EU AI Act — General-Purpose AI (GPAI) Obligations (Art. 50-55) + GPAI Code of Practice: AI Compliance Requirements

When deploying GPAI models (ChatGPT, Claude, Gemini, Copilot, etc.) to generate content for end users, implement technical solutions to mark outputs as AI-generated (watermarking, metadata, disclosure notices). Users must be informed they are interacting with AI-generated content.

Maintain technical documentation covering: the GPAI models used in your products, their intended use cases, known limitations, testing results, and how they were evaluated for safety. Keep this documentation updated when models are changed. For deployers: maintain records of which GPAI model versions your product uses and update documentation when upgrading.

If your product deploys GPAI models trained with >10²⁵ FLOPs (GPT-4, Gemini Ultra, Claude 3 Opus-class and above): (1) Register with the EU AI Office as a systemic risk model deployer; (2) Conduct adversarial testing (red-teaming) before deployment and after major model updates; (3) Implement serious incident reporting to the EU AI Office within 72 hours of discovering a serious incident (harm to persons, critical infrastructure impact, large-scale misinformation events); (4) Implement cybersecurity measures commensurate with systemic risk. GPAI Code of Practice (final, published 2025-07-10) participation creates a rebuttable presumption of compliance, not an absolute safe harbor — and does not apply to non-signatories such as Meta.

If you train or fine-tune AI models, implement and document a policy for complying with EU copyright law, including opt-out mechanisms for rights holders under the Text and Data Mining exception (DSM Directive Article 4). Publish a summary of training data sources.

The EU AI Office published the final GPAI Code of Practice on 2025-07-10. Participation is voluntary but creates a rebuttable presumption of compliance with Art. 51-55 obligations. Key CoP requirements: (1) Model capability disclosures (model cards); (2) Safety benchmarks publication; (3) Copyright policy transparency; (4) Incident reporting procedures. As of June 2026 roughly 24 organizations had signed (Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI, Aleph Alpha, among others) — Meta explicitly declined (2025-07-18). For deployers using a NON-signatory provider (e.g. Meta), the presumption does not apply and full independent compliance documentation is needed.