Harmonizing Safety Practices: Aligning OpenAI with the EU AI Act’s GPAI Code

OpenAI’s Commitment to Safety, Security, and Transparency in Alignment with EU AI Act’s GPAI Code

As enforcement of the EU AI Act approaches, OpenAI has detailed how it aligns its safety, security, and transparency efforts with the GPAI Code.

The company has actively endorsed and contributed to the General-Purpose AI (GPAI) Code of Practice and the Code of Practice on Transparency of AI-Generated Content, both of which have stemmed from collaborative multi-stakeholder processes.

The GPAI Code establishes a common standard for transparency, safety, and security for general-purpose models being sold or deployed within the EU. OpenAI highlights several existing practices that demonstrate its adherence to this standard, such as pre-release testing of models, publication of system cards with major launches, and engagement with external red-teaming through its Red Teaming Network. Additionally, the company maintains a public Model Spec document outlining how it influences model behavior.

Underpinning these practices are two internal frameworks: the Preparedness Framework, established in 2023 and updated in 2025, which lays out OpenAI’s approach to identifying and managing serious risks from advanced systems; and the Frontier Governance Framework, which builds upon the Preparedness Framework by aligning the company’s safety and security practices with legal requirements, including those outlined in the GPAI Code.

According to OpenAI, these frameworks govern various aspects such as risk assessment, safeguards, model reporting, security posture, incident response, and the involvement of external experts in the process.

In addition to its participation in the Frontier Model Forum, OpenAI collaborates with the US Center for AI Standards and Innovation and the UK AI Security Institute, contributing to third-party evaluation standards to promote shared safety research and establish clearer testing benchmarks across the industry.

Challenges in Provenance Identification as AI Modalities Expand

The Transparency Code focuses on facilitating the identification of content created or altered by AI, especially as AI modalities increase.

OpenAI’s strategy revolves around two mechanisms designed to complement each other: Content Credentials, based on the C2PA standard, which attaches context directly to a file; and SynthID watermarking, offering a secondary signal in cases where metadata is removed during transmission.

Efforts are underway to extend provenance measures from images to audio outputs, with plans to encompass additional modalities like text as standards and tools evolve. OpenAI is also developing signals and guidance for developers integrating its models to meet transparency obligations.

Recognizing that no single mechanism can fully address provenance challenges due to potential metadata loss or label alterations, OpenAI advocates for a layered approach coupled with ongoing collaboration within the standards community.

Cybersecurity and Adaptive Governance

OpenAI acknowledges the dual nature of capabilities that aid in identifying and fixing vulnerabilities, which could also be exploited by attackers. To address this, the company introduces its Trusted Access for Cyber program, aimed at providing vetted defenders with advanced cyber capabilities while mitigating misuse risks.

The European deployment arm of this program, known as the EU Cyber Action Plan, was launched in early May 2026. OpenAI collaborates with EU and national cyber agencies, private sector partners, and infrastructure operators to grant access to advanced cyber models, with the goal of enhancing cyber resilience across the continent.

While OpenAI asserts that the program contributes to bolstering cyber defenses, independent verification of its efficacy is not provided in the source material. The initiative aligns with the European Commission’s Action Plan on Cybersecurity and Artificial Intelligence, emphasizing coordinated risk management and defensive capacity-building.

OpenAI commits to adapting its compliance strategy as the EU AI Act implementation progresses, emphasizing the importance of regulatory flexibility to accommodate evolving technology. As the GPAI Code and the Transparency Code are relatively new frameworks, OpenAI’s compliance efforts are continually evolving, necessitating thorough due diligence from teams utilizing its models in regulated European markets.

Discover more insights: Learn about Meta’s personal AI superintelligence strategy detailed by Zuckerberg

For expert insights on AI and big data: Explore the AI & Big Data Expo in Amsterdam, California, and London, part of the TechEx event series alongside the Cyber Security & Cloud Expo. Visit here for more information.

AI News is a publication by TechForge Media. Explore upcoming enterprise technology events and webinars here.