The EU AI Act GPAI Code of Practice is a voluntary framework, published 10 July 2025 under Article 56, that lets general-purpose AI model providers demonstrate compliance with the Act’s transparency, copyright and safety obligations. Most major providers have signed; Meta and leading Chinese developers have not — a distinction procurement teams should weigh directly.
The EU AI Act GPAI Code of Practice is the European Commission’s stopgap compliance tool for general-purpose AI (GPAI) model providers: a set of voluntary commitments, confirmed adequate by the Commission and the EU AI Board, that bridges the gap between the AI Act’s legal obligations and the harmonised European standards still years from adoption. For research institutions now procuring AI writing assistants, literature-review tools, and data-analysis copilots — most of which are built on a small number of underlying GPAI models — signatory status has become a practical, checkable proxy for regulatory risk.
- What is the EU AI Act GPAI Code of Practice?
- Who has signed the GPAI Code of Practice — and who hasn’t?
- A procurement checklist: evaluating AI vendors under the Code
- What this means for research institutions
- Common questions about the GPAI Code of Practice
What is the EU AI Act GPAI Code of Practice?
Article 56 of the EU AI Act establishes the Code of Practice as a voluntary mechanism GPAI model providers can use to demonstrate compliance with the obligations set out in Articles 53 and 55, until dedicated harmonised European standards are drafted by CEN-CENELEC — a process expected to take until 2027 or later. The final Code was published on 10 July 2025, following a multi-stakeholder drafting process the AI Office launched in October 2024.
The Code has three chapters. The Transparency and Copyright chapters apply to every GPAI model provider placing a model on the EU market. The Safety and Security chapter applies only to providers of GPAI models with systemic risk — models presumed to meet that threshold once cumulative training compute exceeds 10^25 floating-point operations (FLOP). Epoch AI’s tracking of large-scale models puts the number of providers currently above that threshold at roughly 11 to 15 worldwide, meaning the systemic-risk chapter is a small-club obligation while transparency and copyright commitments apply far more broadly.
GPAI obligations have applied since 2 August 2025. Enforcement — requests for information, model access, or recalls — begins 2 August 2026; providers of models already on the market before August 2025 have until 2 August 2027 to reach full compliance. Signatories get that runway with reduced scrutiny; non-signatories must prove compliance by other, more burdensome, means from day one.
One point of confusion worth clearing up: the GPAI Code of Practice (Article 56) is not the separate Code of Practice on marking and labelling AI-generated content that the Commission published in June 2026 under Article 50. The two cover different obligations — model-level transparency and safety versus output-labelling — and procurement teams should confirm which one is relevant to the tool in question.
Who has signed the GPAI Code of Practice — and who hasn’t?
The Commission publishes and maintains the official signatory list. Signatories include OpenAI, Anthropic, Google, Microsoft, Amazon, IBM, France’s Mistral AI, and Germany’s Aleph Alpha — the providers behind most GPAI models embedded in commercially available research and productivity tools.
Two gaps matter for procurement due diligence:
- Meta has publicly declined to sign the Code, citing legal uncertainty over some of its transparency and copyright commitments.
- Major Chinese developers — including Alibaba, Baidu, and DeepSeek — have not signed, leaving their models entirely outside the Code’s voluntary compliance pathway for EU deployments.
- xAI has signed only the Safety and Security chapter, not the Transparency or Copyright chapters — a partial-adherence position that is easy to miss if a procurement team checks “has this vendor signed the Code?” as a single yes/no question rather than chapter by chapter.
That last nuance is the one most procurement checklists get wrong. Chapter-level adherence, not blanket signatory status, is the correct unit of due diligence.
