It is a pioneering legislative proposal by the European Union aimed at regulating the use and development of AI technologies. Introduced in April 2021, it is one of the first legal frameworks designed to address the opportunities and risks associated with AI systems and that seeks to create a balanced environment that fosters innovation while safeguarding fundamental rights, safety and ethical standards.
The AI Act introduces a phased implementation process, particularly for General Purpose AI models, to ensure compliance while harmonized European standards are developed. One of the most important mechanisms during this interim period is the Code of Practice. This tool is designed to bridge the gap between the immediate obligations of GPAI model providers and the eventual adoption of European GPAI model standards.
Following the entry into force of the AI Act in August 2024, obligations for GPAI models will become enforceable a year later, by August 2025. However, the development of harmonized European standards for these models is expected to take much longer, potentially up to three years, due to the complexity of AI technology and the need for multi-stakeholder engagement. This process is overseen by the European Committee for Standardization and the European Committee for Electrotechnical Standardization, and may also require alignment with international standards, adding further delays.
In the meantime, the Code of Practice will serve as a temporary framework for GPAI model providers. While not legally binding, adhering to the Code will allow providers to demonstrate conformity with the AI Act’s obligations, especially those related to transparency, risk mitigation, and cybersecurity. These obligations include the provision of technical documentation, sharing relevant information with downstream AI system providers, disclosing summaries of training data, and ensuring compliance with EU copyright law. Important to note, for GPAI models deemed to pose systemic risks, such as those with significant computational power, additional responsibilities will apply, including advanced model evaluations, risk assessments, incident reporting and cybersecurity measures.
Due to the twelve month timeline for GPAI model provider obligations coming into force, the Code of Practice must be drafted within nine months of the AI Act entering into force (by May 1st 2025). This is intended to give the Commission time to approve or reject them via implementing act, and if the latter, to develop alternative methods of enforcement.