The fact that AI models can cause problems was already recognized by the EU in its AI regulation – the Artificial Intelligence Act.
However, the Commission, the European Parliament and the Member States have largely left how to address these problems to developers and development organisations: the education, The tests and evaluation should be documented and risks should be adequately addressed.
What exactly are these and how should they be addressed? The first bill was deemed unsuitable for all of the above due to the variety of models and numerous problems.
Codes of conduct or comparable standards were needed from the providers of such models that should contain the biggest concerns about AI models. So after six months of intensive discussions, the central “Code of Practice” was presented with a few weeks’ delay.
The code of conduct ( General-Purpose AI -GPAI- Code of Practice ) is divided into three areas: Transparency, Intellectual Property and, as a third part, Security and Safeguards.
In a Word document with multiple-choice and free-text answer fields, providers should explain in a simple way how, when, and with what methods, they used datasets and resources to build their models.
This documentation will be a mandatory requirement for operating AI models in the EU from the second half of August 2025.
In the area of copyright, for example, there are certain commitments that AI model operators will have to meet before they can submit a Word with their signature. This includes not scanning piracy websites for training or considering rights restrictions in accordance with the guidelines of the Digital Services Act (DSA ). This includes preventing the appearance of infringing results to the extent possible.
The most difficult part in the implementation, however, concerns the mitigation of the corresponding systemic risks that depend on the model, its training data, capabilities and limitations, as required by Article 55 of the AI Regulation.
The Code of Ethics should now provide specific guidance on what kinds of risks could exist and how they can be professionally addressed.
The range is huge, as you can imagine: from artificially created nude images or pornography based on photos of real people to threats to national security, biased content, inaccurate health advice, radicalization chatbots, and anything we haven't thought of until now.
The use of models for the development of NBC weapons (from nuclear, biological, chemical) or digital attack tools are also scenarios that need to be considered. The Code of Practice primarily offers a reference model to address this issue.
Insufficiency and ashes in the eyes...
The new Code of Practice is not binding on any individual provider. At the same time, it does not effectively protect any signatory provider from being prosecuted one day if the measures are found to be inadequate. The Code of Practice, which was developed by independent scientists on behalf of the EU Commission and in an extensive participatory process, will continue to be the subject of intense debate.
More details
Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.
