{"id":24960,"date":"2025-07-09T09:23:29","date_gmt":"2025-07-09T07:23:29","guid":{"rendered":"https:\/\/compleye.io\/?p=24960"},"modified":"2026-10-12T12:00:11","modified_gmt":"2026-10-12T10:00:11","slug":"whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice","status":"publish","type":"post","link":"https:\/\/compleye.io\/de\/artikel\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\/","title":{"rendered":"Who\u2019s In, Who\u2019s Out: The Scope of GPAI and the Code of Practice"},"content":{"rendered":"<div data-elementor-type=\"wp-post\" data-elementor-id=\"24960\" class=\"elementor elementor-24960\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-66c219a1 e-flex e-con-boxed e-con e-parent\" data-id=\"66c219a1\" data-element_type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7f4e113 elementor-widget elementor-widget-text-editor\" data-id=\"7f4e113\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p id=\"ember1858\" class=\"ember-view reader-text-block__paragraph\">The EU\u2019s Artificial Intelligence Act is rolling out in stages, and we are now fast approaching an important milestone. As of 2 August 2025, new regulations will come into effect, impacting developers and providers of AI systems, particularly those working with General Purpose AI (GPAI) models. These foundational models underpin many AI solutions across industries, so the new rules will apply not only to their original creators but also to anyone adapting or embedding them into their own products.<span class=\"white-space-pre\"> <\/span><\/p><p id=\"ember1859\" class=\"ember-view reader-text-block__paragraph\">But if your GPAI model qualifies as a \u201csystemic risk\u201d heavyweight, think massive scale and influence, you will face stricter obligations: risk assessments, independent security audits, and close monitoring of how your AI impacts fundamental rights.<span class=\"white-space-pre\"> <\/span><\/p><p id=\"ember1860\" class=\"ember-view reader-text-block__paragraph\">No pressure, but for the first time in the history of AI, the EU is watching.<span class=\"white-space-pre\"> <\/span><\/p><h5 id=\"ember1861\" class=\"ember-view reader-text-block__paragraph\"><strong>What does it fall under the GPIA model?<\/strong><span class=\"white-space-pre\"> <\/span><\/h5><p id=\"ember1862\" class=\"ember-view reader-text-block__paragraph\">A GPAI model is defined under the EU AI Act as an AI model that regardless of how it is placed on the market or put into service is trained on a broad range of data using self-supervised or other learning methods and is capable of performing a wide array of distinct tasks. These models are not designed or optimized for a single, specific function but are intended to be integrated into or form part of various downstream AI systems or applications across different domains.<span class=\"white-space-pre\"> <\/span><\/p><p id=\"ember1863\" class=\"ember-view reader-text-block__paragraph\">The Act also defines a special subcategory: GPAI models with systemic risk. This includes models that either:<span class=\"white-space-pre\"> <\/span><\/p><ul><li>Possess exceptionally high computational power measured by a training threshold exceeding 10\u00b2\u2075 floating point operations (FLOPs) used as a proxy for scale and capability; or<span class=\"white-space-pre\"> <\/span><\/li><li>Pose significant risks to public interest (e.g. safety, public health, fundamental rights, security, or democratic processes) due to their widespread use and broad applicability.<\/li><\/ul><p id=\"ember1865\" class=\"ember-view reader-text-block__paragraph\">These high-impact models are subject to stricter transparency, safety, and documentation requirements under the Act, reflecting the potential scale of their societal influence.<span class=\"white-space-pre\"> <\/span><\/p><h5 id=\"ember1866\" class=\"ember-view reader-text-block__paragraph\"><strong>So, Who is in the Hot Seat?<\/strong><span class=\"white-space-pre\"> <\/span><\/h5><p id=\"ember1867\" class=\"ember-view reader-text-block__paragraph\">If you are building or fine-tuning the Godzilla-sized AI models of our time, the EU has you squarely in its sights. The \u201csystemic risk\u201d label under the AI Act comes with real obligations to get your house in order.<span class=\"white-space-pre\"> <\/span><\/p><p id=\"ember1868\" class=\"ember-view reader-text-block__paragraph\">First in line are the big brains with even bigger GPUs, think OpenAI, Google DeepMind, Meta. If you&#8217;re training models that burn through more FLOPs than most countries use in a year, welcome to the exclusive systemic risk club.<span class=\"white-space-pre\"> <\/span><\/p><p id=\"ember1869\" class=\"ember-view reader-text-block__paragraph\">Think you&#8217;re safe because you didn\u2019t train a mega-model from scratch? Think again. If you fine-tune, modify, or even rebrand one of these high-impact models and release it under your own name, congratulations you may be a GPAI provider in the EU\u2019s eyes. That chatbot you adapted from an open-weight model? If it\u2019s powerful and general-purpose enough, you&#8217;re in the club too.<span class=\"white-space-pre\"> <\/span><\/p><p id=\"ember1870\" class=\"ember-view reader-text-block__paragraph\">Systemic risk doesn\u2019t just raise the pressure on companies; it also raises the bar for regulators. The new AI Office and national authorities must now act as part lawyer, part computer scientist, and part risk manager. Their responsibility? Identify which models pose systemic risk, oversee compliance, and step in when necessary.