{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2025-08-01","gaps":[],"covered":["C(2025) 5361 — Opinion — Assessment of the General-Purpose AI Code of Practice [final] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the Commission publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/ai-act/level-3/opinions/commission-c-2025-5361-opinion-gpai-code-of-practice","url":"https://www.headlesslaw.com/ai-act/level-3/opinions/commission-c-2025-5361-opinion-gpai-code-of-practice","title":"C(2025) 5361 — Opinion — Assessment of the General-Purpose AI Code of Practice [final]","family":"l3","work_id":"spaces/aiact/level-3/opinions/commission-c-2025-5361-opinion-gpai-code-of-practice","status":"final","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Commission publication","check":{"against":"the Commission publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://digital-strategy.ec.europa.eu/en/library/commission-opinion-assessment-general-purpose-ai-code-practice","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"67102b8b68b4c85f","change_date":null,"nearest_versions":["2025-08-01"],"first_text_date":"2025-08-01","correction_applies":false,"versions":["2025-08-01"],"version_url":"https://www.headlesslaw.com/ai-act/level-3/opinions/commission-c-2025-5361-opinion-gpai-code-of-practice/versions/2025-08-01","revision_url":"https://www.headlesslaw.com/ai-act/level-3/opinions/commission-c-2025-5361-opinion-gpai-code-of-practice/versions/2025-08-01/rev/67102b8b68b4c85f","versions_url":"https://www.headlesslaw.com/ai-act/level-3/opinions/commission-c-2025-5361-opinion-gpai-code-of-practice/versions","relations_url":"https://www.headlesslaw.com/ai-act/level-3/opinions/commission-c-2025-5361-opinion-gpai-code-of-practice/relations","source_line":"Opinion of the European Commission · not legislation · dated 1 Aug 2025 [final]","attribution":{"prepared_by":"European Commission","published_by":"European Commission","published_in":null,"document_type":"opinion","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"document_date":"2025-08-01","locators":{"document_date":"PDF page 1: \"1.8.2025\""}},"adoption":null}},"provenance":{"official_url":"https://digital-strategy.ec.europa.eu/en/library/commission-opinion-assessment-general-purpose-ai-code-practice","check":{"result":"matched","checked_at":"2026-10-26","against":"the Commission publication"},"repo_path":"spaces/aiact/level-3/opinions/commission-c-2025-5361-opinion-gpai-code-of-practice.md","body_sha256":"466b60e771b3c1117f19eed21962eddc6906c0150355f94c025c4c92a67551d8"},"units":[],"markdown":"---\ntitle: \"C(2025) 5361 — Opinion — Assessment of the General-Purpose AI Code of Practice [final]\"\nshortTitle: \"C(2025) 5361 — Opinion — Assessment of the General-Purpose AI Code of Practice [final]\"\ntype: opinion\ninstrument_type: opinion\nauthority: Commission\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: AI Act\naiact_level3: true\nmica_level2: false\nreference: \"C(2025) 5361 final\"\nlegal_basis: \"Article 56 AI Act\"\ndate: 1 August 2025\nsource_link: \"https://digital-strategy.ec.europa.eu/en/library/commission-opinion-assessment-general-purpose-ai-code-practice\"\nsource_pdf: \"https://ec.europa.eu/newsroom/dae/redirection/document/118688\"\nlifecycle: \"final\"\ntext_version: \"Commission publication\"\nsource_url: \"https://digital-strategy.ec.europa.eu/en/library/commission-opinion-assessment-general-purpose-ai-code-practice\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the Commission publication\"\nsource:\n  prepared_by: \"European Commission\"\n  published_by: \"European Commission\"\n  evidence:\n    prepared_by: \"C(2025) 5361 final\"\n    locator: \"PDF page 1 (https://ec.europa.eu/newsroom/dae/redirection/document/118688)\"\ndocument_type: \"opinion\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  document_date: \"2025-08-01\"\n  locators:\n    document_date: \"PDF page 1: \\\"1.8.2025\\\"\"\nlifecycle_label: \"final\"\n---\n\n**Opinion of the European Commission · not legislation · dated 1 Aug 2025 [final]**\n\n*Final · Commission publication · Checked against the Commission publication on 26 Oct 2026 · [Official source](https://digital-strategy.ec.europa.eu/en/library/commission-opinion-assessment-general-purpose-ai-code-practice)*\n\n| | |\n|---|---|\n| **Full title** | C(2025) 5361 — Opinion — Assessment of the General-Purpose AI Code of Practice \\[final\\] |\n| **Prepared by** | European Commission |\n| **Published by** | European Commission |\n| **Reference** | C(2025) 5361 final |\n| **Document type** | Opinion |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Dated 1 August 2025 |\n| **Legal basis** | Article 56 AI Act |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the Commission publication |\n\nEUROPEAN\n\nCOMMISSION\n\nBrussels, 1.8.2025 C(2025) 5361 final\n\n## COMMISSION OPINION\n\n## of 1.8.2025\n\non the assessment of the General-Purpose AI Code of Practice within the meaning of Article 56 of Regulation (EU) 2024/1689\n\n## COMMISSION OPINION\n\n## of 1.8.2025\n\n## on the assessment of the General-Purpose AI Code of Practice within the meaning of Article 56 of Regulation (EU) 2024/1689\n\n## 1. LEGAL BASIS\n\n(1) The General-Purpose AI Code of Practice (the “Code”) is drawn up pursuant to Article 56 of Regulation (EU) 2024/1689 of the European Parliament and of the Council on a European approach for Artificial Intelligence (the “AI Act”), and is aimed at contributing to the proper application of the Regulation, in particular of the rules for providers of general-purpose AI models and general-purpose AI models with systemic risk.