The recently released draft of the General-Purpose AI Code of Practice seeks to help companies align with the EU AI Act’s stringent requirements. With over 400 global collaborators contributing to the Code, the message is clear: proactive compliance is essential to mitigate systemic risks and foster trust in AI technologies. Organizations that delay may struggle to meet these new standards, exposing themselves to regulatory and reputational risks. Contact DataProbity today to ensure your AI systems comply with global best practices, from transparency and copyright measures to risk assessment and governance frameworks.

Global Collaborators Draft First Guidelines for EU AI Act

The first draft of the General-Purpose AI Code of Practice was released on November 14, 2024. It was developed to guide providers of General-Purpose AI (“GPAI”) as they establish governance programs and processes for the development and deployment of AI models. The Code of Practice is intended to enable these companies to be proactive in their compliance efforts prior to the August 2025 effective data for the EU AI Act’s rules for GPAI. The final version of the Code is targeted for May 2025 after an expected series of four iterations. Stakeholders are invited to review the draft document and provide feedback, particularly as this Code of Practice will play a crucial role in guiding the future of GPA model development and deployment.

More than 400 global organizations participated in the development of the GPAI Code of Practice. The contributors included technology stakeholders, digital content owners and distributors, consulting firms, universities, standards, civil and industry groups, EU Member country representatives and other international stakeholders.

Some of the Collaborator Organizations

Adobe, Amazon, Anthropic, Apache Software Foundation, Apple, Atlassian, Banque de France, Barclays PLC, Bayer, Bloomberg, BMW Group, Booking.com, Canva, Cisco Systems, Conde Nast, Creative Commons, Daimler Truck AG, Dassault Systèmes SE, Fujitsu, GitHub, Google, GSK Glaxo Smith Kline, Hewlett Packard Enterprise, Hitachi, Ltd., Hugging Face, IBM, Lenovo Group, Meta, Metaverse EU, Microsoft, Midjourney, Mozilla Foundation, News Corp, News Media Europe, Nokia, NVIDIA, OpenAI, Orange, Palo Alto Networks, Qualcomm, Rakuten Group, RAND Europe, Salesforce, Samsung Electronics, SAP, Shutterstock, Sony Music Entertainment, Telefónica, TikTok, Toyota Motor Europe, Twilio, Vivendi, Volkswagen, Workday

The document includes a high-level drafting plan outlining the guiding principles and objectives of the Code of Practice. There is recognition of the fact that this first draft is not highly detailed yet, as it aims to provide an overview of the direction being taken, while deliberations continue on sub-measures and KPIs. Exhaustive references to AI Act provisions will be added to future iterations. The document also includes a set of questions to provide more insight into these deliberations and to highlight some of the areas in which progress is expected to be made in future drafts. These are broken into four sections and were addressed by four respective collaborative Working Groups.

These areas are:

Transparency and copyright-related rules
Risk identification and assessment for systemic risk
Technical risk mitigation for systemic risk
Governance risk mitigation for systemic risk

The principles outlined in the draft are the following:

Alignment of Measures, Sub-Measures and KPIs with EU principles and values
Alignment with EU AI Act and international approaches to the Act (e.g. AI Safety Institutes standards and metrics)
Proportionality of Measures, Sub-Measures and KPIs to risk (i.e. suitable, necessary and not excessively burdensome to achieve desired risk-management goal)
Future-Proofing to enable adaptation and updating as technologies and industries change
Proportionality to size and capacity of GPAI provider to enable simplified ways of compliance for SMEs and start-ups
Support and growth for AI safety ecosystem (including collaboration and knowledge-sharing amongst all GPAI ecosystem stakeholders

The draft rules begin with the Transparency and Copyright measures for all providers of GPAI models, and then move into the required measures for providers of GPAI models with systemic risk.

Transparency Measures (in support of EU AI Act Article 53(1)(a) and 53(1)(b))

M.1: Current and updated technical documentation of model (provide to AI Office, upon request)
M.2: Information and documentation for downstream AI system providers (who will integrate model into their systems)

These Transparency measures include sharing an Acceptable Use Policy that clearly provides guidelines on what is and is not acceptable behavior when using the model. The policy should be consistent with the GPAI provider's documentation that describes the uses and capabilities of their model. Adequate information should be provided to the downstream providers so that they can comply with regulations that apply to the deployment and use of their AI system.

