GPAI Code of Practice Signatories: Who Signed and What It Means for Research Tool Vendors

As of mid-2026, Amazon, Anthropic, Google, IBM, Microsoft, OpenAI, Mistral AI and Aleph Alpha have signed the EU’s General-Purpose AI Code of Practice in full, xAI has signed only its Safety and Security chapter, and Meta has declined to sign at all. For research offices and publishers procuring AI-enabled tools, a vendor’s foundation-model supplier and that supplier’s gpai code of practice signatories status is now a material, checkable compliance signal.

The General-Purpose AI Code of Practice (GPAI CoP) is a voluntary compliance framework, published by the European Commission on 10 July 2025, that lets providers of general-purpose AI models demonstrate adherence to the transparency, copyright and safety obligations of the EU AI Act’s Articles 53 and 55.

• Which AI labs have signed the Code of Practice?
• Which major providers have not signed, and why?
• What does signing actually commit a provider to?
• What this means for research-tool vendor risk assessments
• Common questions on GPAI Code of Practice signatories

Which AI labs have signed the Code of Practice?

The European Commission maintains and continuously updates a public list of signatories on its digital-strategy portal. Signatories were first published on 1 August 2025, one day before the AI Act’s GPAI obligations took effect on 2 August 2025. The largest foundation-model providers active in academic and publishing tooling have signed all three chapters.

A Signatory Taskforce, chaired by the EU AI Office, was established to help signing providers implement the Code consistently and to keep the commitments current as models are updated. Institutions should check the Commission’s live list before relying on any third-party summary, including this one, since new signatories are added on a rolling basis.

Which major providers have not signed, and why?

Meta is the most significant non-signatory. In July 2025, Meta’s Chief Global Affairs Officer Joel Kaplan stated that the Code introduces legal uncertainties and obligations that “go far beyond the scope of the AI Act,” and confirmed Meta would not sign. xAI took a narrower position, signing only the Safety and Security chapter while rejecting the Transparency and Copyright chapters as, in the company’s view, potentially harmful to innovation.

• Meta — declined to sign any chapter
• xAI — signed Safety and Security only; declined Transparency and Copyright
• Alibaba, Baidu and DeepSeek — no public commitment to sign as of early 2026

Declining to sign does not exempt a provider from the AI Act itself. The Code is a voluntary route to demonstrating compliance; the underlying legal obligations in Articles 53 and 55 remain binding on any GPAI provider placing a model on the EU market, signatory or not.

What does signing actually commit a provider to?

The Code is organised into three chapters, each addressing a distinct obligation under the AI Act. Signing the full Code commits a provider to detailed documentation, copyright policy and, for the largest models, systemic-risk management.

• Transparency — model documentation covering capabilities, limitations and training-data summaries, shared with downstream providers on request within 14 calendar days.
• Copyright — a policy aligned with EU copyright law, including respecting rights-holder opt-outs and mitigating infringing outputs.
• Safety and Security — applies only to models classified as carrying systemic risk (broadly, those trained above 10²⁵ floating-point operations, per Article 55); requires independent external evaluation, incident reporting and a documented risk-management framework.

Non-signatories that provide GPAI models must still satisfy Articles 53 and 55 through other means and face closer supervisory scrutiny from the AI Office. Under Article 101 of the AI Act, the Commission can fine GPAI providers up to €15 million or 3% of total worldwide annual turnover, whichever is higher, for breaches of these obligations — the same penalty tier applies regardless of Code signature status.

What this means for research-tool vendor risk assessments

Research offices, publishers and institutional procurement teams rarely contract directly with foundation-model developers. They contract with the AI-enabled research tools — plagiarism and integrity checkers, peer-review triage systems, writing and translation assistants, literature-discovery platforms — built on top of those models. The signatory status of the underlying model provider is a proxy for how much documentation, incident transparency and risk evidence a research-tool vendor can realistically pass through to an institutional buyer.

A vendor built on a full Code signatory’s model can typically point to a standardised Model Documentation Form, published training-data summaries, and (for systemic-risk models) an externally evaluated Safety and Security Model Report. A vendor built on a non-signatory model has none of this by default; it must obtain equivalent assurances directly from its model supplier or demonstrate compliance through bespoke documentation, which is harder for a research office to verify at procurement stage.

• Ask vendors which foundation model(s) power their product and whether that provider is a full, partial or non-signatory.
• For partial signatories such as xAI, confirm whether the tool relies on capabilities covered only by the unsigned Transparency or Copyright chapters.
• Where a vendor relies on a non-signatory model, request the provider’s own AI Act compliance documentation directly, rather than accepting the vendor’s assurance alone.
• Track the Commission’s signatory list periodically — a vendor’s compliance posture can change as its underlying model supplier’s status changes.

This procurement lens is distinct from the legal-compliance framing most coverage of the Code takes: research administration offices are not GPAI providers themselves, but they inherit downstream documentation risk every time they adopt an AI-enabled tool, a consideration that belongs alongside existing due-diligence practice for research administration vendor reviews.

Common questions on GPAI Code of Practice signatories

What is a GPAI system?

A general-purpose AI (GPAI) model is a foundation model, such as those underpinning ChatGPT, Gemini or Claude, capable of performing a wide range of tasks without being built for one specific use. Under the AI Act, providers of GPAI models placed on the EU market carry distinct transparency and, above certain compute thresholds, systemic-risk obligations.

What happens if a provider does not sign the Code of Practice?

A non-signatory is not exempt from the AI Act. It must demonstrate compliance with Articles 53 and 55 through alternative means, and the EU AI Office has indicated it will apply closer regulatory scrutiny to non-signatories, increasing enforcement uncertainty relative to signatories.

What are the penalties for GPAI Act non-compliance?

Under Article 101 of the AI Act, the Commission can fine a GPAI provider up to €15 million or 3% of total worldwide annual turnover, whichever is higher, for breaches of the transparency, copyright or systemic-risk obligations, independent of whether the provider signed the Code.

Can a provider sign only part of the Code of Practice?

Yes. xAI signed only the Safety and Security chapter of the Code, declining the Transparency and Copyright chapters. Partial signature means a provider gains reduced administrative burden for the chapters it signed, while still needing to demonstrate compliance with the others through other evidence.

Outlook for research administration

The signatory list will keep shifting as new models cross the compute thresholds in Articles 53 and 55, and as the Signatory Taskforce publishes further implementation guidance. Research offices building AI-tool procurement checklists should treat Code of Practice status as one input alongside existing vendor due-diligence questions on data provenance, licensing terms and institutional data protection — not as a substitute for direct verification against the Commission’s live signatory list.