\n\n(2) Pursuant to Article 56(6) of the AI Act, the European AI Office (the “AI Office”) and the European Artificial Intelligence Board (the “Board”) “shall assess whether the codes of practice cover the obligations provided for in Articles 53 and 55, and shall regularly monitor and evaluate the achievement of their objectives. They shall publish their assessment of the adequacy of the codes of practice.” This Opinion sets out the assessment by the European Commission (the “Commission”). The assessment by the Board is published separately.\n\n(3) This Opinion does not prejudge any future action that the Commission, the Board, and other competent authorities, as applicable, may undertake in the enforcement of the AI Act. This document does not bind the Commission in the interpretation of the AI Act, nor does it pre-empt the Commission from assessing the Code as inadequate in the future following its regular monitoring and evaluation of the achievement of the Code’s objectives and its contribution to the proper application of the AI Act pursuant to Article 56(6) of the AI Act or following the Commission’s review and adaptation of the Code pursuant to Article 56(8) of the AI Act.\n\n## 2. BACKGROUND\n\n(4) Codes of practice play an important role in the wider system of enforcement of the AI Act by contributing to its application. While they remain voluntary, providers of general-purpose AI models and of general-purpose AI models with systemic risk may rely on adhering to commitments made in such a code to demonstrate compliance with the obligations provided for in Articles 53 and 55 of the AI Act.\n\n(5) Pursuant to Article 56(1) of the AI Act, “\\[t\\]he AI Office shall encourage and facilitate the drawing up of codes of practice at Union level in order to contribute to the proper application of this Regulation, taking into account international approaches.” Further, pursuant to Article 56(3) of the AI Act, “the AI Office may invite all providers of general-purpose AI models, as well as relevant national competent authorities, to participate in the drawing-up of codes of practice \\[and\\] \\[c\\]ivil society organisations, industry, academia and other relevant stakeholders, such as downstream providers and independent experts, may support the process.” The Code has been prepared in an iterative drafting process that started on 30 September 2024 with the Kick-off Event for the Code Plenary involving nearly 1,000 participants representing the eligible respondents to the call to participate in the drawing-up launched by the AI Office on 30 July 2024. A variety of interested stakeholders were involved in the drafting process, including providers of general-purpose AI models, downstream providers of AI systems built on such models, industry organisations, civil society, rightsholders, and other entities, as well as academia and independent experts. Close involvement of Member States representatives has been ensured throughout the process, via the Board. The AI Office also invited other public bodies and agencies from all over the world working on risk assessment and mitigation for general-purpose AI models to the Plenary as observers.\n\n(6) The Code’s drafting process involved four working groups of independent chairs and vice-chairs with renowned expertise in the respective areas. Working Group One led the Transparency and Copyright Chapters of the Code, while Working Groups Two, Three, and Four led the Safety and Security Chapter on the assessment and mitigation for systemic risks. In particular, Working Group Two led the parts on systemic risk assessment, Working Group Three on technical mitigations for systemic risks, and Working Group Four on governance mitigations for systemic risks.\n\n(7) The Code establishes a total of 12 commitments, divided into two categories and three documents: Commitment 1 in the Transparency Chapter and Commitment 1 in the Copyright Chapter that are applicable to all providers of general-purpose AI models; and specifically for providers of general-purpose AI models with systemic risk Commitments 1 to 10 in the Safety and Security Chapter. As part of these commitments, the Code includes measures to further specify them as well a “Model Documentation Form” for the Transparency Chapter and four Appendices for the Safety and Security Chapter. Commitment 1 of the Transparency Chapter, in conjunction with the Model Documentation Form, sets out the information that need to be documented and kept up-to-date pursuant to Article 53(1), points (a) and (b), of the AI Act. Commitment 1 of the Copyright Chapter entails the putting in place of a policy to comply with copyright and related rights pursuant to Article 53(1), point (c), of the AI Act and includes measures that participants commit to as part of their policy. Commitment 1 of the Safety and Security