By Aarav Sharma | AI Policy Correspondent
The EU's rulebook on artificial intelligence is moving from paper to enforcement, and OpenAI is making its case early. The company has publicly outlined how its safety, security, and transparency work lines up with the bloc's General-Purpose AI Code — and it wants regulators to see that the homework was done before the test was announced.
OpenAI's compliance argument, in one line
OpenAI says the practices it already runs — pre-release testing of models, published system cards for major launches, outside red-teaming through its Red Teaming Network, and a public Model Spec — place it near the bar set by the EU AI Act's GPAI Code of Practice.
The timing is deliberate. Enforcement is approaching, and the company is positioning its existing playbook as the answer before the questions are formally asked.
Why the GPAI Code is the new compliance benchmark
The General-Purpose AI (GPAI) Code of Practice sets a shared bar for transparency, safety, and security across general-purpose models sold or deployed in the EU. For any company placing an AI model on the European market, this is the reference point regulators will measure against.
It emerged from a multi-stakeholder process — not a unilateral EU directive. Industry, civil society, and regulators all had a hand in shaping what counts as responsible AI deployment. That shared authorship gives the code unusual weight.
What OpenAI says it already does
The company points to a stack of existing practices. Pre-release testing happens before models go out. System cards accompany major launches, documenting capabilities and known limits. Outside experts pressure-test models through what OpenAI calls its Red Teaming Network.
Alongside these sits the public Model Spec document, which guides how models should behave. Together, OpenAI argues, these form the foundation the GPAI Code is asking for — just already in operation.
A second code, same spirit
OpenAI has also contributed to and endorsed the Code of Practice on Transparency of AI-Generated Content. That companion framework tackles a related question: making clear when content has been produced or altered by AI.
Both codes came out of multi-stakeholder processes, and both are now part of the compliance landscape OpenAI is positioning itself within as the AI Act's enforcement machinery switches on.
What this means for EU businesses and developers
For companies building on OpenAI's models in the EU, the alignment matters practically. If OpenAI's practices clear the GPAI Code's bar, downstream developers inherit a degree of compliance confidence — obligations at the foundation-model layer get addressed upstream.
The paperwork matters too. System cards, the Model Spec, and red-teaming records are likely to become due-diligence artefacts in procurement reviews and product audits across Europe.
Confirmed facts versus what remains open
Verified from the original outline: OpenAI has endorsed both codes, participated in the multi-stakeholder processes, and cites pre-release testing, system cards, red-teaming, and its Model Spec as aligning practices.
Not yet independently verified: whether EU regulators will accept OpenAI's self-assessment as full compliance. The code sets a bar; whether existing practice clears it in an enforcement review is a separate question that only the coming oversight process can answer.
Why OpenAI's transparency stack carries weight
OpenAI's position rests on a distinctive layer of public documentation. Few AI labs publish a Model Spec designed to steer model behaviour, or pair major releases with system cards describing known limitations. That documentation trail is the real evidence the company is offering.
It also signals a structural advantage: for OpenAI, compliance looks like an extension of processes already embedded in its release workflow. That lowers the cost of adaptation compared with rivals that would need to build these capabilities from scratch.
The other side of the argument
The obvious tension: self-assessment is not external verification. OpenAI saying it operates near the bar is not the same as a regulator confirming it. The GPAI Code's enforcement machinery will test these claims in practice.
Critics may also ask whether documented processes equal demonstrated safety — and whether system cards and red-teaming, however rigorous, fully address the broader societal risks the EU AI Act is designed to manage.
The wider shift: voluntary codes are becoming binding rails
This is part of a larger pattern in AI governance. What began as voluntary, multi-stakeholder codes of practice are hardening into the operational standards regulators now enforce. OpenAI's move is an early recognition that the voluntary phase is ending.
Other frontier AI labs
