What does General-Purpose AI Code of Practice say about AI in banking?

What are the key points of General-Purpose AI Code of Practice?

• Transparency chapter: a standard Model Documentation Form providers must complete and share with downstream providers and, on request, the AI Office.
• Copyright chapter: commitments on EU copyright compliance, including respecting machine-readable opt-outs when crawling training data.
• Safety and Security chapter: applies only to GPAI models with systemic risk (Art. 55), covering risk assessment, incident reporting and cybersecurity.
• Adherence gives providers a presumption-of-good-faith route and lower administrative burden; non-signatories must demonstrate compliance by other means.
• GPAI obligations applied from August 2, 2025; the Commission's enforcement powers over GPAI providers begin August 2, 2026.
• Banks are typically downstream deployers: the Code determines what documentation they can expect to receive from foundation-model vendors for their own third-party and model-risk records.

What did General-Purpose AI Code of Practice change for banks?

For banks, the Code standardises what foundation-model vendors will disclose — capabilities, limitations, training-data summaries, evaluation results — which becomes the evidentiary base for vendor due diligence and model-risk documentation of generative-AI use cases. It does not impose direct duties on banks unless they fine-tune a model so substantially that they become a GPAI provider.