Chapter outlines a Safety and Security Framework (the “Framework”) that participants create, update, and report to guide their assessment and mitigation for systemic risks pursuant to Article 55(1), point (b), of the AI Act and adherence to the Code. Participants implement the Framework both on an ongoing basis (Measure 1.2, second paragraph, of the Safety and Security Chapter) as well as with increased depth and breadth before placing the model on the market and at certain intervals (Measure 1.2, third paragraph, of the Safety and Security Chapter). Commitment 2 addresses the systemic risk identification that forms the start of the assessment and is supplemented by characterisations of systemic risks in Appendix 1. Commitment 3 describes the systemic risk analysis as part of which participants evaluate their model, in accordance with Appendix 3 and pursuant to Article 55(1), point (a), of the AI Act and estimate the identified systemic risks, including more lenient measures for “similarly safe or safer models” pursuant to Appendix 2. Based on this information, participants then determine whether the systemic risks stemming from their model are acceptable pursuant to Commitment 4. Commitment 5 describes safety mitigations and Commitment 6, in conjunction with Appendix 4, describes cybersecurity mitigations pursuant to Article 55(1), point (d), of the AI Act to be implemented to ensure systemic risk is kept at acceptable levels. The results gathered from the aforementioned commitments in the Safety and Security Chapter and complementary information are then reported to the AI Office pursuant to Commitment 7. Commitment 8 describes how the responsibility for systemic risks should be allocated within the participant’s organisation as a governance mitigation for systemic risk. Commitment 9 entails the serious incident reporting pursuant to Article 55(1), point (c), of the AI Act. Commitment 10 outlines information that participants commit to documenting and keeping up-to-date pursuant to Article 53(1), point (a), Annex XI, Section 2, of the AI Act and further information to evidence adherence to the Code.\n\n## 3. ASSESSMENT\n\n### 3.1. Assessment criteria\n\n(8) Pursuant to Article 56(6) of the AI Act, the AI Office shall evaluate the codes of practice’s contribution to the proper application of this Regulation and assess whether the codes of practice cover the obligations provided for in Articles 53 and 55, which, pursuant to Article 56(2) of the AI Act, includes at least:\n\n(9) the means to ensure that the information referred to in Article 53(1), points (a) and (b), of the AI Act is kept up to date in light of market and technological developments;\n\n(10) the adequate level of detail for the summary about the content used for training;\n\n(11) the identification of the type and nature of the systemic risks at Union level, including their sources, where appropriate;\n\n(12) the measures, procedures, and modalities for the assessment and management of the systemic risks at Union level, including the documentation thereof, which shall be proportionate to the risks, take into consideration their severity and probability, and take into account the specific challenges of tackling those risks in light of the possible ways in which such risks may emerge and materialise along the AI value chain.\n\nThis is assessed in sections 3.2 and 3.3 of this Opinion.\n\n(13) Pursuant to Article 56(4) of the AI Act, the AI Office “shall aim to ensure that the codes of practice clearly set out their specific objectives and contain commitments or measures, including key performance indicators as appropriate, to ensure the achievement of those objectives, and that they take due account of the needs and interests of all interested parties, including affected persons, at Union level.” According to Article 56(5) of the AI Act, the AI Office “shall aim to ensure that participants to the codes of practice report regularly to the AI Office on the implementation of the commitments and the measures taken and their outcomes, including as measured against the key performance indicators as appropriate. Key performance indicators and reporting commitments shall reflect differences in size and capacity between various participants.”\n\nThis is assessed in sections 3.4 to 3.6 of this Opinion.\n\n### 3.2. Contribution to the proper application of the AI Act by covering Article 53(1), including Article 56(2), points (a) and (b), of the AI Act\n\n(14) The Code aims to contribute to the proper application of the AI Act in relation to the rules provided for providers of general-purpose AI models pursuant to Article 53 of the AI Act, by guiding and ensuring compliance and facilitating the AI Office’s monitoring as stated in Objectives A and B of the Code.