The European Commission has received the final code of conduct for general-purpose AI models, setting the stage for the EU AI Regulation rollout in August 2025. The new code, which is voluntary, aims to help providers meet the upcoming legal requirements.
The code was developed by 13 independent experts and incorporates feedback from more than 1,000 stakeholders, including model developers, small and medium-sized businesses, academics, AI safety specialists, rights holders, and civil society organizations.
The code is split into three main chapters. The transparency and copyright sections apply to all general-purpose AI providers, while safety and security is aimed at developers working on the most advanced models.
The transparency chapter introduces a “Model Documentation Form,” which vendors use to provide details about model architecture, design, training methods, data sources, and energy consumption. This documentation must be available to both downstream providers and the EU AI Office on request.
The copyright section lays out practical steps for following EU copyright law. Providers must honor the Robot Exclusion Protocol (robots.txt) when crawling the web and respect rights reservations. Technical safeguards are required to prevent models from generating copyright-infringing content—a particular challenge for image generators like Midjourney. Providers also need to appoint contacts for rights holders and set up a complaints process.
The safety and security chapter, which runs 40 pages, focuses on managing systemic risks. Providers are expected to create a “Safety and Security Framework,” continuously assess risks, and put security measures in place. The chapter also requires serious incidents to be reported to the EU AI Office within set deadlines and includes specific requirements for cybersecurity and model theft prevention.
Reduced red tape for signatories
Providers who sign the code can use it to show compliance with the EU AI Regulation, which means less paperwork and greater legal certainty compared to those who choose other ways to comply.
The code will be supplemented by official Commission guidelines clarifying who is covered by the rules. These guidelines will be published before the obligations take effect. Once the code is endorsed by EU Member States and the Commission, providers can sign on and use it to demonstrate compliance.
The code is intended to turn some of the EU AI Act’s more abstract requirements, which became law in February, into practical recommendations. Additional rules for large AI models will take effect in August. The Commission’s AI Office will be able to enforce these rules a year later for new models and two years later for existing ones.