<span class=\"white-space-pre\"> <\/span><\/p><h5 id=\"ember1871\" class=\"ember-view reader-text-block__paragraph\"><strong>And Everyone Else&#8230;<\/strong><span class=\"white-space-pre\"> <\/span><\/h5><p id=\"ember1872\" class=\"ember-view reader-text-block__paragraph\">Even if you are on the sidelines, systemic risk rules may soon shape your day-to-day. If you are buying AI tools, you will start asking: Is this model compliant? Could this get me into trouble? If you are building apps, services, or hardware powered by GPAIs, expect the ripple effects to hit your shores too.\u00a0 Put simply: the EU isn\u2019t just regulating models. It is regulating power in the AI ecosystem.<span class=\"white-space-pre\"> <\/span><\/p><h5 id=\"ember1873\" class=\"ember-view reader-text-block__paragraph\"><strong>The Scale Divide: Labs vs. SMEs<\/strong><span class=\"white-space-pre\"> <\/span><\/h5><p id=\"ember1874\" class=\"ember-view reader-text-block__paragraph\">For the major labs, the implications are clear. They are training enormous models from scratch using supercomputing clusters, and they clearly fall into the GPAI systemic risk category. Yes, the compliance load is heavy but these companies already have armies of lawyers, policy experts, and ethics ready to tackle it. Things get murkier for SMEs, research labs, and open-source developers. These players may not have hit the 10\u00b2\u2075 FLOPs threshold, but they could still be caught in the regulatory web.<span class=\"white-space-pre\"> <\/span><\/p><p id=\"ember1875\" class=\"ember-view reader-text-block__paragraph\">Say you fine-tune an open-weight model (like Meta\u2019s LLaMA or Mistral) and use it in a chatbot, writing assistant, or health tech tool. If you deploy that product under your company name and it performs a variety of general-purpose tasks regulators might treat you as a GPAI provider.<span class=\"white-space-pre\"> <\/span><\/p><p id=\"ember1876\" class=\"ember-view reader-text-block__paragraph\">The problem? SMEs don\u2019t have in-house compliance departments. They can\u2019t afford three-month legal reviews before each release. And without clearer carve-outs or guidance, they risk being held to standards designed for trillion-parameter giants.<span class=\"white-space-pre\"> <\/span><\/p><h5 id=\"ember1877\" class=\"ember-view reader-text-block__paragraph\"><strong>Why This Matters?<\/strong><\/h5><p id=\"ember1878\" class=\"ember-view reader-text-block__paragraph\">The lack of clarity risks chilling innovation not at the top, but in the middle and bottom of the ecosystem. While the AI Act rightly targets frontier risks, its definitions could unintentionally rope in the very players Europe says it wants to support: its startups, open-source developers, and SMEs driving responsible experimentation.<span class=\"white-space-pre\"> <\/span><\/p><p id=\"ember1879\" class=\"ember-view reader-text-block__paragraph\">What is needed is guidance that reflects the difference between modifying a GPAI model lightly (e.g., prompt-tuning for a narrow use case) and creating a model that genuinely warrants systemic oversight. Otherwise, we risk asking a local EdTech startup to comply like it\u2019s OpenAI\u00a0 and that\u2019s not just unfair; it\u2019s unsustainable.<span class=\"white-space-pre\"> <\/span><\/p><h5 id=\"ember1880\" class=\"ember-view reader-text-block__paragraph\"><strong><span class=\"white-space-pre\"> <\/span>AI Act\u2019s Code of Practice: Transparency, Copyright &amp; a Bit of Contained Panic<\/strong><span class=\"white-space-pre\"> <\/span><\/h5><p id=\"ember1881\" class=\"ember-view reader-text-block__paragraph\">To help navigate the maze, the European Commission introduced a Code of Practice. It\u2019s technically voluntary (for now), but if you&#8217;re a major model developer eyeing compliance, regulatory goodwill, or simply a smooth relationship with the AI Office, you\u2019re expected to treat it less like a suggestion and more like a guidelines to follow.<span class=\"white-space-pre\"> <\/span><\/p><h5 id=\"ember1882\" class=\"ember-view reader-text-block__paragraph\"><strong>Transparency<\/strong><span class=\"white-space-pre\"> <\/span><\/h5><p id=\"ember1883\" class=\"ember-view reader-text-block__paragraph\">All GPAI model providers , systemic risk or not , must now commit to a kind of radical transparency that would make most secretive AI labs shke, Under the Code, signatories must:<span class=\"white-space-pre\"> <\/span><\/p><ul><li>Maintain detailed and up to date model documentation. This documentation must be robust, secure, and detailed enough to satisfy both downstream developers and the EU\u2019s AI Office.<span class=\"white-space-pre\"> <\/span><\/li><li>To keep things tidy, the Code even includes a fully interactive Model Documentation Form.<span class=\"white-space-pre\"> <\/span><\/li><li>Provide relevant information to downstream providers and to the AI Office (on request, of course .<span class=\"white-space-pre\"> <\/span><\/li><\/ul><h5 id=\"ember1885\" class=\"ember-view reader-text-block__paragraph\"><strong><span class=\"white-space-pre\"> <\/span>Copyright: No More \u2018Oops, We Trained on That\u2019<\/strong><span class=\"white-space-pre\"> <\/span><\/h5><p id=\"ember1886\" class=\"ember-view reader-text-block__paragraph\">This is where the Code stops being polite and starts getting legal. Every GPAI provider must now adopt, maintain, and enforce a copyright compliance polic<strong>y<\/strong>. This is already directly required under the AI Act\u00a0 and includes:<span class=\"white-space-pre\"> <\/span><\/p><ul><li>Only crawling lawfully accessible content , say goodbye to the wild-west days of scraping without looking.