Essential Elements of Acceptable Use Policy

Intended users and uses
In-scope users and resources
Acceptable uses, including high-risk AI apps
Unacceptable uses and forbidden actions
Security measures including description of security protocols for GPAI model
Explanation of how and why GPAI provider monitors use of model and privacy impact of that usage
Criteria for loss of user privileges and prior warning processes
Criteria for terminating user account, citing relevant law or regulation used for enforcement
Acknowledgement requirement that downstream providers have read, understood and agreed to comply with AUP

Copyright Measures (in support of EU AI Act Article 53(1)(c))

M.3: Put a copyright policy in place
M.4: Compliance with limits defined in EU Text and Data Mining (TDM) Exception
M.5: Adequate transparency about measures used by provider to comply with EU copyright laws

Taxonomy of Systemic Risks

M.6: Use of Code's Taxonomy as basis for systemic risk assessment and mitigation

Taxonomy of Systemic Risks

Cyber offence: Risks related to offensive cyber capabilities (e.g. vulnerability discovery or exploitation)
Chemical, biological, radiological and nuclear risks: Risk in "dual-use" science (beneficial/harmful) areas (enabling chemical, biological, radiological, and nuclear weapons attacks i.e. weapons development, design, acquisition, and use)
Loss of Control: Issues related to inability to control powerful autonomous GPAI models.
Automated use of models for AI R&D (could greatly increase rate of AI development, potentially leading to unpredictable developments of GPAI models with systemic risk.)
Persuasion and manipulation: Facilitation of large-scale persuasion and manipulation, as well as large-scale disinformation or misinformation with risks to democratic values and human rights (e.g. election interference, loss of trust in the media, homogenization or oversimplification of knowledge)
Large-scale discrimination: Illegal discrimination of individuals, communities, or societies

Additional systemic risks may be added to the taxonomy, including large-scale privacy infringements, surveillance, major accidents etc., as well as other scenarios in which GPAI models might cause widespread negative effects on public health and safety, critical infrastructure, financial security, economic stability, environmental resources, or fundamental rights.

Measures for Providers of GPAI Models with Systemic Risk (in support of EU AI Act Article 55(1)

M.7: Adoption, implementation and availability of a Safety and Security Framework (SSF)

Risk Assessment

M.8: Continuous and thorough system risk identification
M.9: Continuous and thorough analysis of pathways to systemic risk
M.10: Continuous process of evidence collection about risks
M.11: Continuous assessment of risks and evidence collection throughout development and deployment lifecycle

Risk Mitigation

M.12: Details of safety and security mitigations (in SSF)
M.13: Safety and Security Report (SSR) detailing risk, mitigations, forming basis for development and deployment decisions
M.14: Process for go/no-go development and deployment decision (based on SSR analysis)

Governance Risk Mitigation

M.15: Systemic risk ownership at all organization levels to adequately assess and proportionally mitigate risks
M.16: Periodically assess adherence to and adequacy of SSF
M.17: Independent expert systemic risk and mitigation assessment throughout lifecycle, as appropriate
M.18: Identification, tracking and reporting of serious incidents, as appropriate (to AI Office and national authorities)
M.19: Whistleblowing channels and appropriate protections
M.20: Notification when GPAI models meet threshold for systemic risk classification
M.21: Documentation of evidence to adherence to requirements for GPAI with systemic risk (for AI Office, upon request)
M.22: Appropriate public transparency to aid GPAI ecosystem (downstream providers, AI Office, public) to understand and mitigate system risks

The first draft of the General-Purpose AI Code of Practice sends a clear message to GPAI providers: the time to act is now. With the EU AI Act’s rules for GPAI set to take effect in August 2025, this Code offers a roadmap for aligning with regulatory expectations while mitigating systemic risks. Providers must take heed of the outlined measures, from transparency and acceptable use policies to robust risk assessment frameworks, to ensure compliance and ethical AI deployment. As the Code evolves, active engagement in its development will be crucial for shaping a future where innovation and accountability go hand in hand.

The clock is ticking - August 2025 is fast approaching, and in-scope organizations must prepare for compliance with the EU AI Act. While the General-Purpose AI Code of Practice is voluntary, it provides valuable guidance to help businesses align with these new requirements. Complexity should not be a barrier to responsible AI. Let DataProbity simplify your compliance journey by providing the tools and expertise you need. Whether you need to develop governance frameworks, craft acceptable use policies, or conduct systemic risk assessments, we can help you stay ahead. Schedule a consultation today and build a responsible AI ecosystem that drives trust and innovation.