EU tries to explain how to do AI without breaking the law
(2025/07/10)
- Reference: 1752175542
- News link: https://www.theregister.co.uk/2025/07/10/eu_ai_code_of_practice/
- Source link:
The EU has a new set of AI regulations poised to take effect soon. While debate over them continues, Brussels has put out a handy guidebook to help companies make sense of what they can and cannot do.
The European Commission [1]announced the [2]publication of the General-Purpose AI Code of Practice on Wednesday with the goal of helping folks comply with [3]the AI Act . Parties subject to the Act will be able to sign on to the Code to indicate that they're in compliance, but it's purely voluntary.
Broken into three parts, the Code has two brief chapters outlining responsibilities AI companies face regarding [4]transparency and obeying [5]copyright , as well as a much longer section on [6]safety and security that the Commission noted is "relevant only to a limited number of providers of the most advanced models."
[7]
The same goes for the AI Act in general. As we've noted in our prior coverage, it puts the greatest onus for compliance on the largest, most powerful frontier AI models, and those operating in the most critical sectors or whose operations have the greatest potential for harm.
[8]
[9]
The Code's three chapters include all the things you'd expect from a typical AI regulation, like preventing the output of copyrighted content, requiring AI scraping bots to [10]obey robots.txt , and mandating risk assessments.
Beyond those basic rules, the Code also calls for companies to fill out a documentation form that details all the intricacies of a model (including [11]energy consumption data ) and keep model documentation on file for a decade for each version. It even recommends that AI companies that "also provide an online search engine" refrain from downranking pages that refuse to be ingested by the company's AI - and no, that's not targeted at [12]anyone in particular , why do you ask?
[13]
The Code's publication doesn't mean it's official yet - that'll require endorsement by the EU states and the Commission - but even then it won't mean all that much. As the EC noted, there's no push for companies to sign on if they don't want to.
That said, the Code does reflect the AI Act as its written, so they're more than just guidelines - companies ignore them at their peril.
This all assumes the AI Act's general-purpose rules enter into application on 2 August as planned. A number of European companies have [14]come out against the AI Act , calling for its delay and simplification to ensure continental AI firms would be able to compete with unnamed "AI behemoths," some of whom have [15]also called for a pause on enforcement.
[16]
The European arm of the Computer and Communications Industry Association (CCIA), a pro-tech trade association, expressed disappointment in the Code, saying it added further confusion to a set of rules that are badly in need of clarification.
As one [17]example , the CCIA says, the Code imposes rules that aren't requirements in the Act, while other requirements from the Act are missing. If it's that obviously messy, why would any company want to sign on?
[18]Meta's still violating GDPR rules with latest plan to train AI on EU user data, says noyb
[19]EU rattles its purse and AI datacenter builders come running
[20]The launch of ChatGPT polluted the world forever, like the first atomic weapons tests
[21]Sovereign-ish: Google Cloud keeps AI data in UK, but not the support
"Without meaningful improvements, signatories remain at a disadvantage compared to non-signatories, thereby undermining the Commission's competitiveness and simplification agenda," said Boniface de Champris, a senior policy manager at CCIA Europe.
Others are urging the EU not to bow to corporate pressure. A group of academics, watchdog groups, and privacy advocates signed an [22]open letter to the Commission urging it not to delay enforcement, as doing so would call into question Europe's dedication to its own principles of "putting consumer and fundamental rights at the center of all legislation."
"We call upon the Commission to prioritise the full implementation and proper enforcement of the AI Act instead of re-opening or delaying its implementation," the open letter pleaded.