<span class=\"white-space-pre\"> <\/span><\/li><li>Respecting<span class=\"white-space-pre\"> <\/span>robots.txt and other opt-out signals from rightsholders.<span class=\"white-space-pre\"> <\/span><\/li><li>Staying away from piracy domains.<span class=\"white-space-pre\"> <\/span><\/li><li>Minimizing the risk of producing copyright-infringing outputs. That includes fine-tuning guardrails and<span class=\"white-space-pre\"> <\/span><em>not parroting<\/em><span class=\"white-space-pre\"> <\/span>licensed material.<span class=\"white-space-pre\"> <\/span><\/li><li>Appointing a copyright point of contact and establishing a complaint mechanism<span class=\"white-space-pre\"> <\/span><\/li><\/ul><p id=\"ember1888\" class=\"ember-view reader-text-block__paragraph\">This is a big shift, especially for labs that previously treated copyright compliance like a backend housekeeping issue. Now, it\u2019s front and center with documentation and potential reputational consequences to match.<span class=\"white-space-pre\"> <\/span><\/p><h5 id=\"ember1889\" class=\"ember-view reader-text-block__paragraph\"><span class=\"white-space-pre\"> <\/span><strong>Safety and Security: For the Big Kids Only<\/strong><span class=\"white-space-pre\"> <\/span><\/h5><p id=\"ember1890\" class=\"ember-view reader-text-block__paragraph\">This section applies only to GPAI providers whose models pose a systemic risk\u00a0 a fuzzy but important threshold in the AI Act.\u00a0 You are signing up for:<span class=\"white-space-pre\"> <\/span><\/p><ul><li>A full Safety and Security Framework, covering risk assessment, mitigation, and internal governance.<span class=\"white-space-pre\"> <\/span><\/li><li>Evaluating risk across the entire model lifecycle\u00a0 not just during training or deployment.<span class=\"white-space-pre\"> <\/span><\/li><li>Building in state-of-the-art safety mitigations including technical and security measures to prevent model weight leaks.<span class=\"white-space-pre\"> <\/span><\/li><li>Producing a Safety and Security Model Report for each high-risk model.<span class=\"white-space-pre\"> <\/span><\/li><li>Appointing internal responsibility-holders and submitting to independent third-party assessments (with narrow exceptions).<span class=\"white-space-pre\"> <\/span><\/li><li>Monitoring for \u201cserious incidents,\u201d adopting anti-retaliation protections, and keeping the AI Office in the loop at key milestones.<span class=\"white-space-pre\"> <\/span><\/li><\/ul><p id=\"ember1892\" class=\"ember-view reader-text-block__paragraph\">And if a systemic risk issue could meaningfully impact public understanding? You will be expected to disclose it publicly.<span class=\"white-space-pre\"> <\/span><\/p><h5 id=\"ember1893\" class=\"ember-view reader-text-block__paragraph\"><strong>What will happen to models already available on the market?<\/strong><span class=\"white-space-pre\"> <\/span><\/h5><p id=\"ember1894\" class=\"ember-view reader-text-block__paragraph\">The AI Act offers important relief for GPAI models that were marketed before 2 August 2025; these need to be compliant with the AI Act by 2 August 2027. These models are exempt from having to apply the new obligations retroactively; for example, you won\u2019t need to retrain or \u201cde-train\u201d models based on data used before that date.<span class=\"white-space-pre\"> <\/span><\/p><p id=\"ember1895\" class=\"ember-view reader-text-block__paragraph\">2 August 2025 marks a key milestone for the entire AI ecosystem in the EU. If your organization incorporates GPAI models into its products, this is the critical time to assess your position in the supply chain and ensure your processes align with the upcoming requirements.<span class=\"white-space-pre\"> <\/span><\/p><h5 id=\"ember1896\" class=\"ember-view reader-text-block__paragraph\"><strong>So What is the Takeaway?<\/strong><span class=\"white-space-pre\"> <\/span><\/h5><p id=\"ember1897\" class=\"ember-view reader-text-block__paragraph\">The Code of Practice might sound like a polite framework, but its terms are anything but soft. For GPAI providers especially those anywhere near the systemic risk zone\u00a0 this is rapidly becoming a de facto compliance playbook.<span class=\"white-space-pre\"> <\/span><\/p><p id=\"ember1898\" class=\"ember-view reader-text-block__paragraph\">If you are a big lab, you are in. If you are a mid-sized developer with an LLM that\u2019s gotten too clever for its own good, you\u2019re probably in too. And if you\u2019re not sure? Well, the AI Office is watching and they have a Model Documentation Form with your name on it.<span class=\"white-space-pre\"> <\/span><\/p><p id=\"ember1899\" class=\"ember-view reader-text-block__paragraph\"><strong>If you need help understanding the EU AI Act and ensuring your company remains compliant, feel free to contact<span class=\"white-space-pre\"> <\/span><\/strong><a class=\"aKgoauviAZxJAadjRGfyvORexGDtmbTuwaEng\" target=\"_self\" href=\"https:\/\/compleye.io\/de\/demo\/\" data-test-app-aware-link=\"\" tabindex=\"0\">Compleye<span class=\"white-space-pre\"> <\/span><\/a><strong><span class=\"white-space-pre\"> <\/span>for tailored guidance and support.<\/strong><span class=\"white-space-pre\"> <\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-1f4ce9b e-flex e-con-boxed e-con e-parent\" data-id=\"1f4ce9b\" data-element_type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-4a7ca3c e-con-full e-flex e-con e-child\" data-id=\"4a7ca3c\" data-element_type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-5a19be1 elementor-widget elementor-widget-heading\" data-id=\"5a19be1\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Frequently Asked Questions<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-254e85a elementor-widget elementor-widget-n-accordion\" data-id=\"254e85a\" data-element_type=\"widget\" data-settings=\"{&quot;default_state&quot;:&quot;expanded&quot;,&quot;max_items_expended&quot;:&quot;one&quot;,&quot;n_accordion_animation_duration&quot;:{&quot;unit&quot;:&quot;ms&quot;,&quot;size&quot;:400,&quot;sizes&quot;:[]}}\" data-widget_type=\"nested-accordion.default\">\n\t\t\t\t\t\t\t<div class=\"e-n-accordion\" aria-label=\"Accordion. Open links with Enter or Space, close with Escape, and navigate with Arrow Keys\">\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-3910\" class=\"e-n-accordion-item\" open>\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"1\" tabindex=\"0\" aria-expanded=\"true\" aria-controls=\"e-n-accordion-item-3910\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h2 class=\"e-n-accordion-item-title-text\"> Does the EU AI Act apply to my SaaS company if we only use an AI model through an API? <\/h2><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-minus\" viewbox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M416 208H32c-17.67 0-32 14.33-32 32v32c0 17.67 14.33 32 32 32h384c17.67 0 32-14.33 32-32v-32c0-17.67-14.33-32-32-32z\"><\/path><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-plus\" viewbox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M416 208H272V64c0-17.67-14.33-32-32-32h-32c-17.67 0-32 14.33-32 32v144H32c-17.67 0-32 14.33-32 32v32c0 17.67 14.33 32 32 32h144v144c0 17.67 14.33 32 32 32h32c17.67 0 32-14.33 32-32V304h144c17.67 0 32-14.33 32-32v-32c0-17.67-14.33-32-32-32z\"><\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-3910\" class=\"elementor-element elementor-element-f7c193f e-con-full e-flex e-con e-child\" data-id=\"f7c193f\" data-element_type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a925f00 elementor-widget elementor-widget-text-editor\" data-id=\"a925f00\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p>Using a model through an API does not by itself make you a provider of a general-purpose AI (GPAI) model. The GPAI model obligations fall mainly on whoever develops the model. You may still have other responsibilities depending on how you use it, for example transparency duties or stricter rules if your use case is high-risk, and GDPR applies whenever personal data is involved. Check your specific use case with a qualified adviser.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-3911\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"2\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-3911\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h2 class=\"e-n-accordion-item-title-text\"> When does fine-tuning a model make my company a GPAI provider? <\/h2><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-minus\" viewbox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M416 208H32c-17.67 0-32 14.33-32 32v32c0 17.67 14.33 32 32 32h384c17.67 0 32-14.33 32-32v-32c0-17.67-14.33-32-32-32z\"><\/path><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-plus\" viewbox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M416 208H272V64c0-17.67-14.33-32-32-32h-32c-17.67 0-32 14.33-32 32v144H32c-17.67 0-32 14.33-32 32v32c0 17.67 14.33 32 32 32h144v144c0 17.67 14.33 32 32 32h32c17.67 0 32-14.33 32-32V304h144c17.67 0 32-14.33 32-32v-32c0-17.67-14.33-32-32-32z\"><\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-3911\" class=\"elementor-element elementor-element-c5eb88e e-con-full e-flex e-con e-child\" data-id=\"c5eb88e\" data-element_type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-203e38b elementor-widget elementor-widget-text-editor\" data-id=\"203e38b\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p dir=\"ltr\">Not every modification does. The Commission\u2019s guidelines say a downstream modifier becomes a provider when the training compute used for the modification is more than one-third of the original model\u2019s training compute. Light changes such as prompt tuning or small-scale fine-tuning usually fall well below that line. If you are unsure of the original model\u2019s compute, the guidelines give fixed fallback thresholds, and a modifier who does become a provider is generally expected to comply only for its own modification.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-3912\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"3\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-3912\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h2 class=\"e-n-accordion-item-title-text\"> When do the GPAI rules apply, and is the AI Office enforcing them yet? <\/h2><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-minus\" viewbox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M416 208H32c-17.67 0-32 14.33-32 32v32c0 17.67 14.33 32 32 32h384c17.67 0 32-14.33 32-32v-32c0-17.67-14.33-32-32-32z\"><\/path><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-plus\" viewbox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M416 208H272V64c0-17.67-14.33-32-32-32h-32c-17.67 0-32 14.33-32 32v144H32c-17.67 0-32 14.33-32 32v32c0 17.67 14.33 32 32 32h144v144c0 17.67 14.33 32 32 32h32c17.67 0 32-14.33 32-32V304h144c17.67 0 32-14.33 32-32v-32c0-17.67-14.33-32-32-32z\"><\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-3912\" class=\"elementor-element elementor-element-a804d85 e-con-full e-flex e-con e-child\" data-id=\"a804d85\" data-element_type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-da71d8f elementor-widget elementor-widget-text-editor\" data-id=\"da71d8f\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p>GPAI provider obligations have applied since 2 August 2025. The Commission can only take enforcement action from 2 August 2026, so that power is now live. Models already on the market before August 2025 have until 2 August 2027 to comply.