European Commission Unveils General-Purpose AI Code of Practice Ahead of AI Act Enforcement

Editor’s Note: The European Commission’s new General-Purpose AI Code of Practice arrives at a pivotal moment for professionals navigating compliance, security, and legal oversight in AI-rich environments. As general-purpose models underpin an increasing number of enterprise tools—from cybersecurity threat analysis to automated document review—this voluntary code provides actionable standards for transparency, copyright compliance, and systemic risk management. For cybersecurity experts, it offers clearer AI supply chain visibility. For information governance leaders, it outlines data origin practices that withstand audit scrutiny. And for eDiscovery teams, it brings clarity on lawful training data use. This document is more than policy—it’s a practical lens for AI accountability.

Industry News – Artificial Intelligence Beat

European Commission Unveils General-Purpose AI Code of Practice Ahead of AI Act Enforcement

ComplexDiscovery Staff

A turning point in Europe’s approach to regulating artificial intelligence has arrived with the release of the final General-Purpose AI (GPAI) Code of Practice. Unveiled by the European Commission on July 10, the document is the product of collaboration among 13 independent experts and shaped by the insights of over 1,000 stakeholders. These included model developers, small and medium-sized enterprises, civil society organizations, academics, and AI safety professionals.

Though the Code is voluntary, its timing is strategic. It comes just weeks before the EU’s AI Act begins applying to general-purpose AI models on August 2, 2025. Full enforcement will follow one year later for new models and two years later for existing ones. The Code offers a structured framework for compliance in advance of these dates, potentially easing the path for AI providers navigating the new regulatory terrain.

For professionals in cybersecurity, information governance, and eDiscovery, the publication is more than regulatory news—it’s a practical resource. General-purpose AI models are increasingly embedded in the tools and platforms used for threat detection, document analysis, data preservation, and digital forensics. The new Code gives these professionals a clearer sense of how foundational AI technologies must be documented, safeguarded, and lawfully implemented across the EU.

The GPAI Code is organized into three chapters, each targeting a core aspect of the AI Act’s requirements. The first chapter, Transparency, provides a practical Model Documentation Form. This tool is designed to help AI developers consolidate required information about their models into a single, accessible format. For those responsible for data audits, compliance assessments, or AI lifecycle oversight, this documentation creates a clearer window into how models function and where potential vulnerabilities or liabilities may arise.

The second chapter addresses Copyright, offering what the Commission describes as “practical solutions to put in place a policy complying with EU copyright law.” This guidance is particularly relevant for legal technologists and eDiscovery professionals who handle questions of data provenance and chain of custody. Knowing how a model’s training data was sourced—and whether it complied with intellectual property law—has become a vital issue in digital litigation and regulatory reviews.

The final chapter, Safety and Security, applies only to a subset of providers—those developing the most advanced models that may pose systemic risks. These include threats to public safety, social stability, and even national security, such as enabling the development of chemical or biological weapons. Cybersecurity leaders tracking threat actors and advanced persistent threats will find the risk assessment standards embedded in this chapter especially relevant, offering a benchmark for vetting AI systems used in sensitive or high-risk environments.

Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, emphasized the strategic value of the Code in her remarks on its release. “Today’s publication of the final version of the Code of Practice for general-purpose AI marks an important step in making the most advanced AI models available in Europe not only innovative but also safe and transparent,” she said. “Co-designed by AI stakeholders, the Code is aligned with their needs. Therefore, I invite all general-purpose AI model providers to adhere to the Code. Doing so will secure them a clear, collaborative route to compliance with the EU’s AI Act.”

The benefits of signing on to the Code extend beyond reduced legal ambiguity. According to the Commission, providers who voluntarily adopt the Code will be able to “demonstrate compliance with the relevant AI Act obligations” more easily. This approach may lead to a “reduced administrative burden and increased legal certainty compared to providers that prove compliance in other ways.”

For professionals managing enterprise compliance or investigating technology risks, this reduced burden translates into fewer surprises and better-prepared teams when audits or legal scrutiny arise.

Looking ahead, the Commission will publish additional guidelines to complement the Code. These will offer further clarification on which AI model providers fall under the scope of the AI Act’s general-purpose rules. These guidelines are expected before the general-purpose AI obligations take effect in August.

The release of the GPAI Code signals a notable shift from theoretical regulation to actionable guidance. As general-purpose AI models continue to underpin digital systems across sectors—from cyber intrusion detection tools to document review platforms used in complex litigation—the availability of a concrete compliance tool marks a moment of operational clarity for both developers and the professionals who depend on them.

For providers and downstream users alike, the message is clear: the clock is ticking. The opportunity to engage with a flexible, expert-informed compliance pathway is now on the table. Whether that voluntary step will become standard practice remains to be seen, but for now, the framework offers both direction and incentive for those seeking to align early with Europe’s evolving AI governance landscape.

• General-Purpose AI Code of Practice now available (European Commission)
• The General-Purpose AI Code of Practice (European Commission)
• General-Purpose AI Models in the AI Act – Questions & Answers (European Commission)

Assisted by GAI and LLM Technologies

Additional Reading

• Strategic AI and the Shifting Role of IT in Enterprise Innovation
• BRICS Pushes for UN-Led AI Governance at Rio Summit
• Model Poisoning and Malware: GenAI’s Double-Edged Sword
• Legal Tech in the Loop: Generative AI and the New Frontiers of Responsibility

Source: ComplexDiscovery OÜ