General Purpose AI Code of Practice: What You Need to Know About the Draft Version

As already mentioned, the draft GPAI Code of Practice aims to simplify the complex regulatory landscape and guide AI companies in adhering to best practices. But let’s start by understanding the fundamentals.

What Is the General-Purpose AI Code of Practice?

In simple terms, draft Code of Practice is a framework designed to help providers of General-Purpose AI systems like Mistral, ElevenLabs, AlephAlpha, and similar, comply with the EU AI Act. It focuses on transparency, safety, risk management, and ethical AI usage. It also complements the EU AI Act by providing practical steps for securing compliance..  

Who Needs to Follow the General-Purpose AI Code of Practice?

The draft General-Purpose AI Code of Practice will apply to organizations that develop general-purpose AI systems, including those with systemic risks.. Understanding who is required to comply ensures accountability and fosters trust in AI technologies.

a) Providers of General-Purpose AI systems - companies like Mistral, ElevenLabs, and AlephAlpha, which create AI models that can perform various tasks, such as generating text, voice, or visuals, and are widely integrated into other applications.

b) Providers of General-Purpose AI systems that could pose systemic risks - misinformation, discrimination, or expanding ability for  cyberattacks.

To comply, these organizations must address several important features that will be outlined in the final version of theCode of Practice, to be released in Q2 2025. Let’s explore what those key features may be, based on the draft we have access to.

What Are the Key Features of General-Purpose AI Code of Practice?

Now that we understand who needs to follow the General-Puprose AI Code of Practice, let’s explore the key features that guide compliance. These principles ensure transparency, minimize risks, and promote ethical AI development and deployment.

Transparency Requirements

Companies must prepare detailed documentation covering:

• Model architecture and parameters.
• Training and testing processes.
• Intended uses and integration scenarios.
• Acceptable use policies and evaluation results.

Risk Assessment and Mitigation

Providers are required to:

• Identify and assess risks and systemic risks (e.g., cybersecurity, misinformation, discrimination).
• Implement continuous monitoring and technical safeguards.

Intellectual Property and Copyright

Adherence to copyright laws, including respecting data ownership and avoiding the misuse of copyrighted materials.

By adhering to these key features, organizations can ensure they align with best practices. But why does it matter? Let's find out in the next section.

Why Does This Matter?

The Code of Practice isn’t just about ticking boxes—it’s about building trust and ensuring that AI systems are safe, fair, and transparent. For AI businesses, compliance with the Code means a stronger position in the market and better alignment with enterprise customer expectations.

By understanding what is already in the draft Code of Practice, AI companies take the first step toward compliance and turn regulations into a competitive advantage.

The Code of Practice for General-Purpose AI will introduce new responsibilities and challenges for AI companies. While it ensures ethical and safe deployment of AI systems, it also requires significant operational adjustments. Here’s what it means in practical terms:

Obligations Under the Code

General-purpose AI systems will need to  adhere to several key responsibilities, including:

Comprehensive Documentation

• Detailing the model’s architecture, parameters, and intended use cases.
• Providing clear acceptable use policies for downstream applications.

Copyright Directive Compliance

• Respecting data and protected works ownership such as copyright.if rights are reserved against text and data mining.
• Make sure the outputs of the AI system does not generate copyrighted materials.

Risk Management

• Identifying and mitigating risks, such as large-scale disinformation or cybersecurity threats.
• Establishing safety frameworks and incident reporting procedures.

Challenges AI Companies May Face

Adapting to the requirements of the Code of Practice can be daunting, especially for early-stage AI businesses. These challenges highlight areas where adjustments are needed:

• Complexity of compliance - navigating the detailed requirements for technical documentation, risk assessment, and ethical guidelines can be time-intensive.
• Resource allocation - smaller companies may struggle with operationalizing the Code of Practice, as it requires dedicating resources to understanding compliance requirements and implementing effective systems while still focusing on product development.
• Uncertainty around enforcement - since the Code is still in draft form, there may be changes that require companies to adapt quickly.

Opportunities for Growth

While challenging, the Code presents a unique chance for AI companies to gain market advantages. These opportunities can outweigh the short-term hurdles:

• Building trust - Enterprises are already asking their providers to show how they comply with these codes of practice, highlighting its importance for building lasting partnerships. Demonstrating compliance with the Code positions AI companies as responsible and trustworthy partners. 
• Market expansion - adherence to the future Code can open doors to the European market, ensuring AI systems meet local regulatory expectations.
• Competitive edge - early adopters of the Code’s principles can lead the industry in AI deployment, setting themselves apart from competitors.

For AI companies, understanding these obligations and challenges is the foundation for turning compliance into a strategic advantage. Adapting now ensures readiness for the final Code and builds resilience for the future.

The AI Code of Practice is set to redefine how AI companies operate by introducing stricter standards and reshaping business priorities. Here’s a breakdown of its potential impacts:

Operational Changes

The Code of Practice introduces requirements that demand changes in how AI companies document and manage their systems. These adjustments will likely impact daily operations and long-term planning:

• Increased documentation requirements - companies will need to invest time and resources into creating detailed technical documentation and risk assessments.
• Proactive risk management - a continuous process of identifying, mitigating, and reporting systemic risks will become a core responsibility.

Market Dynamics

Compliance with the Code of Practice will influence how AI companies are perceived in the marketplace. It could become a differentiator—or a barrier:

• Compliance as a market barrier - non-compliance could restrict access to the European market, limiting growth opportunities.
• Customer expectations - enterprise customers are likely to prioritize vendors that demonstrate adherence to the Code, making compliance essential for winning deals.

Resource Implications

Adapting to the Code may require rethinking resource allocation and investment. These changes will shape how companies balance compliance with innovation:

• Focus shift - balancing compliance efforts with innovation may require reallocating internal resources or seeking external support.

In the next section, we’re going to explain what steps companies should take in order to comply with the Code of Practice. Let’s move on.

Meeting the requirements of General-Purpose AI Code of Practice for AI necessitates a strategic approach. Here’s how AI companies can prepare:

1. Conduct a compliance audit - assess current operations to identify gaps in documentation, risk management, and ethical practices. This audit will serve as a foundation for building a compliance strategy.
2. Strengthen documentation processes - ensure comprehensive technical documentation, including model architecture, training details, intended uses, and acceptable use policies, is in place and up to date.
3. Implement risk mitigation measures - adopt systems for identifying, monitoring, and mitigating systemic risks, such as cybersecurity vulnerabilities and misinformation potential.
4. Align with copyright laws - establish policies to ensure compliance with intellectual property rights, including due diligence on datasets and prevention of copyright violations, when rights are reserved.

Leverage external expertise - consider using compliance tools, like TrustPath, to automate documentation, streamline risk assessments, and meet the Code’s requirements efficiently.