General-Purpose AI: Codes of Practice, Guidelines and Standards

The legal framework

The rules for general-purpose AI models are in Chapter V of the AI Act, Regulation (EU) 2024/1689, Articles 51 to 56. Chapter V applies since 2 August 2025 (Article 113, point (b)). Models placed on the market before that date must comply by 2 August 2027 (Article 111(3)). The Commission's power to fine providers of these models, in Article 101, applies from 2 August 2026, the general date of application. The Digital Omnibus on AI, Regulation (EU) 2026/1744, amended Article 56(6) and Article 50(7) on how codes of practice are assessed. The consolidated text of 27 July 2026 includes those changes.

Who is caught

A general-purpose AI model is a model that "displays significant generality and is capable of competently performing a wide range of distinct tasks" and can be integrated into many downstream systems (Article 3, point (63)). Models used only for research, development or prototyping before they are placed on the market are excluded.

The duties fall on the provider of the model: the company that develops it, or has it developed, and places it on the market under its own name. A company that builds an application on top of someone else's model is a downstream provider (Article 3, point (68)). It does not take over the model duties, but it is the provider of its own AI system.

The duties, article by article

• Article 51: systemic risk. A model has systemic risk if it has high-impact capabilities or if the Commission designates it. High-impact capabilities are presumed when the cumulative training compute exceeds 10^25 floating point operations (Article 51(2)). The Commission can change that threshold by delegated act (Article 51(3)).
• Article 52: notification. A provider whose model meets the threshold must notify the Commission within two weeks. It may argue that the model, exceptionally, does not present systemic risk. The Commission publishes a list of models with systemic risk (Article 52(6)).
• Article 53: all providers. Four duties: technical documentation for the AI Office and authorities (Annex XI); information for downstream providers so they understand the model's capabilities and limits (Annex XII); a policy to comply with EU copyright law, including respect for opt-outs under Article 4(3) of Directive (EU) 2019/790; and a public summary of the training content, on the AI Office template.
• Open-source exception. Models released under a free and open-source licence with public weights, architecture and usage information are exempt from the documentation duties in Article 53(1)(a) and (b) (Article 53(2)) and from the authorised representative (Article 54(6)). The copyright policy and training summary still apply. The exception never covers models with systemic risk.
• Article 54: authorised representative. Providers established outside the EU must appoint a representative in the EU by written mandate before placing a model on the EU market.
• Article 55: systemic-risk models. On top of Articles 53 and 54: model evaluation including adversarial testing, assessment and mitigation of systemic risks, reporting of serious incidents to the AI Office and adequate cybersecurity.
• Article 56: codes of practice. The AI Office encourages codes of practice at EU level that cover at least Articles 53 and 55. Under Article 56(6), as amended in 2026, the Commission, taking utmost account of the Board's opinion, assesses whether the codes cover those obligations and publishes its assessment. If a code is not adequate, the Commission may set common rules by implementing act (Article 56(9)).

What each instrument binds

The AI Act itself binds directly. Articles 51 to 55 are legal obligations, and the Commission can fine a provider up to 3% of worldwide annual turnover or EUR 15 million, whichever is higher (Article 101(1)).

The General-Purpose AI Code of Practice is voluntary. The Commission's page on the code states that it was published on 10 July 2025, that it has three chapters (Transparency, Copyright, and Safety and Security), and that the Commission and the AI Board have confirmed it as an adequate tool for providers to demonstrate compliance. The Transparency and Copyright chapters concern Article 53. The Safety and Security chapter concerns Article 55. Under Articles 53(4) and 55(2), a provider may rely on a code to demonstrate compliance "until a harmonised standard is published". A provider that does not adhere must show "alternative adequate means of compliance" for assessment by the Commission. When the Commission sets a fine, it takes commitments made in codes of practice into account (Article 101(1)).

Harmonised standards give a presumption of conformity. A model that complies with a harmonised standard whose reference is published in the Official Journal is presumed to meet the obligations of Chapter V, Sections 2 and 3, to the extent the standard covers them (Article 40(1)). If standards are missing or inadequate, the Commission may adopt common specifications by implementing act, with the same presumption (Article 41(1) and (3)).

Commission guidelines explain how the Commission reads the Act. Article 96 lists their subjects, such as the definition of an AI system, the prohibitions and the transparency duties of Article 50. The Act gives them no binding force of their own, but Member States must take them into account when they set penalties (Article 99(1)). The Commission's page states that the code is complemented by Commission guidelines on key concepts for general-purpose AI models.

Codes of conduct under Article 95 are a different instrument. They let providers and deployers of AI systems that are not high-risk apply some or all high-risk requirements on a voluntary basis, or commit to goals such as environmental sustainability or AI literacy. They create no presumption of conformity.

The code of practice on AI-generated content. Article 50(7) asks the Commission to encourage codes on detecting, marking and labelling AI-generated content. The Commission assesses whether adherence is adequate to meet Article 50(2) and (4) and may adopt an implementing act if it is not.

In practice

A Brussels start-up fine-tunes an open-weight model and offers it to customers through an API under its own name. If it places the fine-tuned model on the market under its own name as a general-purpose AI model, it is a provider under Article 3, point (3), and Chapter V applies to it. If it releases the result under a free and open-source licence with public weights, it still needs a copyright policy and a training summary. If it keeps the weights closed, it also needs the Annex XI and XII documentation.

An Antwerp insurer builds a claims assistant on a large model from a major provider. The insurer is a downstream provider. It is entitled to the Annex XII information under Article 53(1)(b): capabilities, limitations and what it needs to meet its own duties. If its assistant is high-risk, Article 25(4) also requires a written agreement with the supplier.

A US developer places a model on the EU market. It needs an EU authorised representative under Article 54, and that representative must keep the technical documentation for ten years (Article 54(3)(b)).

A provider trains a very large model. Once it knows the training compute will exceed 10^25 FLOPs, it has two weeks to notify the Commission (Article 52(1)). It can then sign the Safety and Security chapter, or prove compliance with Article 55 another way.

Contracts and practical steps

1. Determine your role. For each model you use, record whether you are its provider, a downstream provider or a deployer. Our AI Act register records this per system.
2. Ask for the Annex XII information. Put the right to receive and update it in your contract, with notice of new versions and known limitations.
3. Agree on copyright. Ask the model provider for its copyright policy and training summary, and allocate the risk of infringing output. See AI, intellectual property and training data.
4. Check whether your supplier signed the code. Signing is voluntary, but it tells you how the supplier intends to meet Articles 53 and 55. Without it, ask what "alternative adequate means" the supplier relies on.
5. Draft the clauses. Document Studio helps you draft and review information, audit and cooperation clauses for model supply.
6. Govern it internally. Codes, guidelines and standards change faster than the Act. Assign someone to follow them, as part of your AI governance framework.

Frequently asked questions

Is signing the code of practice mandatory?

No. It is voluntary. Signing it is one way to demonstrate compliance with Articles 53 and 55. Without it, the provider must show alternative adequate means to the Commission.

Does the code replace the AI Act?

No. The obligations are in Articles 53 to 55. The code describes one way to meet them, and only until a harmonised standard is published.

Are Commission guidelines binding?

The AI Act gives them no binding force of their own. They show how the Commission and national authorities read the Act, and Member States must take them into account for penalties.

I only use a model through an API. Do Articles 53 to 55 apply to me?

Not as model provider. They apply to the company that places the model on the market. You may be the provider or deployer of your own AI system, with the duties that come with that role.

What if my model was on the market before 2 August 2025?

You have until 2 August 2027 to comply (Article 111(3)).

How this connects

This article is part of our series on the EU digital rulebook. See the EU digital rulebook in 2026 for the full map, the Digital Omnibus on AI for the 2026 amendments and AI regulatory sandboxes and real-world testing for testing under supervision. For the roles in the value chain, read provider vs deployer.

Our AI Act compliance team maps your models and roles, and our commercial contracts team negotiates model supply terms.

Provisions cited. AI Act, Articles 3(63) and (68), 25(4), 40(1), 41(1) and (3), 50(7), 51 to 56, 95, 96, 99(1), 101(1), 111(3) and 113(b). Directive (EU) 2019/790, Article 4(3).

Key dates. 2 August 2025: Chapter V applies. 10 July 2025: code of practice published. 2 August 2026: Commission fines under Article 101 apply. 27 July 2026: amended Articles 50(7) and 56(6) in force. 2 August 2027: deadline for models placed on the market before 2 August 2025.

Sources. AI Act, Regulation (EU) 2024/1689, Regulation (EU) 2026/1744, Directive (EU) 2019/790 and the General-Purpose AI Code of Practice.