Article 56: Codes of Practice for GPAI Models

Codes of practice are voluntary frameworks facilitated by the AI Office that translate the abstract obligations in Articles 53 and 55 into concrete, actionable measures. They are:

• Not binding law — but adherence creates a practical compliance presumption
• Developed through multi-stakeholder process — GPAI providers, downstream providers, civil society, academia
• Published by the AI Office — with periodic review
• Interim — they fill the gap until harmonised standards are adopted by European standardisation organisations

The hierarchy is: harmonised standards (strongest presumption) > common specifications (Commission implementing acts) > codes of practice (soft-law safe harbour).

Article 56 requires that codes provide sufficient detail for providers to comply with:

For all GPAI providers (Article 53): - Technical documentation (Annex XI) - Information to downstream providers (Annex XII) - Copyright policy and text-and-data-mining compliance - Summary of training content

For systemic-risk providers (Article 55): - Model evaluation and adversarial testing - Systemic risk assessment and mitigation - Serious incident tracking and reporting - Cybersecurity protection

Codes may also include processes, tools, and metrics that demonstrate compliance without revealing trade secrets.

Not adhering to a code of practice is not an infringement in itself. However:

1. The burden of proof shifts: you must demonstrate alternative adequate means of compliance to the AI Office 2. In enforcement proceedings, the AI Office may compare your practices against the code as a benchmark 3. Notified bodies, deployers, and regulators may expect code adherence as market practice

In practice, following a code is the path of least resistance unless you have genuinely superior compliance measures.

• Article 53 — Baseline GPAI obligations that codes help demonstrate compliance with.
• Article 55 — Systemic-risk obligations that codes also cover.
• Article 40 — Harmonised standards (stronger compliance presumption, when adopted).
• Article 41 — Common specifications (Commission implementing acts, intermediate tier).
• Article 64 — AI Office investigation powers that may assess code adherence.
• Article 101 — GPAI fines — code adherence is relevant mitigation evidence.
• Annex XI — Technical documentation requirements covered by codes.
• Annex XII — Transparency information covered by codes.

The recitals in the same consolidated AI Act on EUR-Lex contextualise the co-regulatory approach, the multi-stakeholder process, and the transitional role of codes pending harmonised standards. Use the official preamble on EUR-Lex.