The code of practice for general-purpose AI models — who it really applies to

What the code contains

The code covers three areas: transparency (information about the model and its documentation), copyright (a policy of respecting creators’ rights when training models), and safety and security, which concern the most capable models. Some providers, including OpenAI and Mistral, announced in July 2025 that they would sign up to the code; Meta declined to sign.

Who it applies to and from when

• Providers of general-purpose AI models: the AI Act obligations have applied since 2 August 2025; providers of models placed on the market before that date have until 2 August 2027.
• Companies using tools built on these models: the code does not bind them. Their obligations follow from their role as deployers: supporting the development of AI literacy of their staff (Art. 4) and the transparency obligations of Art. 50, which apply from 2 August 2026.

What this means for a construction or industrial company

The code gives a user company better questions to ask its provider. It is worth asking whether the model provider has signed up to the code or demonstrates compliance in another way, what information it makes available about the model’s limitations, where the company’s data is processed and how the provider treats copyright-protected content. The answers affect the choice of tool and the rules for working with data in the company.

For the board, what matters more than the code itself is whether the company has a description of its processes that is not tied to one provider. Then changing the model, when its legal status or price changes, does not mean losing all the work done. This is how semantic transformation works: organising a company’s names, processes and data so that people, language models and board reports understand them the same way.

What has changed since first publication

• We clarified that the code concerns providers of general-purpose AI models, not every company that uses AI.
• We removed claims about a “reduced risk of penalties” and about companies that do not sign up being “pushed to the margins”; they had no basis in the rules that apply to users.
• We removed the naming of specific institutions as the national supervisory authority; the competent authorities are set by national legislation, which is worth checking in its current wording.
• We added the obligations of user companies after the amendment of the AI Act by Regulation (EU) 2026/1744 (the AI Omnibus): Art. 4 in its new wording and Art. 50.