\n\n(15) The Transparency Chapter of the Code, by way of its Commitment 1, contributes to the proper application of Article 53(1), points (a) and (b), of the AI Act in the following ways:\n\n(16) Measure 1.1 details out the information referred to in Annex XI, Section 1, and Annex XII of the AI Act, corresponding to the information that providers of general-purpose AI models must document and keep up-to-date under Article 53(1), points (a) and (b), of the AI Act. It does so in the form of a Model Documentation Form which participants may choose to fill in as a simple and practical means of demonstrating compliance with their documentation obligations. The Model Documentation Form includes each item under Annex XI, Section 1, and Annex XII of the AI Act, and gives further guidance to providers on the specific information that should be provided under each item. In addition, Measure 1.1 specifies how providers of general-purpose AI models may fulfil their obligation to keep the documentation up-to-date, in particular in relation to model versions.\n\n(17) Measure 1.2 specifies how providers of general-purpose AI models may fulfil their obligation to provide relevant information, upon request, to the AI Office and national competent authorities, and to make available relevant information to downstream providers. The Measure specifies that requests from national competent authorities are made through the AI Office, and clarifies the basis on which requests can be made. In the case of information to be provided to downstream providers, the Measure specifies the conditions under which additional information beyond that listed in the Model Documentation Form may need to be provided.\n\n(18) Measure 1.3 specifies how providers of general-purpose AI models may ensure the quality, integrity, and security of the documented information. This Measure ensures that the information referred to in Article 53(1), points (a) and (b), of the AI Act is documented in such a way that it can meaningfully serve its purpose under the AI Act, namely allowing the AI Office and national competent authorities to exercise their tasks under the Regulation, and allowing downstream providers to have a good understanding of the capabilities and limitations of the general-purpose AI model relevant for its integration into AI systems, and to comply with their own obligations pursuant to the Regulation.\n\n(19) The Safety and Security Chapter of the Code contributes to the proper application of Article 53(1), point (a), Annex XI, Section 2, of the AI Act by its Measure 10.1, which lists the required items in its first paragraph and ties them to the corresponding parts of the systemic risk assessment and mitigation under the Code. In particular, Annex XI, Section 2, points (1) and (2), of the AI Act are covered by the reference to model evaluations under the Code (Measure 10.1, first paragraph, point (3)), which include “testing”, and “model adaptations, including alignment and fine-tuning” is covered by the reference to safety mitigations (Measure 10.1, first paragraph, point (4)).\n\n(20) Article 56(2), point (a), of the AI Act is covered by the Transparency Chapter of the Code, by way of its Commitment 1 and recital (c). More specifically, Measure 1.1 specifies how participants may keep their documentation up-to-date as their models evolve throughout their lifecycle, so that where information is requested by the AI Office, or where it is made available to downstream providers, information which reflects the most recent technological development is provided. Moreover, recital (c) clarifies that the information provided by participants may need to take into account market and technological developments, so that it can effectively serve its purpose. Similarly, Measure 10.1 requires the information listed in Annex XI, Section 2, of the AI Act to be kept up-to-date.\n\n(21) The Copyright Chapter of the Code contributes to the proper application of Article 53(1), point (c), of the AI Act, by way of its Commitment 1 under which participants commit to drawing up, implementing, and keeping up-to-date a policy to comply with Union law on copyright and related rights, and in particular to identify and comply with, including through state-of-the-art technologies, a reservation of rights expressed pursuant to Article 4(3) of Directive (EU) 2019/790. Importantly, the Copyright Chapter points out that the measures taken in accordance with this Commitment do not constitute compliance with Union law on copyright and related rights. They also do not affect the application and enforcement of Union law on copyright and related rights, in line with recital 108 of the AI Act. Moreover, the Chapter duly acknowledges that Union law on copyright and related rights is laid down in directives which have been transposed by Member States into their national laws. These measures can only be used to demonstrate compliance with the obligation provided for in Article 53(1), point (c), of the AI Act as a market entry condition and not with Union law on copyright and related rights. In addition, participants remain responsible to verify that the measures in the Code comply with these laws, before carrying out any copyright-relevant act in the territory of the relevant Member State. More concretely, the measures from the Copyright Chapter contribute to the proper application of Article 53(1), point (c), of the AI Act in the following ways:\n\n(22) Measures 1.1 clarifies that participants will draw up, keep up-to-date, and implement a copyright policy in a single document, and assign specific responsibilities within the organisation for its implementation and oversight. Moreover, participants are encouraged to publish on a voluntary basis a summary of their copyright policy. Measures 1.2 to 1.4 clarify which concrete measures should be part of the copyright policy of participants.