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-3913\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"4\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-3913\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h2 class=\"e-n-accordion-item-title-text\"> What is the GPAI Code of Practice, and do we have to sign it? <\/h2><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-minus\" viewbox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M416 208H32c-17.67 0-32 14.33-32 32v32c0 17.67 14.33 32 32 32h384c17.67 0 32-14.33 32-32v-32c0-17.67-14.33-32-32-32z\"><\/path><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-plus\" viewbox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M416 208H272V64c0-17.67-14.33-32-32-32h-32c-17.67 0-32 14.33-32 32v144H32c-17.67 0-32 14.33-32 32v32c0 17.67 14.33 32 32 32h144v144c0 17.67 14.33 32 32 32h32c17.67 0 32-14.33 32-32V304h144c17.67 0 32-14.33 32-32v-32c0-17.67-14.33-32-32-32z\"><\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-3913\" class=\"elementor-element elementor-element-4db893a e-con-full e-flex e-con e-child\" data-id=\"4db893a\" data-element_type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-ee0b6f3 elementor-widget elementor-widget-text-editor\" data-id=\"ee0b6f3\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p>The Code of Practice is a voluntary tool published by the European Commission to help GPAI providers meet their obligations. It covers transparency, copyright and, for the most capable models, safety and security. Signing it is not mandatory, but it gives providers a recognized way to show compliance and a smoother relationship with the AI Office. If you buy models, it is worth asking whether your vendor has signed.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-3914\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"5\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-3914\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h2 class=\"e-n-accordion-item-title-text\"> What counts as a GPAI model with \u201csystemic risk\u201d? <\/h2><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-minus\" viewbox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M416 208H32c-17.67 0-32 14.33-32 32v32c0 17.67 14.33 32 32 32h384c17.67 0 32-14.33 32-32v-32c0-17.67-14.33-32-32-32z\"><\/path><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-plus\" viewbox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M416 208H272V64c0-17.67-14.33-32-32-32h-32c-17.67 0-32 14.33-32 32v144H32c-17.67 0-32 14.33-32 32v32c0 17.67 14.33 32 32 32h144v144c0 17.67 14.33 32 32 32h32c17.67 0 32-14.33 32-32V304h144c17.67 0 32-14.33 32-32v-32c0-17.67-14.33-32-32-32z\"><\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-3914\" class=\"elementor-element elementor-element-09041c4 e-con-full e-flex e-con e-child\" data-id=\"09041c4\" data-element_type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-74d0402 elementor-widget elementor-widget-text-editor\" data-id=\"74d0402\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p>The Act presumes systemic risk for models trained with more than 10^25 floating point operations, a proxy for scale and capability. Models can also be designated if they pose significant risks to public interest, such as safety, public health, fundamental rights or democratic processes. These models face stricter obligations, including risk assessment, security measures and incident monitoring.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t<script type=\"application\/ld+json\">{\n    \"@context\": \"https:\\\/\\\/schema.org\",\n    \"@type\": \"FAQPage\",\n    \"mainEntity\": [\n        {\n            \"@type\": \"Question\",\n            \"name\": \"Does the EU AI Act apply to my SaaS company if we only use an AI model through an API?\",\n            \"acceptedAnswer\": {\n                \"@type\": \"Answer\",\n                \"text\": \"Using a model through an API does not by itself make you a provider of a general-purpose AI (GPAI) model. The GPAI model obligations fall mainly on whoever develops the model. You may still have other responsibilities depending on how you use it, for example transparency duties or stricter rules if your use case is high-risk, and GDPR applies whenever personal data is involved. Check your specific use case with a qualified adviser.\"\n            }\n        },\n        {\n            \"@type\": \"Question\",\n            \"name\": \"When does fine-tuning a model make my company a GPAI provider?\",\n            \"acceptedAnswer\": {\n                \"@type\": \"Answer\",\n                \"text\": \"Not every modification does. The Commission\\u2019s guidelines say a downstream modifier becomes a provider when the training compute used for the modification is more than one-third of the original model\\u2019s training compute. Light changes such as prompt tuning or small-scale fine-tuning usually fall well below that line. If you are unsure of the original model\\u2019s compute, the guidelines give fixed fallback thresholds, and a modifier who does become a provider is generally expected to comply only for its own modification.