GPAI Code of Practice (Safety and Security)

What it is

General-Purpose AI Code of Practice: Safety and Security Chapter

Voluntary for providers of general purpose SI models with systemic risk; the Commission and AI Board treat it as an adequate tool for showing AI Act compliance, and signatories include Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI and OpenAI, with xAI signing only this chapter and Meta not signing.

What it requires

• Adopt a Safety and Security Framework and notify it to the AI Office
• Identify and analyze systemic risks, including CBRN, loss of control, cyber offense and harmful manipulation
• Set measurable risk acceptance criteria and proceed only when all risks are acceptable
• Use independent external evaluators, with limited exemptions
• Track and report serious incidents and file a Safety and Security Model Report
• Secure the model and maintain whistleblower protections and a healthy risk culture

Penalties

No penalties: this measure has no binding enforcement.

Status

Voluntary or guidance As of November 8, 2026, per the Control Map page for European Union. Statuses follow the Control Map method: in force means binding and applying now; passed means enacted but not yet applying; voluntary covers guidance and pledges; proposed means formally introduced; stalled means withdrawn, paused or dead.

Sources

1. The General-Purpose AI Code of Practice European Commission · Oct 7, 2026
2. Signing the General-Purpose AI Code of Practice: FAQ European Commission
3. General-Purpose AI Code of Practice Wikipedia