Article content
In briefShow moreShow lessThe EU published the General-Purpose AI Code of Practice as a voluntary route for demonstrating compliance with transparency, copyright and systemic-risk duties.
- The EU published the General-Purpose AI Code of Practice as a voluntary route for demonstrating compliance with transparency, copyright and systemic-risk duties.
- Signing the Code does not replace legal duties, but can structure evidence.
- EU implementation support, not binding Norwegian law. It is operationally relevant to Norwegian providers serving the EU and to future Norwegian implementation.
What happened
The EU published the General-Purpose AI Code of Practice as a voluntary route for demonstrating compliance with transparency, copyright and systemic-risk duties. Independent experts drafted it through a process facilitated by the AI Office.
Signing the Code does not replace legal duties, but can structure evidence. Customers can use adherence, transparency and risk reporting in supplier due diligence without treating the Code as a guarantee.
Legal status in Norway
EU implementation support, not binding Norwegian law. It is operationally relevant to Norwegian providers serving the EU and to future Norwegian implementation.
What the sources clarify
The Code was divided according to the underlying obligations. Its transparency section supported technical documentation and information for providers building on a model. The copyright section addressed policies for complying with EU law and publication of a training-content summary. For models with systemic risk, the work covered risk assessment, incident reporting and security. Supplier due diligence should therefore ask which sections the provider signed, which model version the declaration covers and what evidence accompanies it. Participation is useful information, but it is not certification of the customer's particular system or use.
A signed Code section should be recorded with model name, version, date and a link to the provider declaration. The customer should then verify whether documentation covers its use and whether later updates remain within that declaration. Contracts should provide change notices and relevant incident information; the Code does not remove the customer's duty to assess the resulting system.
Practical implications
When selecting a model, the buyer should compare the Code declaration with technical documentation and the actual service. Version, training-summary or incident-channel discrepancies must be resolved before use. Later withdrawal or alteration of the provider's commitment should trigger contractual notice and reassessment.
Sources
European Commission: “General-Purpose AI Code of Practice,” 10 July 2025.
European Commission: “General-purpose AI models: AI Act questions and answers,” 10 July 2025.
For discussion
Which supplier do we need more evidence from?
