With the majority of obligations for general-purpose AI (GPAI) models set to take effect on 2 August 2025 (AI Act, Chapter V, Art. 53), the European Commission has published the long-awaited GPAI Code of Practice on 10 July 2025. The document—developed by independent experts—serves as voluntary guidance to help GPAI providers prepare for compliance under the EU AI Act. It focuses on three key areas: Copyright, Transparency, and Safety & Security.

The definition of systemic risk in Article 3(65) of the EU AI Act presents challenges of interpretation due to potential ambiguities. This working paper analyses these ambiguities and how the GPAI Code of Practice attempts to categorise these risks through a taxonomy. A key concern is the potential for exploitation of these systemic risk definitions by GPAI model providers.

The EU is actively engaged in the process of shaping AI regulation, with the General-Purpose AI Code of Practice (GPAI CoP) playing a crucial role in complementing the EU AI Act. However, the development of this code is encountering certain challenges. Discover how this “living framework” aims to evolve with the rapidly changing AI landscape and why the AI Office’s upcoming decisions are critical.