The EU's voluntary AI code: who signed in full before Brussels could check

Since August 2, 2026, the European Commission's AI Office can request information, evaluate models, order corrective measures or market withdrawal, and fine general-purpose AI (GPAI) providers up to €15 million or 3% of worldwide annual turnover, whether they are based in the EU or not. To handle these cases, the Office quietly built up capacity: more than 125 staff, backed by a Scientific Panel of 60 independent experts.

A year earlier, in July 2025, the Commission had published a voluntary Code of Practice for GPAI models — with no sanction power attached. More than 20 providers signed it in full, including Anthropic, Google, Microsoft and OpenAI. Meta declined to sign at all. xAI signed only the "safety and security" chapter, leaving the rest of the commitments (governance, technical documentation, risk management) unaddressed.

That signing choice, made at a time when commitment cost nothing because no one was checking, is not a cosmetic detail for an economist — it is a natural screening experiment. The providers with the most to lose from future scrutiny, or anticipating the highest regulatory exposure, had an interest in locking in a structured framework early rather than facing unpredictable oversight later.

For industrial leadership teams embedding these providers' models into their own products — aerospace, O&G, energy, luxury — the question is no longer just "which model to choose", but "which provider already revealed, through a year-old signing choice, the level of regulatory predictability it will pass on to you". A deeper read through Rothschild & Stiglitz's (1976) screening theory is available in our Analyses section.