What the EU’s General Purpose AI Code Means for Businesses
Starting 2 August 2025, the European Union’s AI Act rules on general purpose AI will come into effect, setting a new compliance landscape for businesses using these technologies. The EU has introduced the General-Purpose Artificial Intelligence (GPAI) Code of Practice as a voluntary framework to help companies meet the Act’s requirements, especially for AI models with broad capabilities like ChatGPT, Gemini, or Claude.
This code addresses key areas such as copyright, transparency, safety, and security. Some advanced AI models, deemed to pose “systemic risk,” face additional voluntary obligations. Signatories commit to respecting data access restrictions—like paywalls—and to implementing technical safeguards that prevent generating content that infringes EU copyrights.
- Major AI providers including Anthropic, OpenAI, Google, Amazon, and IBM have signed the GPAI Code.
- Elon Musk’s xAI has signed only the safety and security section.
- Signatories must develop copyright policies aligned with EU law.
The GPAI Code requires continuous risk assessment and mitigation throughout the AI model lifecycle, along with mandatory reporting of serious incidents to EU authorities. Companies are also expected to disclose information about new AI models at launch to the EU AI Office, national regulators, and system integrators upon request.
Legal teams should note: Providers of generative AI are directly responsible for compliance. However, any company using these AI models—whether purchased directly or embedded within other systems—will experience impacts on their supply chains and third-party risk management.
Despite these efforts, some copyright holders remain dissatisfied. A coalition of 40 groups, including news publishers, artists, translators, and producers, criticized the GPAI Code for falling short of protecting intellectual property rights as promised by the EU AI Act. The European Writers’ Council described the code as a missed opportunity and a betrayal of the Act’s objectives.
Still, the EU’s AI regulations stand out as some of the most comprehensive globally, setting standards that many international companies will need to follow. While not perfect, these rules currently represent the only binding global framework for trustworthy AI and responsible innovation.
The AI Act itself came into force in August 2024, with its first enforcement phase starting in February 2025. Alongside the GPAI Code, 2 August 2025 also marks the deadline for EU member states to appoint “national competent authorities” tasked with overseeing the Act’s application and market surveillance.
Penalties for non-compliance can reach up to 7% of a company’s global turnover, underscoring the importance of early preparation. Legal teams must ensure their organizations can demonstrate responsible AI use, even if they are not yet legally required to do so.
Levent Ergin, chief climate, sustainability, and AI strategist at Informatica, emphasizes that this is the first real test of AI supply chain transparency. Without clear records of data sources and model reasoning, organizations risk being unprepared for AI-related compliance.
For legal professionals, this means:
- Reviewing AI use policies and ensuring alignment with the GPAI Code and AI Act.
- Establishing frameworks for ongoing risk assessment and incident reporting.
- Ensuring transparency in AI model deployment and integration.
- Preparing for regulatory audits by maintaining clear documentation of data provenance and AI decision-making processes.
Businesses should treat this deadline seriously and start building compliance capabilities now. For more guidance on AI compliance and practical training, explore resources at Complete AI Training.
Your membership also unlocks:
