OpenAI’s EU AI Act Playbook Looks Serious—but Brussels Will Want Receipts

Europe’s AI Rules Are Entering a Tougher Phase

OpenAI has explained how its safety, security, and transparency practices fit within the European Union’s fast-maturing AI regulatory system. The timing is deliberate.

On August 2, 2026, the European Commission gains enforcement powers over providers of general-purpose AI models under the EU AI Act. The European AI Office will be able to request technical documents, evaluate models, order corrective action, and impose significant fines when companies fail to comply.

In plain English, Brussels can finally start checking whether the industry’s carefully polished promises match reality.

Ahead of the deadline, OpenAI published a statement titled “Advancing Responsible AI Across Europe.” In it, the company confirmed that it contributed to and endorsed two European initiatives: the General-Purpose AI Code of Practice and the Code of Practice on Transparency of AI-Generated Content.

OpenAI argues that much of the necessary machinery already exists inside the company. It tests models before release, publishes system cards, invites external specialists to conduct red-team exercises, and maintains formal frameworks for evaluating extreme risks.

That may sound like a nearly completed compliance checklist, but the situation is more complicated. Signing a voluntary code helps demonstrate regulatory alignment; it does not prove that a company has satisfied every applicable legal requirement.

OpenAI has shown Europe its safety toolbox. Brussels must now examine whether anything important is missing—and one empty compartment is already attracting attention.

Two Codes, Two Different Regulatory Jobs

Although OpenAI endorsed two codes, they address different parts of the AI supply chain.

The General-Purpose AI Code of Practice focuses primarily on powerful models that can perform many tasks and support numerous downstream applications. Its commitments cover transparency and copyright, along with additional safety and security measures for models that create systemic risks.

The Code of Practice on Transparency of AI-Generated Content deals more directly with AI outputs and user awareness. It aims to help companies mark synthetic material, disclose when content has been generated or manipulated by AI, and give people more context about what they encounter online.

The distinction is crucial because model documentation and content labelling are not interchangeable.

A provider may document a model’s architecture, capabilities, training process, evaluations, and limitations. That work largely falls within the general-purpose AI framework. Separately, an application may need to inform users that they are communicating with an AI system or attach machine-readable provenance information to synthetic media.

OpenAI operates on both sides. It develops foundation models, runs ChatGPT, generates multiple forms of media, and supplies APIs that other companies use to build products.

As a result, its compliance challenge resembles a sprawling control panel rather than one convenient switch. Model-level transparency, system-level disclosures, copyright policies, cybersecurity controls, and output provenance all require separate attention.

That complexity explains why endorsing both codes makes sense. It also explains why a cheerful announcement cannot settle every compliance question.

The Safety Machinery Behind OpenAI’s Strategy

OpenAI points to several established practices as evidence that its operations already align with European expectations.

Before releasing major models, the company conducts capability and safety evaluations. It then publishes system cards containing information about performance, limitations, test results, and identified risks. External specialists also participate through OpenAI’s Red Teaming Network, where they deliberately probe models for dangerous behavior and exploitable weaknesses.

The company’s public Model Spec adds another layer. It explains how OpenAI intends its systems to behave when following instructions, handling conflicting requests, responding to harmful prompts, and balancing usefulness against safety constraints.

Two formal frameworks support these activities.

OpenAI introduced its Preparedness Framework in 2023 and updated it in 2025. It provides a structure for identifying, evaluating, and managing serious risks from increasingly capable AI systems.

The newer Frontier Governance Framework builds on that foundation. According to reports from AI News and 4sysops, the document connects OpenAI’s existing safety practices with emerging legal requirements, including the GPAI Code.

Its primary risk categories include cyber offence, chemical and biological threats, harmful manipulation, and loss of control. OpenAI uses the combined frameworks to guide model evaluations, safeguards, security controls, incident response, external consultation, and regulatory reporting.

This structure is more meaningful than a vague promise to develop “responsible AI.” Still, frameworks only reveal what a company says should happen. Their credibility ultimately depends on what management does when safety concerns collide with commercial pressure.

A Signature Is Not a Regulatory Force Field

The GPAI Code gives companies a practical route for demonstrating how they satisfy relevant provisions of the EU AI Act. It does not replace the legislation, and signing it does not produce instant compliance.

The European Commission’s official guidance says adherence can serve as a means of demonstrating compliance. However, it does not create an automatic presumption that the signatory has fulfilled every legal obligation.

That distinction matters enormously.

A provider must implement the commitments it accepts, maintain the necessary documentation, and show that its safeguards function outside a corporate presentation. Regulators may examine whether evaluations cover relevant risks, whether reporting remains complete, and whether mitigation systems perform effectively in real deployments.

Companies can decline to sign the code and use another approach, but the alternative is hardly a free pass. A non-signatory must explain why its own measures adequately satisfy the legislation, potentially through detailed comparisons with the officially approved framework.

Signing therefore gives OpenAI a clearer pathway and may streamline its dealings with the European AI Office. It does not offer immunity, formal certification, or a shiny “Brussels Approved” badge for the lobby.

Under the Act, the AI Office can request information, perform model evaluations, demand risk mitigations, and order corrective action. In extreme circumstances, regulators could require a model’s withdrawal from the European market.

Fines for violating GPAI obligations can reach €15 million or 3% of worldwide annual turnover, whichever amount is higher. Suddenly, governance is not merely a reputation exercise. It can hit the balance sheet with the grace of a falling piano.

The Copyright Question OpenAI Barely Discussed

OpenAI’s European statement spends considerable time on safety evaluations, cybersecurity, external testing, model reporting, and synthetic-media provenance. Copyright receives far less attention.

That omission has become one of the central criticisms of the announcement.

As Tech Times reports, the GPAI Code includes a copyright chapter requiring providers to maintain a policy for complying with European copyright law. Covered companies must also publish a sufficiently detailed summary of the material used to train their models.

OpenAI’s statement does not explain how the company meets those requirements. It provides no detailed public discussion of how OpenAI handles rights holders’ text-and-data-mining reservations, nor does it direct readers to a completed training-content summary for every relevant model.

The omission does not automatically establish a legal violation. A public announcement is not a complete regulatory dossier, and OpenAI may have provided additional information privately to European authorities.

Nevertheless, the silence stands out because training data remains one of the most contentious issues surrounding generative AI.

The Commission’s training-content summary guidance does not require companies to reveal every individual book, article, image, or website included in a training set. Instead, providers must supply meaningful information about data categories, principal sources, collection methods, and processing practices.

OpenAI talks openly about red-teaming and catastrophic-risk evaluations. Its account of training-data composition remains considerably less transparent.

Rights holders will notice that imbalance. Regulators almost certainly have.

OpenAI’s Models Do Not All Share One Deadline

The EU AI Act’s timetable contains several moving parts, which makes careless summaries especially dangerous.

The legislation entered into force on August 1, 2024. Its restrictions on prohibited AI practices and its AI-literacy provisions began applying in February 2025, while obligations for general-purpose AI providers started applying on August 2, 2025.

However, European rules treat older and newer models differently.

According to the Commission’s guidelines for GPAI providers, models placed on the European market after August 2, 2025, must comply with the applicable GPAI obligations. Providers of models already available before that date receive a transition period lasting until August 2, 2027.

The Commission’s enforcement powers begin on August 2, 2026.

Three dates therefore shape the immediate picture:

August 2, 2025: GPAI obligations began applying.
August 2, 2026: the Commission’s enforcement and fining powers began.
August 2, 2027: the transition period ends for older GPAI models.

This schedule prevents an overly broad claim that every OpenAI model must immediately satisfy every new requirement in precisely the same way. Some systems remain within a transitional period, while newer releases do not receive the same runway.

For OpenAI, the date on which a model enters the European market now carries significant legal consequences. A major launch no longer revolves only around benchmarks, pricing, context windows, and a dazzling collection of adjectives.

It may also start a new compliance clock.

The Difficult Business of Labelling AI Content

OpenAI says its approach to content provenance relies on two complementary technologies: C2PA Content Credentials and Google’s SynthID.

C2PA credentials attach signed provenance information to supported media files. That information can identify the system involved in creating or editing the material, helping compatible platforms and tools show users where the content came from.

The weakness is straightforward: metadata can disappear. Screenshots, file conversions, social-media processing, and ordinary editing may strip away the information.

SynthID takes another approach by embedding an imperceptible signal into generated media. Depending on the format and implementation, the signal may survive transformations that destroy ordinary metadata. OpenAI is using provenance measures for images and expanding its work into audio.

Combining both technologies provides stronger coverage than relying on either one alone, but neither method is invincible. OpenAI acknowledges that labels may not travel across platforms and that no provenance technique works perfectly in every situation.

Text creates an even more stubborn problem.

As Nerds.xyz explains, a text watermark may rely on subtle statistical patterns in word selection. Paraphrasing, translation, editing, or passing the material through another model can weaken or erase those patterns.