Whichever way the Commission swings on AI Act enforcement, it'll still take some time for punishments to be meted out: While the AI Act applies as of next month, the Commission won't have enforcement power for some time. According to the EC, "new models" released on or after August 2, 2025, will have one year to get fully compliant, while older models get two years. A lot could change between now and then. ®
Get our [23]Tech Resources
[1] https://ec.europa.eu/commission/presscorner/detail/en/ip_25_1787
[2] https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai
[3] https://www.theregister.com/2024/05/21/prepare_your_audits_eu_commission/
[4] https://ec.europa.eu/newsroom/dae/redirection/document/118120
[5] https://ec.europa.eu/newsroom/dae/redirection/document/118115
[6] https://ec.europa.eu/newsroom/dae/redirection/document/118119
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aHA3-24bkI_utOSim0xD2QAAAAM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aHA3-24bkI_utOSim0xD2QAAAAM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aHA3-24bkI_utOSim0xD2QAAAAM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2025/04/09/ietf_ai_preferences_working_group/
[11] https://www.theregister.com/2025/05/21/ai_energy_consumption_loose_estimates/
[12] https://www.reuters.com/legal/litigation/googles-ai-overviews-hit-by-eu-antitrust-complaint-independent-publishers-2025-07-04/
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aHA3-24bkI_utOSim0xD2QAAAAM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[14] https://www.theregister.com/2025/07/04/eu_businesses_push_for_freedom/
[15] https://www.reuters.com/business/media-telecom/will-eu-delay-enforcing-its-ai-act-2025-07-03/
[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aHA3-24bkI_utOSim0xD2QAAAAM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[17] https://ccianet.org/news/2025/07/ai-act-eus-final-gpai-code-imposes-disproportionate-burden-improvements-required/
[18] https://www.theregister.com/2025/05/14/metas_still_violating_gdpr_rules/
[19] https://www.theregister.com/2025/07/01/eu_shakes_its_purse_and/
[20] https://www.theregister.com/2025/06/15/ai_model_collapse_pollution/
[21] https://www.theregister.com/2025/07/10/google_uk_data_sovereignty/
[22] https://edri.org/our-work/open-letter-european-commission-must-champion-the-ai-act-amidst-simplification-pressure/
[23] https://whitepapers.theregister.com/
The European Commission [1]announced the [2]publication of the General-Purpose AI Code of Practice on Wednesday with the goal of helping folks comply with [3]the AI Act . Parties subject to the Act will be able to sign on to the Code to indicate that they're in compliance, but it's purely voluntary.
Broken into three parts, the Code has two brief chapters outlining responsibilities AI companies face regarding [4]transparency and obeying [5]copyright , as well as a much longer section on [6]safety and security that the Commission noted is "relevant only to a limited number of providers of the most advanced models."
[7]
The same goes for the AI Act in general. As we've noted in our prior coverage, it puts the greatest onus for compliance on the largest, most powerful frontier AI models, and those operating in the most critical sectors or whose operations have the greatest potential for harm.
[8]
[9]
The Code's three chapters include all the things you'd expect from a typical AI regulation, like preventing the output of copyrighted content, requiring AI scraping bots to [10]obey robots.txt , and mandating risk assessments.
Beyond those basic rules, the Code also calls for companies to fill out a documentation form that details all the intricacies of a model (including [11]energy consumption data ) and keep model documentation on file for a decade for each version. It even recommends that AI companies that "also provide an online search engine" refrain from downranking pages that refuse to be ingested by the company's AI - and no, that's not targeted at [12]anyone in particular , why do you ask?
[13]
The Code's publication doesn't mean it's official yet - that'll require endorsement by the EU states and the Commission - but even then it won't mean all that much. As the EC noted, there's no push for companies to sign on if they don't want to.
That said, the Code does reflect the AI Act as its written, so they're more than just guidelines - companies ignore them at their peril.
This all assumes the AI Act's general-purpose rules enter into application on 2 August as planned. A number of European companies have [14]come out against the AI Act , calling for its delay and simplification to ensure continental AI firms would be able to compete with unnamed "AI behemoths," some of whom have [15]also called for a pause on enforcement.
[16]
The European arm of the Computer and Communications Industry Association (CCIA), a pro-tech trade association, expressed disappointment in the Code, saying it added further confusion to a set of rules that are badly in need of clarification.
As one [17]example , the CCIA says, the Code imposes rules that aren't requirements in the Act, while other requirements from the Act are missing. If it's that obviously messy, why would any company want to sign on?
[18]Meta's still violating GDPR rules with latest plan to train AI on EU user data, says noyb
[19]EU rattles its purse and AI datacenter builders come running
[20]The launch of ChatGPT polluted the world forever, like the first atomic weapons tests
[21]Sovereign-ish: Google Cloud keeps AI data in UK, but not the support
"Without meaningful improvements, signatories remain at a disadvantage compared to non-signatories, thereby undermining the Commission's competitiveness and simplification agenda," said Boniface de Champris, a senior policy manager at CCIA Europe.
