TLDR: The European Union has unveiled a final voluntary Code of Practice for AI companies, complementing its pioneering AI Act. This comprehensive legislation, the world’s first, categorizes AI systems by risk, imposing strict requirements on high-risk and general-purpose AI. While industry leaders express concerns over regulatory complexity, the EU remains committed to its phased implementation, with key obligations for general-purpose AI models taking effect in August 2025 and significant fines for non-compliance.
Brussels, Belgium – The European Union continues to solidify its position as a global leader in artificial intelligence governance, with significant advancements in the implementation of its landmark AI Act. On July 10, 2025, the European Commission published the final version of a voluntary Code of Practice, designed to assist AI companies in navigating the comprehensive legal framework. This move underscores the EU’s commitment to fostering trustworthy AI while ensuring transparency, limiting copyright violations, and safeguarding public safety.
The EU AI Act, adopted in 2024 and entering into force on August 1, 2024, represents the world’s first comprehensive legal framework for AI. Its core principle is a four-tier, risk-based classification system for AI applications: unacceptable, high, limited, and minimal risk. Systems deemed ‘unacceptable risk,’ such as social scoring and real-time biometric identification for law enforcement, are outright prohibited. ‘High-risk’ systems, which include AI in critical infrastructure, education, employment, migration, and justice, are permitted but subject to stringent ex-ante compliance obligations. These include detailed requirements for risk-management systems (Article 9), data quality and governance (Article 10), and accuracy, robustness, and cybersecurity (Article 15).
A crucial aspect of the Act addresses General-Purpose AI (GPAI) models, like those developed by OpenAI, Microsoft, and Google, which can perform a wide range of tasks and form the basis for many AI systems. Rules for providers of these models, particularly those posing systemic risks, become applicable on August 2, 2025. These rules mandate transparency, the creation of technical documentation, and the disclosure of any copyrighted material used during training. Providers of GPAI models that may carry systemic risks are also required to assess and mitigate these risks.
The newly published voluntary Code of Practice, developed by 13 independent experts after consulting over 1,000 stakeholders, aims to clarify legal obligations under the AI Act. It specifically addresses transparency, copyright, and systemic risk management. AI model companies that sign on to this code are expected to benefit from lower administrative burdens and greater legal certainty. The European Commission stated that the code’s publication ‘marks an important step in making the most advanced AI models available in Europe not only innovative but also safe and transparent.’ Major AI firms, including OpenAI and Google, are currently reviewing the code.
Enforcement of the AI Act will be phased, with rules for new models starting in 2026 and for existing ones in 2027. However, some critical new rules are already in effect or imminent. Prohibitions and AI literacy obligations became applicable on February 2, 2025. The governance rules and obligations for general-purpose AI models will apply from August 2, 2025. The rules for high-risk AI systems embedded into regulated products have an extended transition period until August 2, 2027. Non-compliance with the AI Act carries significant penalties, with fines potentially reaching up to 7% of a company’s global annual revenue.
Also Read:
- Anthropic Unveils Open-Source AI Research and Code to Propel Ethical AI Development
- OSFI Unveils EDGE Principles for Responsible AI in Canadian Finance, Balancing Innovation with Robust Risk Management
Despite the EU’s determined rollout, the implementation has not been without its challenges. Over 45 leading European companies, including Airbus, ASML, Lufthansa, Mercedes-Benz, Siemens Energy, and Mistral, recently urged the European Commission to ‘stop the clock’ for at least two years on the most stringent requirements for high-risk and general-purpose AI systems. Their letter, dated July 3, cited concerns over regulatory complexity and potential threats to Europe’s competitiveness and innovation. However, the European Commission has emphatically rejected these calls to delay the August 2 effective date, reaffirming its commitment to the scheduled implementation.
