The morning read on Europe's digital policy Friday 30 October 2026
Search

GPAI Code of Practice signatories: who signed it and what it requires

As of October 2026, the European Commission lists 22 signatories of the General-Purpose AI (GPAI) Code of Practice, among them Amazon, Anthropic, Google, IBM, Microsoft, OpenAI, Mistral AI and Aleph Alpha. xAI has signed only the Safety and Security chapter, and Meta has refused to sign. The code is a voluntary tool that helps developers of general-purpose AI models show they meet the AI Act's rules on transparency, copyright and, for the most capable models, safety and security.

The obligations themselves come from the AI Act, not from the code. Article 53 binds every provider placing a general-purpose AI model on the EU market, and Article 55 adds duties for models with systemic risk, whether or not the provider signs.

Who signed the GPAI Code of Practice

The Commission's signatory page, last updated on 7 October 2026, names these providers:

  • AI Studio Delta
  • Aleph Alpha
  • Almawave
  • Amazon
  • Anthropic
  • Black Forest Labs
  • Bria AI
  • Cohere
  • Domyn
  • Dweve
  • Fastweb
  • Google
  • IBM
  • LINAGORA
  • Microsoft
  • Mistral AI
  • Open Hippo
  • OpenAI
  • Pleias
  • Reflection AI
  • ServiceNow
  • WRITER

In addition, xAI signed only the Safety and Security chapter, so it must show by other adequate means that it meets the AI Act's transparency and copyright obligations, the Commission says. The list does not show which chapters the other companies follow; for providers that neither develop nor plan models with systemic risk, the Safety and Security chapter is optional.

The list changes over time. Its first version, published on 1 August 2025, named 26 organisations besides xAI. Black Forest Labs, LINAGORA, Reflection AI and AI Studio Delta have since been added, while eight names from the first list, including Accexible, Lawise and Virtuo Turing, no longer appear. The signatory page gives no reasons for these changes and notes that new signatures may take time to show up.

Who has not signed

Meta is the best-known refusal. On 18 July 2025 its chief global affairs officer, Joel Kaplan, wrote on LinkedIn that "Europe is heading down the wrong path on AI", arguing that the code created legal uncertainty for model developers and included measures going far beyond the scope of the AI Act, CNBC reported. As of October 2026, Meta is still absent from the Commission's list.

None of the large Chinese developers, such as Alibaba, Baidu or DeepSeek, appears on the list either. Staying out exempts no one: the AI Act's rules apply to any provider placing a general-purpose AI model on the EU market, wherever it is based.

What the code requires: the three chapters

The code has three separately written chapters. The first two apply to all providers of general-purpose AI models; the third concerns only models with systemic risk.

1. Transparency

The Transparency chapter covers the documentation duties in Article 53(1)(a) and (b). Signatories commit to:

  • document each model, for example with the chapter's Model Documentation Form, keep it up to date and retain earlier versions for 10 years after the model is placed on the market;
  • publish contact details that the AI Office and downstream providers can use to request information;
  • give downstream providers the documentation meant for them and answer additional requests within 14 days, save in exceptional circumstances;
  • supply information to the AI Office on request, within the period it sets.

Models released under a free and open-source licence with public weights are exempt from these measures unless they pose systemic risk.

2. Copyright

The Copyright chapter spells out the duty to have a policy for complying with EU copyright law. Signatories commit to:

  • keep a written copyright policy and assign internal responsibility for it;
  • crawl only lawfully accessible content, without bypassing paywalls, and skip websites that EU or EEA courts or authorities have recognised as persistently infringing copyright on a commercial scale;
  • follow robots.txt instructions and other machine-readable opt-outs from text and data mining, and publish information about their crawlers;
  • use technical safeguards against outputs that reproduce protected training content in an infringing way, and ban infringing uses in their terms;
  • offer a point of contact and a complaints mechanism for rightsholders.

