What happened. Under Article 113 of the AI Act, Chapter V on general-purpose AI (GPAI) models, the governance chapter and the penalty rules became applicable on 2 August 2025. Providers must keep technical documentation, give downstream providers the information they need, adopt a policy to comply with EU copyright law and publish a sufficiently detailed summary of the content used for training (Article 53). Providers of models with systemic risk, presumed where training compute exceeds 10^25 floating-point operations, must also evaluate and adversarially test their models, assess and mitigate systemic risks, report serious incidents and ensure cybersecurity (Article 55).
The Code of Practice. The final Code of Practice, drafted by independent chairs with a large group of stakeholders, was published on 10 July 2025 in three chapters: transparency, copyright, and safety and security. Signing is voluntary; adherence is a way to demonstrate compliance with Articles 53 and 55, not conclusive proof of it. According to Euronews, some 26 companies were on the Commission's list of signatories at the start of August 2025, including Amazon, Google, IBM, Microsoft, OpenAI, Mistral AI and Aleph Alpha; Anthropic had announced on 21 July that it would sign. Meta said it would not sign, claiming that the Code restricts innovation; xAI signed only the safety and security chapter, and must show compliance with the transparency and copyright duties by other means.
Timing and enforcement. The Commission's powers to fine GPAI providers apply from 2 August 2026, a year after the obligations. Models placed on the market before 2 August 2025 have until 2 August 2027 to comply. The 2026 Digital Omnibus postponed the high-risk rules but left these dates unchanged.
Why it matters for governance. The GPAI chapter is a test of co-regulation: public law sets outcomes, while a negotiated code supplies the detail. Critics on one side see the code as regulatory overreach drafted before the evidence base exists; critics on the other see voluntary signature and self-assessment as weak tools for the most capable systems. Public administrations that deploy chatbots and drafting assistants on top of these models depend on upstream documentation they cannot produce themselves.
What to watch. The AI Office's first information requests and enforcement actions after August 2026; whether non-signatories face closer scrutiny; and how useful the published training-data summaries prove to rights-holders and researchers.