\n\n(23) Measure 1.2 refers to measures that will help to ensure lawful access by not circumventing effective technological measures as defined in Article 6(3) of Directive 2001/29/EC and excluding from their web-crawling piracy websites, recognised as such by courts or public authorities in the European Union and the European Economic Area.\n\n(24) Measure 1.3 refers to a variety of rights reservation protocols (such as the Robot Exclusion Protocol (robots.txt) and other appropriate machine-readable protocols) that are adopted by standardisation organisations or are generally agreed as state-of-the-art in a process to be facilitated at Union level, involving providers, rightsholders, and other stakeholders. A related transparency measure (Measure 1.3, point (4)) will also ensure that rightsholders are informed about the use of such protocols at the time of web-crawling.\n\n(25) Measure 1.4 clarifies how participants will mitigate the risk that their models are used to generate output that infringes on the right of reproduction in works or other subject matter protected by Union law on copyright and related rights.\n\n(26) Measure 1.5 mandates the establishment of a complaint mechanism and a point of contact to enable complaints by affected rightsholder regarding possible non-compliance with the measures in the Copyright Chapter of the Code.\n\n(27) Article 53(1), point (d), of the AI Act requires providers to make publicly available a sufficiently detailed summary about the content used for the training of the models according to a template to be provided by the AI Office. The AI Office has been preparing this template in parallel and has also consulted a first proposal with the participants in the Code process. Considering this parallel work and the diverging views among stakeholders for the level of details to be covered that has emerged during the consultation and the discussions with providers, rightsholders, and other stakeholders during the relevant working group meetings, it was decided that the Code (recital (f) of the Copyright Chapter) will refer to the AI Office’s template for the summary that will specify the adequate level of detail, as required in Article 53(1), point (d), of the AI Act, regardless of whether the providers adhere to the Code.\n\n(28) In light of the above, the Commission assesses that the Transparency and Copyright Chapters adequately cover the obligations provided for in Article 53(1), and the parts thereof outlined in Article 56(2), points (a) and (b), of the AI Act, for providers of general-purpose AI models, while the Safety and Security Chapter adequately covers the transparency obligations specific to providers of general-purpose AI models with systemic risk under Annex XI, Section 2, of the AI Act. The assessment of the Commission regarding the Copyright Chapter of the Code is limited to assessing the adequacy of the Code to act as a means to demonstrate compliance with the obligation under Article 53(1)(c) of the AI Act and in no way affects the application and enforcement of Union law on copyright and related rights.\n\n### 3.3 Contribution to the proper application of the AI Act by covering Article 55(1), including Article 56(2), points (c) and (d), of the AI Act\n\n(29) The Code aims to contribute to the proper application of the AI Act in relation to the rules provided for providers of general-purpose AI models with systemic risk pursuant to Article 55 of the AI Act, by guiding and ensuring compliance and facilitating the AI Office’s monitoring as stated in Objectives A and B of the Code.\n\n(30) The Safety and Security Chapter of the Code, by way of its Commitments 1 to 10, contributes to the proper application of Article 55(1), points (a) to (d), of the AI Act in the following ways:\n\n(31) Measure 3.2, in conjunction with Appendix 3, specifies how providers of general-purpose AI models with systemic risk may perform model evaluations pursuant to Article 55(1), point (a), of the AI Act. Such model evaluations are understood part of the systemic risk assessment process under Commitments 2, 3, and 4, which participants commit to conducting before placing their model on the market and continually under certain conditions specified in Measure 1.2. Appendix 3 describes requirements that model evaluations need to fulfil, including the necessary rigour and depth (Appendix 3.1), the level of model elicitation (Appendix 3.2), the robustness of technical mitigations (Appendix 3.3), the qualification and resourcing of evaluation teams (Appendix 3.4), and under which conditions independent external evaluations are appropriate (Appendix 3.5). In addition, Measure 1.2, second paragraph, states that lighter-touch model evaluations should be done at appropriate points along the entire model lifecycle and Measure 3.5 addresses under which conditions independent external evaluations are appropriate to facilitate post-market monitoring.