list and the AI Office assessment material must be checked on the Commission and AI Office sites on the date of reliance. A model provider with a specific model should confirm the Code route, the alternative means route, and the systemic risk position with the AI Office and a legal adviser. Code adherence is a compliance route that needs evidence, not a label that can be asserted in general terms.
Frequently asked questions
Is the GPAI Code of Practice mandatory?
No. It is a voluntary instrument under Article 56. Providers may rely on it to demonstrate compliance with Articles 53 and 55 until a harmonised standard is published, and adherence can support a presumption of compliance to the extent the Code covers the obligations. Providers that do not adhere must demonstrate alternative adequate means for Commission assessment.
What chapters does the Code have?
In outline, a transparency and copyright chapter covering documentation, downstream information, copyright policy and training summary, and a safety and security chapter covering systemic risk assessment, evaluation and adversarial testing, incident reporting and cybersecurity. The chapters apply differently to models with and without systemic risk, and the Code text must be checked for the model concerned.
Does signing the Code prove compliance?
No. Signing is a commitment to the Code measures. Compliance must be shown through the documentation, evaluations, incident records and reports that the Code requires, assessed by the AI Office and the Commission. A signature without the evidence does not show compliance.
Where is the signatory list?
On the AI Office and Commission sites, with the Code text and the monitoring material. The list changes over time and must be checked on the date of reliance, with the chapters signed and the monitoring position recorded. Secondary reporting on signatories should not be relied on without that check.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗European Commission AI Act overview ↗AI Act Service Desk timeline ↗