Anthropic said on July 21, 2025 that it intends to sign the European Union's General-Purpose AI Code of Practice, the voluntary code designed to help providers of general-purpose AI (GPAI) models show that they comply with the EU AI Act. The announcement came 12 days before the Act's obligations for GPAI model providers started to apply on August 2, 2025. For teams building on Claude or other frontier models, it shows which documentation, copyright and risk practices a major provider will follow in Europe.

Key Facts#

  • Announcement: On July 21, 2025, Anthropic said that, after review, it intends to sign the EU's General-Purpose AI Code of Practice.
  • Legal trigger: Article 113 of the AI Act, Regulation (EU) 2024/1689, makes Chapter V, which holds the rules for GPAI model providers, applicable from August 2, 2025.
  • What the code is for: Articles 53(4) and 55(2) let providers rely on codes of practice to demonstrate compliance with their GPAI obligations until a harmonized standard is published.
  • Systemic-risk threshold: A GPAI model is presumed to have high-impact capabilities, and therefore systemic risk, when the cumulative compute used to train it exceeds 10^25 floating-point operations (Article 51(2)).
  • Fines come later: Article 101 lets the Commission fine GPAI providers up to 3% of worldwide annual turnover or EUR 15 million, whichever is higher, but under the original timetable it applies only from August 2, 2026.
  • Models already on the market: Providers of GPAI models placed on the market before August 2, 2025 have until August 2, 2027 to comply (Article 111(3)).
  • Anthropic's reading: The company says the code's mandatory Safety and Security Frameworks build on its own Responsible Scaling Policy and include the assessment of chemical, biological, radiological and nuclear (CBRN) risks.

What Happened#

Anthropic's statement was short and supportive. It wrote that the code advances transparency, safety and accountability, principles it says it has promoted in frontier AI development for years. It argued that a careful rollout of the AI Act and the code would help Europe use AI to drive innovation and competitiveness rather than hold it back.

Much of the post made an economic case. Anthropic cited an outside estimate that AI could add more than a trillion euros a year to the EU economy by the mid-2030s, presented the code alongside the EU's AI Continent Action Plan as proof that flexible safety standards can coexist with adoption, and pointed to work at Novo Nordisk, Legora and the European Parliament as examples of what is already possible.

On substance, Anthropic said the code sets a transparency baseline through Safety and Security Frameworks that signatories must maintain. These frameworks describe how a provider identifies, assesses and mitigates systemic risks, including catastrophic CBRN risks. Anthropic said they build on the Responsible Scaling Policy it has published since 2023.

The company also argued for flexibility. It noted that it has revised its Responsible Scaling Policy several times since first publishing it, and said the industry is still working out how to assess the systemic risks the code names, with groups such as the Frontier Model Forum helping to set shared evaluation practices. Anthropic committed to working with the EU AI Office and safety organizations to keep the code rigorous as the technology changes.

Background#

The AI Act takes effect in stages. Its general provisions and its list of prohibited practices applied from February 2, 2025, as covered in our report on the first AI Act prohibitions. Chapter V, on general-purpose AI models, followed on August 2, 2025, while the regulation as adopted in 2024 set August 2, 2026 as the date on which most of its remaining provisions apply.

Chapter V places baseline duties on every GPAI provider under Article 53. Providers must:

  1. Maintain technical documentation on the model, including its training, testing and evaluation results, for the AI Office and national authorities.
  2. Give companies that integrate the model enough information to understand its capabilities and limitations and to meet their own obligations.
  3. Adopt a policy for complying with EU copyright law, including honoring rights holders' reservations against text and data mining.
  4. Publish a sufficiently detailed summary of the content used for training, following a template from the AI Office.

The first two duties do not apply to open-source models with public weights, but that exemption never covers models with systemic risk. Those carry extra Article 55 duties: adversarial testing, EU-level risk mitigation, reporting serious incidents to the AI Office and adequate cybersecurity. Article 56 asks the AI Office to encourage codes of practice covering these duties, the role the GPAI code fills.

The decision also fits Anthropic's wider agenda. On July 7, 2025 it had proposed a transparency framework for the largest frontier developers, built on public safety frameworks, system cards and whistleblower protections. In May 2025 it activated ASL-3 protections with the launch of Claude Opus 4 as a precaution against misuse for CBRN weapons development.

Why It Matters for Developers#

Most .NET teams consume models that others train, so they are not GPAI providers. The GPAI chapter still reaches their work.

  • Ask for downstream documentation. Article 53 obliges providers to tell integrators about capabilities and limitations. Request that material from each vendor and keep it with your inventory of AI features as evidence for your own risk assessments. The Responsible AI and LLM security guide covers how to structure that inventory.
  • Track provenance in your own pipelines. If you fine-tune models or build retrieval indexes from crawled content, record sources, licenses and opt-outs from day one, as providers must. Our RAG guide discusses the ingestion pipelines where this matters.
  • Mirror the evaluation mindset. Keep regression evaluations for the prompts and tools you ship, as described in evaluating AI applications in .NET, and log the model identifier and version behind every response so incident reviews start from facts.
  • Check your own role. A team that trains or substantially modifies a general-purpose model and offers it in the EU under its own name should get legal advice on whether it becomes a GPAI provider itself.
  • Keep providers swappable. A vendor's stance on the code may become a procurement criterion for European customers. Routing calls through IChatClient from Microsoft.Extensions.AI turns a provider change into a configuration update.

What's Next#

The next milestones are written into the regulation. Under the 2024 text, the Commission can fine GPAI providers that breach their obligations from August 2, 2026, and providers of models placed on the market before August 2, 2025 must be compliant by August 2, 2027. Codes of practice are meant as a bridge: the Act treats them as a way to demonstrate compliance only until harmonized standards are published.

Anthropic's current policy page lists the code among the international governance efforts it participates in, next to its ISO 42001 certification and the Frontier Model Forum. Open questions remain about how the AI Office will judge adherence and how quickly the code will change as risk-assessment methods mature, issues Anthropic itself raised.

Sources#