\"\n            }\n        },\n        {\n            \"@type\": \"Question\",\n            \"name\": \"When do the GPAI rules apply, and is the AI Office enforcing them yet?\",\n            \"acceptedAnswer\": {\n                \"@type\": \"Answer\",\n                \"text\": \"GPAI provider obligations have applied since 2 August 2025. The Commission can only take enforcement action from 2 August 2026, so that power is now live. Models already on the market before August 2025 have until 2 August 2027 to comply.\"\n            }\n        },\n        {\n            \"@type\": \"Question\",\n            \"name\": \"What is the GPAI Code of Practice, and do we have to sign it?\",\n            \"acceptedAnswer\": {\n                \"@type\": \"Answer\",\n                \"text\": \"The Code of Practice is a voluntary tool published by the European Commission to help GPAI providers meet their obligations. It covers transparency, copyright and, for the most capable models, safety and security. Signing it is not mandatory, but it gives providers a recognized way to show compliance and a smoother relationship with the AI Office. If you buy models, it is worth asking whether your vendor has signed.\"\n            }\n        },\n        {\n            \"@type\": \"Question\",\n            \"name\": \"What counts as a GPAI model with \\u201csystemic risk\\u201d?\",\n            \"acceptedAnswer\": {\n                \"@type\": \"Answer\",\n                \"text\": \"The Act presumes systemic risk for models trained with more than 10^25 floating point operations, a proxy for scale and capability. Models can also be designated if they pose significant risks to public interest, such as safety, public health, fundamental rights or democratic processes. These models face stricter obligations, including risk assessment, security measures and incident monitoring.\"\n            }\n        }\n    ]\n}<\/script>\n\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>The EU\u2019s Artificial Intelligence Act is rolling out in stages, and we are now fast approaching an important milestone. As of 2 August 2025, new regulations will come into effect, impacting developers and providers of AI systems, particularly those working with General Purpose AI (GPAI) models. These foundational models underpin [&hellip;]<\/p>","protected":false},"author":17,"featured_media":24957,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[125,126],"class_list":["post-24960","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-lean","tag-eu-ai-act","tag-gpia"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Lean Compliance Collaboration Platform | Compleye.io | ISO 27001 | ISO 9001 | SOC 2<\/title>\n<meta name=\"description\" content=\"Lean Compliance Collaboration Platform to help SaaS Companies towards their ISO 27001, ISO 9001 or SOC-2 certification and stronger performance on privacy and security.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/compleye.io\/de\/artikel\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\/\" \/>\n<meta property=\"og:locale\" content=\"de_DE\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Lean Compliance Collaboration Platform | Compleye.io | ISO 27001 | ISO 9001 | SOC 2\" \/>\n<meta property=\"og:description\" content=\"Lean Compliance Collaboration Platform to help SaaS Companies towards their ISO 27001, ISO 9001 or SOC-2 certification and stronger performance on privacy and security.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/compleye.io\/de\/artikel\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\/\" \/>\n<meta property=\"og:site_name\" content=\"compleye.io\" \/>\n<meta property=\"article:published_time\" content=\"2025-07-09T07:23:29+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-12T10:00:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/compleye.io\/wp-content\/uploads\/2026\/01\/1752039762864.jpeg\" \/>\n\t<meta property=\"og:image:width\" content=\"640\" \/>\n\t<meta property=\"og:image:height\" content=\"360\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Karolin Kruiskamp\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Geschrieben von\" \/>\n\t<meta name=\"twitter:data1\" content=\"Karolin Kruiskamp\" \/>\n\t<meta name=\"twitter:label2\" content=\"Gesch\u00e4tzte Lesezeit\" \/>\n\t<meta name=\"twitter:data2\" content=\"10\u00a0Minuten\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":[\"Article\",\"BlogPosting\"],\"@id\":\"https:\\\/\\\/compleye.io\\\/articles\\\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/compleye.io\\\/articles\\\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\\\/\"},\"author\":{\"name\":\"Karolin Kruiskamp\",\"@id\":\"https:\\\/\\\/compleye.io\\\/#\\\/schema\\\/person\\\/0cec6d61467336a3c2ea74f0beb84bc3\"},\"headline\":\"Who\u2019s In, Who\u2019s Out: The Scope of GPAI and the Code of Practice\",\"datePublished\":\"2025-07-09T07:23:29+00:00\",\"dateModified\":\"2026-10-12T10:00:11+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/compleye.io\\\/articles\\\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\\\/\"},\"wordCount\":2246,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/compleye.io\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/compleye.io\\\/articles\\\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/compleye.io\\\/wp-content\\\/uploads\\\/2026\\\/01\\\/1752039762864.jpeg\",\"keywords\":[\"EU