Short passages may not contain enough information for reliable detection. False positives could also lead schools, publishers, employers, and online platforms to misclassify human writing as machine-generated.

The EU requires machine-readable marking where it is technically feasible. For AI-generated text, that phrase may become the battleground.

Cybersecurity Reveals Why Static Rules Will Struggle

OpenAI presents cybersecurity as an example of why responsible governance must adapt alongside technology.

Advanced models can help defenders analyze malicious software, find vulnerabilities, investigate incidents, and respond to attacks. The same underlying capabilities may help criminals automate reconnaissance, scale phishing operations, or perform sophisticated technical tasks with less expertise.

A simplistic policy could block every request that resembles hacking. Unfortunately, that would also obstruct legitimate researchers and defensive teams.

OpenAI’s frameworks attempt to manage the conflict through capability testing, access controls, monitoring, safeguards, and incident-response procedures. The company also works with external organizations, including the Frontier Model Forum, the US Center for AI Standards and Innovation, and the UK AI Security Institute.

These relationships can support shared testing practices and give outside specialists a role in evaluating advanced models.

Yet, as Scalevise observes, the published framework does not establish a formal policy for slowing AI development.

OpenAI identifies severe risks while describing systems designed to evaluate and mitigate them, but it does not specify the point at which those findings would trigger a delayed release, reduced deployment, or coordinated action with competing laboratories.

That unresolved issue sits at the center of frontier governance.

A company can publish an impressive safety framework when the decisions remain hypothetical. The genuine test arrives when a commercially valuable model produces troubling evaluation results days before launch.

At that moment, someone must decide whether safety outranks speed. Brussels will want to know who makes that decision and what evidence guides it.

What OpenAI Customers Must Do Themselves

OpenAI’s regulatory commitments do not automatically protect businesses that build products using its models.

A company may integrate an OpenAI model into customer support, educational software, hiring tools, financial services, healthcare applications, or workplace systems. Depending on what it builds and how it offers the product, the company could become a deployer, downstream provider, or provider under the AI Act.

Each role carries different responsibilities.

Article 50 transparency requirements begin applying on August 2, 2026. In relevant circumstances, users must be informed that they are interacting with an AI system. Providers and deployers can also face marking or labelling obligations for synthetic and manipulated content.

The Commission has allowed a limited transition until December 2, 2026, for certain marking and detection duties affecting systems already on the market before August 2. That window does not suspend the entire transparency regime.

Businesses serving European users should therefore identify every AI system they operate, determine their legal role, classify relevant use cases, examine vendor documentation, and review user-facing disclosures.

They must also check whether a particular application belongs to a high-risk category. An AI-powered writing assistant does not carry the same regulatory profile as software used to evaluate job applicants or make decisions about access to essential services.

Using a reputable foundation-model provider may strengthen a company’s vendor review. It does not eliminate the company’s independent obligations.

“Powered by OpenAI” is a technical description. It is not a legal invisibility cloak.

OpenAI Has Presented a Map, Not Proof of Arrival

OpenAI’s European compliance strategy contains substantial mechanisms rather than empty slogans. The company uses formal risk frameworks, system cards, outside testing, incident-response processes, provenance technology, and collaboration with public institutions.

Endorsing Europe’s codes also represents a pragmatic choice. Instead of rejecting the emerging regime, OpenAI is trying to translate its existing governance structure into language regulators can evaluate.

Even so, the announcement should not be mistaken for a certification of complete compliance.

The limited public discussion of copyright policy and training-content summaries leaves an obvious unresolved issue. Reliable labelling of AI-generated text remains technically uncertain, while the company’s governance frameworks do not establish a precise threshold for delaying an advanced model when the risks become uncomfortable.

OpenAI has described processes for identifying hazards, evaluating capabilities, consulting experts, and implementing safeguards. What the documents cannot yet demonstrate is how the company will respond when those processes produce an answer that conflicts with its commercial ambitions.

Europe’s enforcement powers make that question more than academic.

Regulators can now move beyond principles and policy statements by requesting technical documentation, examining models, requiring corrections, and imposing financial penalties. The next phase of the EU AI Act will therefore focus less on what companies promise and more on what they can prove.

OpenAI has presented the map.

Brussels is preparing to inspect the territory.

Sources

Kingy Launch Brief

The public Friday pilot has not sent its first issue yet. Join for a source-checked launch briefing with a clear try, watch or skip verdict, then check your inbox and confirm your address.

Free · Friday pilot · Double opt-in · Unsubscribe anytime