The First Draft of the General-Purpose AI Code of Practice

Please click here to download the full alert.

Following the release of the European Union’s Artificial Intelligence Act (“AI Act”) on July 12, 2024, EU institutions are taking action to ensure its effective implementation.

The European AI Office (the “AI Office”), a body within the European Commission, was created with the specific purpose of overseeing the implementation of the AI Act and promoting and facilitating the development of harmonized standards. Under Article 56 of the AI Act, the AI Office “shall encourage and facilitate the drawing up of codes of practice at Union level in order to contribute to the proper application of [the] Regulation, taking into account international approaches.” Codes drafted by the AI Office must be ready by May 2025 and will come into force on August 2, 2025.

On November 14, 2024, the AI Office released the first draft of the General-Purpose AI Code of Practice (the “Code”), providing standards for the development and deployment of general-purpose Artificial Intelligence models (“AI Models”) in the EU.

The draft Code is intended to become a central tool for AI Model providers (i.e., any operators developing, training, and offering AI Models for integration into various systems (“Providers”)) to demonstrate compliance with the AI Act. Though the Code is not legally binding, complying with it will give Providers a “presumption of conformity” with their obligations under the AI Act.

The initial draft will undergo further refinement through an iterative drafting process. Plenary sessions were scheduled for the week starting November 18, 2024, allowing stakeholders, EU Member State representatives and observers to provide feedback on the draft. The outcome of those discussions will be reflected in subsequent versions of the draft Code.

The draft Code addresses key issues such as transparency, copyright compliance, and systemic-risk mitigation of AI Models.

Transparency

Transparency is a central principle of the draft Code, reflecting the EU’s commitment to fostering trust in AI technology. The draft Code provides that Providers must maintain documentation describing key features of their AI Models, such as design specifications, acceptable use policies, license, training processes, testing and validation procedures. Such documentation must be made available upon request by the AI Office or national competent authorities, and/or provided to AI system providers intending to integrate the AI Model into their AI systems (i.e., a system encompassing multiple AI Models (“AI Systems”)).

Copyright Compliance

The draft Code places strong emphasis on complying with EU copyright laws and related rights. Key obligations for Providers include:

1. Copyright policy: Providers must implement a policy to ensure compliance with EU copyright legislation. Providers are required to conduct thorough copyright due diligence before entering contracts with third parties to use datasets for the development of AI Models.

1. Text and data mining (TDM): When engaging in TDM, Providers must ensure they have lawful access to copyright-protected content. They are also required to comply with rights reservations using state-of-the-art technologies. Providers must use crawlers that respect the Robot Exclusion Protocol (a standard used by websites to indicate, to visiting web crawlers and other web robots, which portions of the website they are allowed to visit), ensure exclusions do not negatively impact content findability and avoid crawling pirated sources. They are also encouraged to cooperate in developing rights reservation standards, i.e., practices that help ensure that the copyright is respected when content is used, such as by clearly indicating the permissions granted for use or access to the content.

1. Transparency in copyright compliance: Providers are required to be transparent about their copyright compliance measures. This includes publishing information on rights reservation compliance, offering contact information for rightsholders to lodge complaints and maintaining documentation about data sources and authorizations to access and use protected content.

Systemic Risks

The draft Code provides a comprehensive framework for managing systemic risk, imposing an obligation on Providers to assess those risks and implement appropriate technical and governance mitigation measures. The draft Code identifies six types of systemic risks associated with AI Models: (1) Cybercrimes; (2) Chemical, biological, radiological, and nuclear risks; (3) Loss of control over AI Models; (4) Automated use of models for artificial intelligence research and development; (5) Large-scale persuasion and manipulation; and (6) Large-scale discrimination of individuals, communities, or societies.

In furtherance of the principles of proportionality and accountability set forth in the AI Act, the draft Code requires that Providers document the result of their risk assessments and implement safety and security measures proportional to the seriousness of the risks they identified. Governance mitigation measures should include clear decision-making processes and independent expert assessments to oversee the development and deployment of AI Models. The draft Code also covers operational aspects, including incident reporting, whistleblower protection, and public transparency, all aimed at building trust and ensuring compliance with regulatory standards.

***

The first draft of the Code marks an important step toward establishing a clearer and more tangible regulatory framework for the development and deployment of AI Systems within the European Union.

Providers must be prepared to address the implications of ensuring transparency, copyright compliance and management of systemic risks.

With the final version of the Code set to come into force in August 2025, it is essential for companies to closely monitor regulatory developments, prepare to meet the new requirements if they qualify as Providers or understand how to choose their Providers for the integration of their models into AI Systems.