AI ACT\",\"GPIA\"],\"articleSection\":[\"Compleye Lean Compliance Designers\"],\"inLanguage\":\"de\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/compleye.io\\\/articles\\\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/compleye.io\\\/articles\\\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\\\/\",\"url\":\"https:\\\/\\\/compleye.io\\\/articles\\\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\\\/\",\"name\":\"Lean Compliance Collaboration Platform | Compleye.io | ISO 27001 | ISO 9001 | SOC 2\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/compleye.io\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/compleye.io\\\/articles\\\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/compleye.io\\\/articles\\\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/compleye.io\\\/wp-content\\\/uploads\\\/2026\\\/01\\\/1752039762864.jpeg\",\"datePublished\":\"2025-07-09T07:23:29+00:00\",\"dateModified\":\"2026-10-12T10:00:11+00:00\",\"description\":\"Lean Compliance Collaboration Platform to help SaaS Companies towards their ISO 27001, ISO 9001 or SOC-2 certification and stronger performance on privacy and security.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/compleye.io\\\/articles\\\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\\\/#breadcrumb\"},\"inLanguage\":\"de\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/compleye.io\\\/articles\\\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\\\/\\\/compleye.io\\\/articles\\\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\\\/#primaryimage\",\"url\":\"https:\\\/\\\/compleye.io\\\/wp-content\\\/uploads\\\/2026\\\/01\\\/1752039762864.jpeg\",\"contentUrl\":\"https:\\\/\\\/compleye.io\\\/wp-content\\\/uploads\\\/2026\\\/01\\\/1752039762864.jpeg\",\"width\":640,\"height\":360},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/compleye.io\\\/articles\\\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/compleye.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Who\u2019s In, Who\u2019s Out: The Scope of GPAI and the Code of Practice\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/compleye.io\\\/#website\",\"url\":\"https:\\\/\\\/compleye.io\\\/\",\"name\":\"compleye.io\",\"description\":\"security and privacy compliance getting done\",\"publisher\":{\"@id\":\"https:\\\/\\\/compleye.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/compleye.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"de\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/compleye.io\\\/#organization\",\"name\":\"Compleye\",\"url\":\"https:\\\/\\\/compleye.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\\\/\\\/compleye.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/compleye.io\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/Compleye_Logo_Logo_Black.png\",\"contentUrl\":\"https:\\\/\\\/compleye.io\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/Compleye_Logo_Logo_Black.png\",\"width\":2451,\"height\":892,\"caption\":\"Compleye\"},\"image\":{\"@id\":\"https:\\\/\\\/compleye.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/c-board\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCpe1Z7aynfqWSrjgJORgKXw\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/compleye.io\\\/#\\\/schema\\\/person\\\/0cec6d61467336a3c2ea74f0beb84bc3\",\"name\":\"Karolin Kruiskamp\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e9c574805c26ff058e494916fb42a856824ea78280afec8044becfcbddce78c7?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e9c574805c26ff058e494916fb42a856824ea78280afec8044becfcbddce78c7?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e9c574805c26ff058e494916fb42a856824ea78280afec8044becfcbddce78c7?s=96&d=mm&r=g\",\"caption\":\"Karolin Kruiskamp\"},\"url\":\"https:\\\/\\\/compleye.io\\\/de\\\/articles\\\/author\\\/karolin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Lean Compliance Collaboration Platform | Compleye.io | ISO 27001 | ISO 9001 | SOC 2","description":"Lean Compliance Collaboration Platform to help SaaS Companies towards their ISO 27001, ISO 9001 or SOC-2 certification and stronger performance on privacy and security.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/compleye.io\/de\/artikel\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\/","og_locale":"de_DE","og_type":"article","og_title":"Lean Compliance Collaboration Platform | Compleye.io | ISO 27001 | ISO 9001 | SOC 2","og_description":"Lean Compliance Collaboration Platform to help SaaS Companies towards their ISO 27001, ISO 9001 or SOC-2 certification and stronger performance on privacy and security.","og_url":"https:\/\/compleye.io\/de\/artikel\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\/","og_site_name":"compleye.io","article_published_time":"2025-07-09T07:23:29+00:00","article_modified_time":"2026-10-12T10:00:11+00:00","og_image":[{"width":640,"height":360,"url":"https:\/\/compleye.io\/wp-content\/uploads\/2026\/01\/1752039762864.jpeg","type":"image\/jpeg"}],"author":"Karolin Kruiskamp","twitter_card":"summary_large_image","twitter_misc":{"Geschrieben von":"Karolin Kruiskamp","Gesch\u00e4tzte Lesezeit":"10\u00a0Minuten"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":["Article","BlogPosting"],"@id":"https:\/\/compleye.io\/articles\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\/#article","isPartOf":{"@id":"https:\/\/compleye.io\/articles\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\/"},"author":{"name":"Karolin