On July 10, 2025, the European AI Office released the final draft of the Code of Practice for general-purpose AI (GPAI) models. CDT Europe has responded positively to the inclusion of fundamental rights risks in the systemic risk taxonomy within this new Code. This marks a change from previous versions that did not adequately address these risks, despite extensive feedback and warnings from civil society.
The updated Code now mandates that providers of GPAI models with systemic risk consider safety, public security, health, fundamental rights, and societal risks at a high level as part of their risk management approach. However, while identifying these risks is compulsory, assessing them remains at the discretion of providers.
Laura Lazaro Cabrera, Counsel and Programme Director for Equity and Data, commented on this aspect: “The reality is that the two-tier approach remains: there is a clear distinction between mandatory and non-mandatory risks to assess, and the open-ended identification of risks still relies on the good faith and good will of providers. For these risks, whether they are assessed or omitted from consideration altogether will be the providers’ decision to make.”
She further emphasized that “the incentive for providers to robustly identify these risks will only be as strong as the AI Office’s commitment to enforce a comprehensive, good-faith approach.”
The final version also lessens the obligation on providers to engage with external stakeholders meaningfully. Although mandatory external assessments are still required, obligations to involve external experts, civil society, and downstream actors have been reduced to a general principle of cooperation.
Despite these changes, CDT Europe recognizes the Code as an ambitious initial step in GPAI model governance. They stress that it represents just the start of regulatory discussions in Europe. The potential impact of the Code depends on ongoing multistakeholder dialogue and sharing best practices to ensure effective risk assessments and mitigations for societal impacts.
CDT Europe expressed its willingness to participate in future solution-oriented efforts: “The Code of Practice is a first-of-its-kind, ambitious step forward in the governance of GPAI models... We look forward to contributing to such solution-oriented efforts.”