AI Act's new GPAI Code out… finally

It’s late but finally here. The 3rd edition of the EU’s GPAI Code of Practice was originally expected in mid February but was published on 11 March, along with a website to help make the Code more accessible. 

The voluntary Code, which the Commission is keen to stress was “written by independent experts” with stakeholder engagement, is designed to help providers of General Purpose AI models demonstrate compliance with their obligations under the EU AI Act. However some industry bodies from the tech sector have said “serious issues remain” –  calling out the provisions around copyright, transparency and ‘burdensome’ external risk assessments as particular areas of concern. 

The latest version of the Code has, according to the Commission press release, “a more streamlined structure with refined commitments and measures.” It sets out detail around how GPAI providers who sign up to the code can comply with the:

• transparency obligations under Articles 53(1)(a) and (b) of the AI Act (and the corresponding Annexes XI and XII). This section includes a ‘user friendly’ Model Documentation Form to ensure information is documented in the correct place; 
• copyright provisions in Article 53(1)(c) – this remains a contentious area and we will be publishing a separate blog which looks into the details of this; and 
• safety and security section in Articles 52(1), 53(1), 53(3), 55(1) and 56(2) and 56(5). This section only applies to GPAI models with systemic risk. 

Separate from this Code of Practice for GPAI model providers, the AI Office plans to publish guidance clarifying the scope of the GPAI rules “in due time”. This AI Office guidance is expected to cover issues such as:

• the definition of GPAI models
• the extent to which these rules will apply downstream to anyone modifying or fine-tuning a GPAI model
• the scope of the exemption for GPAI models provided under free and open-source licenses; and 
• the additional transition period for GPAI models placed on the market before August 2025. 

In the meantime, these Q&As provide additional information, and the AI Office have updated them to reflect the third draft of the Code.

In terms of timing, the Code will be updated once more following feedback on this third draft, and must be finalised in May. The AI Act states that if the Code has not been finalised by 2 August 2025 (the date from which the GPAI model provisions apply), or if the AI Office does not think the Code is adequate following an assessment, the Commission may pass an implementing act  to provide “common rules” covering these various GPAI model provisions.  

Comment:

A lot is riding on this voluntary Code for the EU Commission. While the EU AI Act took years to agree, in many ways passing the legislation is the easy bit. More challenging is making sure it works in practice, and the Code is a key part of this. However, a number of the large GPAI model providers had said they would not sign the previous version, and while some improvements (from their perspective) have been made in this 3^rd draft, early comments made by tech sector representative bodies suggest that this ‘streamlined’ version has not addressed all of their concerns.