Kruiskamp","@id":"https:\/\/compleye.io\/#\/schema\/person\/0cec6d61467336a3c2ea74f0beb84bc3"},"headline":"Who\u2019s In, Who\u2019s Out: The Scope of GPAI and the Code of Practice","datePublished":"2025-07-09T07:23:29+00:00","dateModified":"2026-10-12T10:00:11+00:00","mainEntityOfPage":{"@id":"https:\/\/compleye.io\/articles\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\/"},"wordCount":2246,"commentCount":0,"publisher":{"@id":"https:\/\/compleye.io\/#organization"},"image":{"@id":"https:\/\/compleye.io\/articles\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\/#primaryimage"},"thumbnailUrl":"https:\/\/compleye.io\/wp-content\/uploads\/2026\/01\/1752039762864.jpeg","keywords":["EU AI ACT","GPIA"],"articleSection":["Compleye Lean Compliance Designers"],"inLanguage":"de","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/compleye.io\/articles\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/compleye.io\/articles\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\/","url":"https:\/\/compleye.io\/articles\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\/","name":"Lean Compliance Collaboration Platform | Compleye.io | ISO 27001 | ISO 9001 | SOC 2","isPartOf":{"@id":"https:\/\/compleye.io\/#website"},"primaryImageOfPage":{"@id":"https:\/\/compleye.io\/articles\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\/#primaryimage"},"image":{"@id":"https:\/\/compleye.io\/articles\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\/#primaryimage"},"thumbnailUrl":"https:\/\/compleye.io\/wp-content\/uploads\/2026\/01\/1752039762864.jpeg","datePublished":"2025-07-09T07:23:29+00:00","dateModified":"2026-10-12T10:00:11+00:00","description":"Lean Compliance Collaboration Platform to help SaaS Companies towards their ISO 27001, ISO 9001 or SOC-2 certification and stronger performance on privacy and security.","breadcrumb":{"@id":"https:\/\/compleye.io\/articles\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\/#breadcrumb"},"inLanguage":"de","potentialAction":[{"@type":"ReadAction","target":["https:\/\/compleye.io\/articles\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\/"]}]},{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/compleye.io\/articles\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\/#primaryimage","url":"https:\/\/compleye.io\/wp-content\/uploads\/2026\/01\/1752039762864.jpeg","contentUrl":"https:\/\/compleye.io\/wp-content\/uploads\/2026\/01\/1752039762864.jpeg","width":640,"height":360},{"@type":"BreadcrumbList","@id":"https:\/\/compleye.io\/articles\/whos-in-whos-out-the-scope-of-gpai-and-the-code-of-practice\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/compleye.io\/"},{"@type":"ListItem","position":2,"name":"Who\u2019s In, Who\u2019s Out: The Scope of GPAI and the Code of Practice"}]},{"@type":"WebSite","@id":"https:\/\/compleye.io\/#website","url":"https:\/\/compleye.io\/","name":"compleye.io","description":"security and privacy compliance getting done","publisher":{"@id":"https:\/\/compleye.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/compleye.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"de"},{"@type":"Organization","@id":"https:\/\/compleye.io\/#organization","name":"Compleye","url":"https:\/\/compleye.io\/","logo":{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/compleye.io\/#\/schema\/logo\/image\/","url":"https:\/\/compleye.io\/wp-content\/uploads\/2023\/03\/Compleye_Logo_Logo_Black.png","contentUrl":"https:\/\/compleye.io\/wp-content\/uploads\/2023\/03\/Compleye_Logo_Logo_Black.png","width":2451,"height":892,"caption":"Compleye"},"image":{"@id":"https:\/\/compleye.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/c-board\/","https:\/\/www.youtube.com\/channel\/UCpe1Z7aynfqWSrjgJORgKXw"]},{"@type":"Person","@id":"https:\/\/compleye.io\/#\/schema\/person\/0cec6d61467336a3c2ea74f0beb84bc3","name":"Karolin Kruiskamp","image":{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/secure.gravatar.com\/avatar\/e9c574805c26ff058e494916fb42a856824ea78280afec8044becfcbddce78c7?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/e9c574805c26ff058e494916fb42a856824ea78280afec8044becfcbddce78c7?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e9c574805c26ff058e494916fb42a856824ea78280afec8044becfcbddce78c7?s=96&d=mm&r=g","caption":"Karolin Kruiskamp"},"url":"https:\/\/compleye.io\/de\/articles\/author\/karolin\/"}]}},"_links":{"self":[{"href":"https:\/\/compleye.io\/de\/wp-json\/wp\/v2\/posts\/24960","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/compleye.io\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/compleye.io\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/compleye.io\/de\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/compleye.io\/de\/wp-json\/wp\/v2\/comments?post=24960"}],"version-history":[{"count":8,"href":"https:\/\/compleye.io\/de\/wp-json\/wp\/v2\/posts\/24960\/revisions"}],"predecessor-version":[{"id":25566,"href":"https:\/\/compleye.io\/de\/wp-json\/wp\/v2\/posts\/24960\/revisions\/25566"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/compleye.io\/de\/wp-json\/wp\/v2\/media\/24957"}],"wp:attachment":[{"href":"https:\/\/compleye.io\/de\/wp-json\/wp\/v2\/media?parent=24960"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/compleye.io\/de\/wp-json\/wp\/v2\/categories?post=24960"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/compleye.io\/de\/wp-json\/wp\/v2\/tags?post=24960"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}