\n\n(32) Commitments 1 to 4 specify how providers of general-purpose AI models with systemic risk may assess possible systemic risks at Union level stemming from the model pursuant to Article 55(1), point (b), of the AI Act. In particular, participants commit to conducting an iterative and recursive process of systemic risk identification (Commitment 2), analysis (Commitment 3), and acceptance determination (Commitment 4) before placing the model on the market and continually thereafter (Measure 1.2, third paragraph). In addition, more frequent but less thorough systemic risk assessment measures are outlined in Measure 1.2, second paragraph, and Measure 3.5. Following the systemic risk assessment, Commitments 1, 5, and 6 clarify the application of Article 55(1), point (b), of the AI Act to mitigate possible systemic risks at Union level stemming from the model. In particular, participants commit to implementing appropriate safety mitigations (Commitment 5) and cybersecurity mitigations (Commitment 6), the latter of which is further specified in Appendix 4, to ensure systemic risks are acceptable. Moreover, these technical mitigations are complemented by governance mitigations such as in Commitments 1, 7, and 8 in accordance with the emphasis in recital 114 of the AI Act on “risk-management policies, such as accountability and governance processes”.\n\n(33) Commitment 9 specifies how providers of general-purpose AI models with systemic risk may keep track of, document, and report relevant information about serious incidents and possible corrective measures to address them pursuant to Article 55(1), point (c), of the AI Act. In particular, it sets out methods for the identification of serious incidents (Measure 9.1), which information is relevant for a given serious incident (Measure 9.2), what “without undue delay” typically requires of reporting timelines (Measure 9.3), and for how long the information should be kept by participants (Measure 9.4).\n\n(34) Commitment 6 specifies how providers of general-purpose AI models with systemic risk may ensure an adequate level of cybersecurity protection for the model and its physical infrastructure pursuant to Article 55(1), point (d), of the AI Act. In particular, participants commit to specifying a security goal that takes account of expected threat actors and to ensuring that their security measures meet this goal (Measure 6.1). Further, Measure 6.2, in conjunction with Appendix 4, specifies various security objectives and suggested security measures thereunder, which participants commit to implementing, while allowing for deviating measures if participants can justify that a similar level of cybersecurity protection is ensured (Measure 7.3, point (3)(d)).\n\n(35) The commitments of the Safety and Security Chapter further contribute to the proper application of Article 55(1) of the AI Act by specifying that the various obligations are not isolated but complement and feed into each other. Performing model evaluations (Article 55(1), point (a), of the AI Act) and serious incident reporting (Article 55(1), point (c), of the AI Act) are an essential part of systemic risk assessment (Article 55(1), point (b), of the AI Act). Ensuring adequate cybersecurity protection (Article 55(1), point (d), of the AI Act) limits the scenarios that could lead to materialised systemic risks and, thus, serves as a systemic risk mitigation (Article 55(1), point (b), of the AI Act). Accordingly, the participants’ model evaluations and serious incident reporting inform the systemic risk estimations (Measure 3.4), cybersecurity protection is part of the technical systemic risk mitigations (Commitment 6), and establishing serious incident reporting processes are viewed as part of the participants’ governance mitigations (Commitment 9).\n\n(36) Article 56(2), point (c), of the AI Act is addressed by the Safety and Security Chapter, by way of its Appendix 1 that guides the systemic risk identification in Commitment 2. In particular, Appendix 1.1 provides examples of risks derived from recital 110 of the AI Act, the Code’s multi-stakeholder process, and international approaches under the types of risks that Article 3(65) of the AI Act sets out. Appendix 1.2 distinguishes between essential (Appendix 1.2.1) and contributing (Appendix 1.2.2) characteristics for the nature of systemic risks. Appendices 1.3.1 to 1.3.3 describe sources of systemic risks, including model capabilities, propensities, and affordances and other contextual factors. Lastly, Appendix 1.4 specifies systemic risks derived from recital 110 of the AI Act and from international approaches that form part of the open-ended systemic risk identification process (Measure 2.1, point (2)).\n\n(37) Article 56(2), point (d), of the AI Act is addressed in the Safety and Security Chapter as clarified in the Chapter’s recital (i), and assessed in paragraph (18) above. The required documentation thereunder is described in Commitment 10, in particular in Measure 10.1, third paragraph. Further, recital (b) of the Safety and Security Chapter emphasises contextual systemic risk assessment and mitigation, reflecting integrations of the model into AI systems, while recital (c) refers to the proportionality principle in the Code’s interpretation. In recognition of the particular challenge of how systemic risks might materialise along the value chain, the participants commit in Measure 9.1 to facilitating the reporting of serious incidents of the model by downstream providers and final users, and, thus, contributing to the visibility of incidents derived from the model along the value chain. Moreover, the foreseeable integrations of the model into AI systems along the value chain need to be reflected in the performed model evaluations pursuant to Appendix 3.2, second paragraph, point (2).