POSITION | DIGITALISATION AND INNOVATION | INDUSTRIAL AI
Risks to Europe’s Competitiveness within the General Purpose AI Code of Practice (CoP)
27 March 2025
General Remarks
The AI Act aims to provide companies in Europe with a comprehensible and practical foundation for the use of AI in their processes. The General Purpose AI Code of Practice (CoP) strives to establish basic guidelines for providers of general-purpose AI when placing their products on the market under the AI Act. While we commend the EU Commission's intention, the current draft and approach of the CoP imposes highly demanding and costly reporting and compliance burdens on its affected parties. We believe that the CoP in its current form threatens to hinder innovation and investments in AI and does not provide adequate guidance for complying with the AI Act.
Characteristics of General Purpose AI Model
The third draft of the CoP strives to establish basic guidelines for providers of general-purpose AI models, while the definition of the term remains unclear. There is no explanation of the vague delimitation criteria of the legal definition, such as "significant generality", "wide range of distinct tasks", etc. Thus, there is great uncertainty of the scope of the entire CoP. This negatively affects in particular those model providers who are placing them on the market only as part of an AI-system with a typically limited intended purpose (e.g. a language-based control unit of a device).
Fine-Tuning
The Commission and the drafters of the CoP have declared their intent to limit the applicability of the obligations for providers of GPAI models with systemic risk (GPAISR) of the CoP to a small group of addresses excluding those that are merely fine-tuning these models. However, neither the EU Commission, nor the CoP, have yet provided any reliable guidance at which point fine-tuning an existing AI model – a widely practiced and economically significant method – would classify the fine-tuning company as a provider of a GPAI Model. Given the legal text of the AI Act and the existing logic of product safety regulation, it remains unclear how the limited scope will be guaranteed. If the extensive requirements for GPAISR in the third draft were to apply to companies fine-tuning GPAISR, the CoP would significantly undermine their international competitiveness. Therefore, the Commission or the drafters of the CoP must urgently find an innovation-preserving solution for the fine-tuning of GPAISR. In order to create legal certainty in the applying industry, fine-tuners must be removed from the obligations of the CoP if necessary and legally feasible.
GPAI Systematic Risk Threshold
The third draft of the CoP introduces significant requirements for GPAISR, while the definition of the term remains unclear. Many development methods or product characteristics used to categorize GPAI as "with systematic risk" are industry-standard, competitive advantages, or widely adopted practices. Consequently, more GPAI models will be classified as "with systematic risk" than necessary. The arbitrary nature of the threshold defining GPAI models as GPAISR, and the EU Commission's ability to change it at any time impose severe legal uncertainty on companies developing, fine-tuning, or deploying GPAI models. Additionally, we disagree with the Commission's reasoning that the growing size of GPAI models and their systematic risk increase linearly. This assumption is questionable and may depend on the end-use case. Requirements for GPAI models should be based on the models’ capabilities and risk, not the size or location of a company.
Scope Overreach and the Risk of IP Theft
The third draft of the GPAI Codex continues to impose additional obligations beyond those specified in the AI Act, such as detailed documentation and extensive post-market surveillance. Furthermore, the detailed transparency obligations regarding model architecture, design specifics, and data used for training, testing, and validation threaten IP security. In general, the CoP should focus on eliciting model capabilities and the associated risks rather than disclosing the commercially sensitive methods used to achieve these capabilities.
Legal Basis and Legal Certainty
The CoP aims to specify provisions outlined in the AI Act making, where appropriate, references to other Union legislation and principles of EU law. Moreover, the AI Act reflects the common agreement of the EU co-legislators which ought to be reflected in the code. EVP Virkkunen reaffirmed this in February stating that the “upcoming code of practice on ai [...] would limit reporting requirements to what is included in the existing ai rules”. Hence the code of practice should not exceed the requirements in the AI Act, specifically regarding copyright, transparency, risk assessments and adequacy assessments.
Summary
We believe that the GPAI Code of Practice in its current status hinders innovation and investments in AI in Europe and does not provide adequate guidance for complying with the AI Act. The CoP further burdens companies in Europe by increasing red tape, which contradicts the current spirit of the EU Commission's omnibus packages. We call for a comprehensive revision of the CoP to keep the GPAI applicable in the EU. In view of the large number of passages in the CoP that need to be revised in terms of practicability, we call for a revision of the deadlines for publication of the final draft in order to give the authors sufficient time to optimize the CoP.
Imprint
Federation of German Industires (BDI)
Breite Straße 29, 10178 Berlin www.bdi.eu
T: +49 30 2028-0
EU Transparency Register: 1771817758-48
German Lobbying Register Number: R000534
Editor Polina Khubbeeva
Digitalisation and Innovation
T: +49 30 2028-1586 p.khubbeeva@bdi.eu
BDI Document Number: D 2072