A procurement checklist: evaluating AI vendors under the Code
Most AI tools institutions buy — literature-review assistants, grant-drafting copilots, coding and data-analysis tools — wrap a small number of underlying GPAI models. Procurement teams rarely negotiate directly with OpenAI or Google; they negotiate with a SaaS vendor built on top of one. Tracing the underlying model, and its provider’s Code chapter adherence, is a genuine due-diligence step, not a formality.
| Evaluation question | If the underlying GPAI provider is a signatory | If not, or only partially |
|---|---|---|
| Model documentation | Standardised Model Documentation Form available on request, covering training data summary, compute, and energy use | No standard form; institution must request bespoke documentation or accept a documentation gap |
| Copyright policy | Documented policy on lawful data collection and machine-readable rights signals, plus a complaints contact point | Institution bears greater burden to assess copyright exposure independently |
| Systemic-risk safeguards | (where applicable) Safety and Security Framework, incident reporting, and evaluation regime in place | No equivalent framework confirmed; higher-risk models warrant closer technical review |
| Regulatory exposure | Commission enforcement focuses on monitoring; Code commitments can mitigate fines | Vendor faces fuller compliance burden by alternative means; more regulatory requests likely |
Practical steps for a research-institution procurement or IT-governance office:
- Ask every AI vendor which underlying GPAI model(s) power their product, not just the vendor’s own brand name.
- Check chapter-level adherence against the Commission’s published signatory list — Transparency, Copyright, and Safety and Security are separate commitments.
- Request the Model Documentation Form (or equivalent) as a contractual deliverable, not an optional extra, where the underlying provider is a signatory.
- For non-signatory or partial-signatory models, budget additional time for independent technical and legal review before approving procurement.
- Record Code of Practice status in the institution’s AI-tool risk register alongside existing data-protection and accessibility checks.
What this means for research institutions
Universities and funders are not the direct addressees of Article 56 — GPAI model providers are. But procurement decisions inherit the compliance posture of whichever models sit underneath the tools researchers use. A literature-synthesis tool built on a Code-compliant model comes with documented training-data provenance and a defined incident-reporting channel; one built on a non-signatory model does not, and the institution absorbs that gap as its own due-diligence burden.
Research administration offices already run vendor risk assessments for data protection and accessibility; Code of Practice adherence is a natural addition to that workflow. As enforcement ramps toward the 2 August 2026 date and the 2027 deadline for legacy models, institutions that have already mapped their AI-tool stack to underlying GPAI providers will face far less disruption than those discovering the dependency mid-audit.
The Code remains voluntary and harmonised standards are still years away. Until CEN-CENELEC finalises them, signatory status is the clearest available signal of a provider’s regulatory posture — and the most defensible basis on which an institution can currently justify an AI procurement decision to its own governance body.
Common questions about the GPAI Code of Practice
Is the GPAI Code of Practice legally binding?
No. The Code of Practice is voluntary, established under Article 56 of the EU AI Act as an interim compliance route. Providers who sign it can use adherence to demonstrate compliance with Articles 53 and 55; non-signatories must prove compliance through other, generally more burdensome, means.
Has Meta signed the EU AI Act GPAI Code of Practice?
No. Meta has publicly declined to sign the Code of Practice, citing concerns about legal uncertainty in some of its Transparency and Copyright commitments. This places Meta’s GPAI models outside the Code’s voluntary compliance pathway for EU deployments.
What happens if an AI vendor does not sign the Code of Practice?
A non-signatory provider must demonstrate AI Act compliance through alternative means, which the Commission has indicated will typically involve more requests for information and closer scrutiny. Institutions procuring tools built on non-signatory models should expect a heavier independent due-diligence burden.
When does enforcement of the GPAI Code of Practice begin?
AI Office enforcement action begins 2 August 2026 for models placed on the market after August 2025. Providers of models already on the market before that date have until 2 August 2027 to bring them into full compliance.
The bottom line for research institutions: signatory status under the GPAI Code of Practice is not a legal requirement, but it is fast becoming the practical baseline against which every AI procurement decision — from a departmental writing assistant to an institution-wide research-administration platform — should be measured.