3. Safety and Security

Under Article 51 of the AI Act, a model is presumed to have systemic risk if more than 10^25 floating-point operations (FLOP) were used to train it; the Commission can also designate models below that level. Under the Safety and Security chapter, signatories with such models commit to:

  • adopt a Safety and Security Framework and give the AI Office access to it, and to each update, within five business days of confirming it;
  • carry out a full systemic risk assessment at least before placing a model on the market, always covering four specified risks: chemical, biological, radiological and nuclear threats, loss of control, cyber offence and harmful manipulation;
  • bring in qualified independent external evaluators, unless the model is shown to be as safe as a reference model or no qualified evaluator can be found;
  • give the AI Office a Safety and Security Model Report, as a rule by the time the model goes on the market;
  • report serious incidents, with initial reports due two to 15 days after learning of the model's involvement, depending on the type of incident;
  • protect the model and its infrastructure against theft, leaks and unauthorised access.

One duty sits outside the code: every provider must publish a summary of the content used to train its model, using a Commission template released on 24 July 2025. The Commission's guidelines of 18 July 2025 explain which models and companies are in scope.

What signing changes, and what happens without a signature

The Commission says the code adds no new legal obligations and gives no presumption of conformity. Its Q&As on signing the code and on general-purpose AI models describe it as a simpler route to showing compliance:

  • for signatories, the Commission focuses its enforcement on monitoring their adherence to the code;
  • commitments made under the code may count as a mitigating factor when a fine is set;
  • a provider that opts out of a chapter loses that benefit for the obligations the chapter covers.

Providers that do not sign, such as Meta, must demonstrate compliance by other adequate means and report the measures they use to the AI Office, for example through a gap analysis against the code. The Commission says they may also receive more requests for information and for access to evaluate their models.

The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, changed how the Act treats codes of practice for general-purpose AI: the Commission assesses whether a code adequately covers the obligations in Articles 53 and 55 and publishes that assessment. The Omnibus did not change those obligations; it mainly strengthens the AI Office's enforcement powers.

Key dates and enforcement

  • 10 July 2025: final code published.
  • 1 August 2025: the Commission and the AI Board of member states confirm the code as adequate; first signatory list published.
  • 2 August 2025: obligations for providers of general-purpose AI models start to apply.
  • 2 August 2026: the Commission can enforce those obligations with fines of up to 3% of annual worldwide turnover or EUR 15 million, whichever is higher.
  • 2 August 2027: deadline for models placed on the market before 2 August 2025 to comply.

During the first year, the AI Office said it would treat signatories that had not yet implemented every commitment as acting in good faith, and that from 2 August 2026 it would enforce full compliance with fines. The AI Office can request information, evaluate models and require measures such as risk mitigation or a recall from the market. Its procedures for model evaluations and fine proceedings are set out in Implementing Regulation (EU) 2026/1755, in force since 10 August 2026. For other deadlines, see our EU AI Act timeline.

How to sign, and how the code will change

Any current or future provider of a general-purpose AI model can sign by returning the Commission's signatory form, signed by a person authorised to bind the company. There is no deadline, and a signatory may withdraw at any time.

Signatories have set up a Signatory Taskforce, chaired by the AI Office, which met four times between January and July 2026. The AI Office has said it will review the code at least every two years; signatories would be invited to sign any updated text.

The GPAI code is separate from the code of practice on transparency of AI-generated content, which supports the marking and labelling duties in Article 50 of the AI Act. More analysis is in our AI Act section and wider Policy coverage.

Frequently asked questions

Who has signed the EU's GPAI Code of Practice?

As of October 2026, the Commission lists 22 signatories, including Amazon, Anthropic, Google, IBM, Microsoft, OpenAI, Mistral AI, Aleph Alpha, Cohere and Black Forest Labs. xAI has signed only the Safety and Security chapter.

Why did Meta refuse to sign the AI code of practice?

In July 2025 Meta said the code created legal uncertainty for model developers and went beyond the scope of the AI Act. It must still comply with the AI Act's rules for general-purpose AI models and prove it by other means.

Is the GPAI Code of Practice mandatory?

No. Signing is voluntary, but the obligations the code describes, in Articles 53 and 55 of the AI Act, are binding on providers that place general-purpose AI models on the EU market.

What happens if an AI company does not sign the code?

It must prove compliance by other adequate means, for example with a gap analysis against the code, and may face more requests for information and model evaluations from the AI Office.

When can the EU fine general-purpose AI providers?

The Commission's power to fine providers applies from 2 August 2026, with fines of up to 3% of worldwide annual turnover or EUR 15 million, whichever is higher. Models already on the market before 2 August 2025 have until 2 August 2027 to comply.