The fourth and final version of the EU’s General Purpose AI Code of Practice (the GPAI Code) that was due to be published on 2 May has been delayed. The European AI Office is facilitating the drawing-up of the GPAI Code, chaired by independent experts, involving nearly 1000 stakeholders, as well as EU Member States representatives, European and international observers. No official statement has been issued on the reason(s) for delay however it is assumed that it is to allow for additional time for stakeholder (including the major GPAI model providers) consultation. The delay would further extend the response time for the EU Commission’s separate and ongoing consultation on its proposed draft GPAI guidelines (open until 22 May), which also seek to clarify certain aspects of GPAI model providers’ obligations under the EU AI Act. Most observers tracking the progress of this and other AI related updates around the EU AI Act would certainly point to the tensions between industry factions, regulations and international pressures as being instrumental in the delay. 

The GPAI Code

The GPAI Code is a voluntary code, primarily designed to assist providers with compliance with the AI Act and it serves to address concerns that “some of these (GPAI) models could carry systemic risks if they are very capable or widely used. To ensure safe and trustworthy AI, the AI Act puts in place rules for providers of such models. This includes transparency and copyright-related rules. For models that may carry systemic risks, providers should assess and mitigate these risks.” The AI Act rules on GPAI will become effective in August 2025, and the GPAI Code is now expected at a similar time. 

Overall, the GPAI Code has three sections. The first two, Transparency and Copyright, apply to all GPAI model providers. The third, Safety and Security, only applies to providers of GPAI models with systemic risk (above the 10^25 threshold), currently a very small group of 5-15 companies worldwide. For each section, the GPAI Code lays down certain commitments and corresponding measures for how providers can adhere to the commitments. Its goals include:

• Transparency: Clarifying training data sources and model capabilities
• Copyright Compliance: Respecting opt-out mechanisms for protected content
• Systemic Risk Mitigation: Introducing safeguards for large-scale, high-impact models

What next?

Though the GPAI Code remains unpublished, the AI Act’s implementation course remains unchanged. By August 2, 2025, the following obligations become legally binding for GPAI providers:

• Submission of technical documentation
• Ensuring explainability of outputs
• Providing evidence of copyright protections

The European AI Office will coordinate enforcement, with EU Member States under an obligation to designate national supervisory authorities by August to ensure localised compliance and initiate penalties where appropriate. Further, the EU AI Act remains on track for broader implementation over the coming years:

• August 2026: Obligations for high-risk AI systems in employment, healthcare, law enforcement, and critical infrastructure take effect. These systems will require conformity assessments and risk management documentation.
• August 2027: All remaining provisions of the AI Act will apply, including those affecting AI embedded in regulated products like medical devices and industrial control systems.
• August 2030: Final compliance deadline for legacy AI systems used by public authorities.

Consensus on the key issues addressed in the GPAI Code such as copyright is going to be tricky to reach given the fundamental tensions that exist between diametrically opposed stakeholders and international players in this ever-evolving space and it may be that intervention via an implementing act is required eventually. We continue to monitor and report developments and look forward to the materialisation of the GPAI Code.