\n\n(38) In light of the above, the Commission assesses that the Safety and Security Chapter of the Code adequately covers the obligations provided for in Article 55(1), and the parts thereof outlined in Article 56(2), points (c) and (d), of the AI Act, for providers of general-purpose AI models with systemic risk.\n\n### 3.4. Whether specific objectives are clearly set out (Article 56(4) of the AI Act)\n\n(39) The Code sets out its specific objectives at the start of each Chapter. In particular, it aims to serve as a guiding document for demonstrating compliance with Articles 53 and 55 (Objective A) and enable the assessment of compliance by the AI Office (Objective B). More specifically, the Transparency, Copyright, and Safety and Security Chapters each contain dedicated recitals clarifying various purposes and considerations that the commitments serve. Further, the Commitments entail purpose-clauses phrased as “in order to” or “for the purpose of” that set out the Commitments’ specific objectives (see, for example, Commitment 1 of each Chapter).\n\n(40) In light of the above, the Commission assesses that the Code clearly sets out its specific objectives.\n\n* 3.5. Whether the Code contains commitments or measures to ensure achievement of its objectives, including key performance indicators as appropriate and reporting (Article 56(4) and (5) of the AI Act)\n\n(41) The Code’s Commitments and Measures outlined above are clearly directed to achieving their specific objectives described in their purpose-clauses and, in doing so, contribute to the Code’s Objectives A and B.\n\n(42) The Code does not contain dedicated reporting commitments or measures for the Transparency and Copyright Chapters of the Code. However, the Commission considers proactive reporting for these Chapters as currently not necessary. The obligations under Article 53(1) of the AI Act that are covered by these Chapters require documentation, policies, and summaries by providers of general-purpose AI models. As such, the Commission considers that monitoring the participants’ adherence to the related commitments by other means than proactive reporting is sufficient to ensure the achievement of the Code’s objectives. This reflects the size and capacity of providers that typically place general-purpose AI models without systemic risk on the market.\n\n(43) The Code contains dedicated reporting commitments and measures to ensure the achievement of its objectives in its Safety and Security Chapter. Different to the Transparency and Copyright Chapters, the Safety and Security Chapter necessitates proactive reporting because the covered obligations under Article 55(1) of the AI Act do not include forms of documentation, with the exception of Article 55(1), point (c). Commitment 1 of the Safety and Security Chapter on the Framework entails in its Measures 1.1 and 1.4 a list of high-level systemic-risk-related information that the participants commit to compiling and reporting to the AI Office. In addition, participants commit to reporting to the AI Office information about their model and adherence to the Safety and Security Chapter pursuant to Commitment 7.\n\n(44) The Code does not contain any key performance indicators to measure the implementation and outcome of the Code’s commitments. In line with the assessment of the independent experts that drafted the Code, the Commission considers key performance indicators as currently not appropriate to ensure the achievement of the Code’s objectives.\n\n(45) In light of the above, the Commission assesses that the Code contains commitments and measures to ensure the achievement of its objectives.\n\n(46) With a view to further strengthening the achievement of the objectives of the Code the Commission also encourages participants to expand their reporting for example by including key performance indicators, where they become appropriate to measure the implementation and outcome of the Code. Such data may also become useful in comparisons over time and across participants.\n\n### 3.6. Whether due account is taken of the needs and interests of all interested parties, including affected persons, at Union level (Article 56(4) of the AI Act)\n\n(47) The Transparency Chapter ensures that the documentation burden for providers of general-purpose AI models is proportionate, for example, by way of its clarification in recital (b) that actors who modify a given general-purpose AI model and become the provider of the modified model need only document information regarding the modification, and by way of its express references in Measure 1.2 and the Model Documentation Form to the confidentiality provisions under Article 78 and Article 53(1), point (b), of the AI Act.