Others are urging the EU not to bow to corporate pressure. A group of academics, watchdog groups, and privacy advocates signed an [22]open letter to the Commission urging it not to delay enforcement, as doing so would call into question Europe's dedication to its own principles of "putting consumer and fundamental rights at the center of all legislation."
"We call upon the Commission to prioritise the full implementation and proper enforcement of the AI Act instead of re-opening or delaying its implementation," the open letter pleaded.
Whichever way the Commission swings on AI Act enforcement, it'll still take some time for punishments to be meted out: While the AI Act applies as of next month, the Commission won't have enforcement power for some time. According to the EC, "new models" released on or after August 2, 2025, will have one year to get fully compliant, while older models get two years. A lot could change between now and then. ®
Get our [23]Tech Resources
[1] https://ec.europa.eu/commission/presscorner/detail/en/ip_25_1787
[2] https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai
[3] https://www.theregister.com/2024/05/21/prepare_your_audits_eu_commission/
[4] https://ec.europa.eu/newsroom/dae/redirection/document/118120
[5] https://ec.europa.eu/newsroom/dae/redirection/document/118115
[6] https://ec.europa.eu/newsroom/dae/redirection/document/118119
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aHA3-24bkI_utOSim0xD2QAAAAM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aHA3-24bkI_utOSim0xD2QAAAAM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aHA3-24bkI_utOSim0xD2QAAAAM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2025/04/09/ietf_ai_preferences_working_group/
[11] https://www.theregister.com/2025/05/21/ai_energy_consumption_loose_estimates/
[12] https://www.reuters.com/legal/litigation/googles-ai-overviews-hit-by-eu-antitrust-complaint-independent-publishers-2025-07-04/
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aHA3-24bkI_utOSim0xD2QAAAAM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[14] https://www.theregister.com/2025/07/04/eu_businesses_push_for_freedom/
[15] https://www.reuters.com/business/media-telecom/will-eu-delay-enforcing-its-ai-act-2025-07-03/
[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aHA3-24bkI_utOSim0xD2QAAAAM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[17] https://ccianet.org/news/2025/07/ai-act-eus-final-gpai-code-imposes-disproportionate-burden-improvements-required/
[18] https://www.theregister.com/2025/05/14/metas_still_violating_gdpr_rules/
[19] https://www.theregister.com/2025/07/01/eu_shakes_its_purse_and/
[20] https://www.theregister.com/2025/06/15/ai_model_collapse_pollution/
[21] https://www.theregister.com/2025/07/10/google_uk_data_sovereignty/
[22] https://edri.org/our-work/open-letter-european-commission-must-champion-the-ai-act-amidst-simplification-pressure/
[23] https://whitepapers.theregister.com/
Re: "but it's purely voluntary."...
Yet Another Anonymous coward
Except all the consultancies that will offer you an AI tool that monitors your compliance with the AI rules
At last - my topic ;)
bridgebuilder
Chair of CEN-CENELEC JTC21 here, the (admittedly arcanely named) standardisation committee that has the mandate from the European Commission to create the so-called "harmonised standards" for the AI Act.
Adding to the article:
- The AI Act was originally designed in the pre-chatgpt era and mostly sets the rules for AI *products*. The most interesting category here are AI products (or systems) for high-risk applications. These incur the more onerous requirements laid down in articles 8 to 15.
- Having said that, these articles are fairly high level, e.g. they might require human oversight without specifying what that exactly means and how to go about it. An officially acceptable (but not compulsory!) implementation path is described in a set of "harmonised" standards. Whoever follows these standards is automatically deemed to be compliant with the AI Act requirements, hence it will be the preferred method for most organisations. This is what we are developing in JTC21.
- Requirements specifically for foundation models (NOT products!) were bolted onto the draft AI Act only during the final rounds of negotiations in 2023. They work differently, and given that there was no time to develop standards for these requirements, the Code of Practice was created in a more tightly managed dialogue, with the EU in the driving seat rather than a standardisation body. It is possible (but not yet decided) that the Code of Practice will be replaced by an additional set of harmonised standards a few years down the line.
Take this as the opening salvo for an AMA around European AI standardisation ;)
"but it's purely voluntary."...
So every US based company that's peddling their so-called 'A.I.' will just wipe their arse with it...