OpenAI has endorsed the European Union’s General-Purpose AI Code of Practice and a separate code covering transparency of AI-generated content. The company says its existing testing, governance and provenance work already aligns closely with the emerging requirements.
The endorsement is a significant compliance signal, but it does not transfer responsibility from organisations deploying OpenAI models. System cards and vendor frameworks are inputs to European due diligence, not proof that a particular application complies with the EU AI Act.
OpenAI maps existing safety work onto the GPAI Code
The GPAI Code establishes a shared approach to transparency, safety and security for general-purpose models offered in the EU. OpenAI points to pre-release evaluations, system cards for major models, external red-teaming and its public Model Spec as evidence of established practice.
Two internal structures organise that work. The Preparedness Framework, introduced in 2023 and updated in 2025, describes how the company identifies, evaluates and mitigates serious risks from advanced systems. The newer Frontier Governance Framework explains how safety and security practices map to legal requirements, including the GPAI Code.
Together, the documents cover risk assessment, safeguards, reporting, security, incident response and the involvement of outside experts. OpenAI also cites collaboration through the Frontier Model Forum, the US Center for AI Standards and Innovation and the UK AI Security Institute.
These materials provide customers with useful evidence, but implementation continues to evolve. Buyers should retain the system card and model version used in each deployment, track later changes and determine which vendor controls are active in their own configuration.
The relevant compliance object is not the model in isolation. A company may add retrieval, tools, personal data and automated decisions that introduce risks absent from the provider’s general evaluation. Application owners still need intended-use documentation, human oversight, monitoring and incident procedures.
Provenance needs several imperfect signals
The Transparency Code addresses how people can recognise content made or altered by AI. OpenAI’s approach combines Content Credentials based on the C2PA standard with SynthID watermarking.
Content Credentials attach creation context to a file. That metadata can disappear when a platform processes, screenshots or re-exports the material. Watermarking offers a second signal when metadata is stripped, but no watermark reliably survives every transformation or detects every generated output.
OpenAI is extending coverage from images to audio and working towards additional modalities, including text, as standards mature. It is also developing guidance and signals for companies building products on its models.
A layered approach is more credible than claiming one universal detector. Developers should preserve provenance metadata through their own pipelines, label generated material at the user interface and document circumstances in which signals may be lost.
Transparency also needs a clear audience. A machine-readable credential helps platforms and investigators, while an ordinary person requires a visible, understandable disclosure. Neither should imply that labelled content is false or that unlabelled content is authentic.
Cyber access shows why governance must adapt to capability
Advanced cyber models can help defenders find and patch vulnerabilities while also assisting attackers. OpenAI’s Trusted Access for Cyber programme gives vetted defenders access to stronger capabilities under additional controls.
An EU Cyber Action Plan launched in May 2026 extends this approach to European and national agencies, infrastructure operators and private-sector partners. OpenAI describes the goal as stronger continental cyber resilience, but has not supplied independent outcome evidence showing measurable defensive gains.
The programme illustrates adaptive access: controls change according to capability, user and purpose. Customers should ask how vetting works, what activity is monitored, how access can be revoked and which incidents trigger notification.
Both EU codes are new, and OpenAI acknowledges that its compliance approach will continue changing as implementation advances. Flexibility is necessary, but regulated customers need stable records of what applied when a consequential decision occurred.
Endorsing the GPAI and Transparency Codes gives OpenAI a framework for explaining its practices to European regulators and customers. The real test comes through auditable operation: whether evaluations expose material risks, provenance survives real distribution and cyber access produces defensible benefits without creating uncontrolled capability. Organisations can use OpenAI’s documentation as a starting point, but their own governance must complete the chain from general-purpose model to specific real-world use.