\n\n(48) The Copyright Chapter reflects a delicate balance with clear and workable measures for participants which they commit to putting in place as part of their copyright policy, whilst aiming to ensure that the measures are in compliance with Union law on copyright and related rights. Recital (d) of the Copyright Chapter emphasises that the commitments that require proportionality need to take due account of the size and capacity of the provider. Measure 1.3, point (b), includes the prospect of standardisation and an inclusive Union process with the participation of providers, rightsholders, and other stakeholders to generally agree on state-of-the-art, machine-readable protocols other than robot.txt. Point (3) encourages participants to engage in discussions with rightsholders and other stakeholders in the development of such protocols, while point (4) provides rightsholders with transparency into the participants’ methods to comply with rights reservations in the context of web-crawling by the providers. Given that Measure 1.4 is designed as a preventive measure, the Commission’s understanding is that the appropriate and proportionate technical safeguards aim to prevent the model from generating outputs that reproduce the training content in a copyright infringing manner, thus necessarily aiming to prevent also potential subsequent acts of communicating or making available such infringing outputs to the public in violation of Union copyright law. Finally, Measure 1.5 contains a complaint mechanism and requires a point of contact to facilitate discussion with rightsholders and to enable complaints.\n\n(49) The Safety and Security Chapter takes account of relevant actors along the value chain. For example, its Appendix 3.2 requires the model evaluations to at least match the expected use context, informed by the integrations into AI systems, and, thus, reflects the experience of final users and integrations by downstream providers in the systemic risk assessment of the participants. Relatedly, Measure 3.1 lists “the effects of models on natural persons, including vulnerable groups” as an exemplary investigation aim for collecting model-independent information. Measure 3.5 lists “collecting end-user feedback” as an exemplary post-market monitoring method to be taken into account by participants. Further, the participants commit in Measure 9.1 to facilitating the reporting of serious incidents of the model by downstream providers and final users, and, thus, contribute to the visibility of incidents that may affect downstream providers and final users to the AI Office and, as appropriate, national competent authorities. This is underscored by recital (e) that emphasises the principle of cooperation between the participants and downstream providers.\n\n(50) In light of the above, the Commission assesses that the Code takes due account of the needs and interests of all interested parties, including affected persons, at Union level.\n\n## 4. REVIEW AND ADAPTATION OF THE CODE\n\n(51) The AI Office and the Board shall regularly monitor and evaluate the achievement of the objectives of the Code and its contribution to the proper application of the Regulation pursuant to Article 56(6) of the AI Act. The AI Office shall encourage and facilitate the review and adaptation of the Code pursuant to Article 56(8) of the AI Act. In particular, the AI Office will consider facilitating formal updates to the Code at least every two years, for instance based on the emergence of standards, relevant technological developments, or changes in the risk landscape. To monitor the achievement of the objectives of the Code, the AI Office will remain in exchange with the participants to understand where implementation support is necessary and may cooperate with national competent authorities, downstream providers, rightsholders, and other actors.\n\n(52) Further, the Code leaves the Commission’s responsibility unaffected to issue guidance on the application of the AI Act, which may be of relevance for concepts in the Code. In particular, in the case of an imminent threat of large-scale irreversible harm or to address its negative effects, the AI Office will consider whether rapid guidance on the AI Act’s application, or a rapid update to the Code agreed upon by the participants, are appropriate, in addition to adequate enforcement actions. Such a situation could arise for instance in the case of a:\n\n(53) materialisation of systemic risks or large-scale incidents;\n\n(54) discovery of novel attack vectors or exploitation methods;\n\n(55) significant shift in deployment contexts creating new systemic risks; and/or\n\n(56) development of breakthrough capabilities, new risk mitigation methods, or in other important factors that fundamentally alter risk profiles.\n\n## 5. CONCLUSION\n\n(57) In light of the foregoing, the Commission concludes that the General-Purpose AI Code of Practice adequately covers the obligations provided for in Articles 53 and 55 of the AI Act and meets the aims according to Article 56 of the AI Act.\n\nDone at Brussels, 1.8.2025\n\nFor the Commission Henna Virkkunen Executive Vice-President\n\n## Related Level 1 articles\n\n- [Article 56 — Codes of practice](../../articles/56.md)\n"}