EU's new AI Code of Practise brings fresh compliance for UK firms
The European Union's General-Purpose AI Code of Practise has officially come into effect, setting out new voluntary standards for AI development and deployment in the region.
The publication of the Code by the European Commission and the EU AI Office is a notable milestone in the ongoing implementation of the EU AI Act, which became law in 2024. This Act stands as the world's first comprehensive legal framework for the regulation of artificial intelligence, targeting systems that are widely used and rapidly evolving in sophistication.
Responsibilities for UK businesses
Wayne Cleghorn, partner at Excello Law and a member of the working group responsible for drafting the Code, has urged UK organisations to carefully assess their AI systems to determine whether they fall within the scope of the new EU regime. Cleghorn also serves as a European Commission-appointed independent expert in AI, data governance, and cybersecurity.
He has played a central role in shaping the new guidelines and was actively involved in the drafting process undertaken by the working groups since September 2024.
"The work to produce the Code of Practise was a world first. It was intensive, technical, and fast-paced," said Cleghorn. "The final text represents a consensus built under real time pressure. It's a best-effort starting point, and while it will need to evolve, it establishes foundational norms for AI governance."
Although the Code is voluntary, it is expected to have broad impact. Organisations that endorse the standards can benefit from streamlined procedures when demonstrating compliance with the EU AI Act. However, the legal requirements of the Act remain binding even upon those who do not sign the Code.
Cleghorn emphasised that the scope of the EU AI Act extends beyond European borders. UK organisations, particularly those whose AI systems are in use within the EU market, are also affected.
"The reach of the EU AI Act is not limited to EU-based businesses," Cleghorn warns. "UK companies, including those building or deploying AI systems that enter the EU market, could be directly impacted. It's crucial to assess whether your AI systems fall into categories of 'unacceptable', 'high', 'limited', or 'minimal risk' as defined under the Act, and then apply the relevant compliance obligations."
Implementation timeline
The EU AI Act, having come into force in August 2024, is being implemented over several years. A significant milestone will take place in August 2025, requiring all 27 EU member states to appoint Notifying Authorities and Market Surveillance Authorities, formalise local penalty frameworks, and report on the state of their national AI oversight infrastructure.
This phase of implementation will provide greater clarity on the practical application and enforcement of the regulations across the bloc.
"This phase will reveal the real-world scale of the EU's AI regulatory framework," Cleghorn explains. "It will also give UK and international businesses insight into how each member state intends to enforce the law, and how consistent enforcement is likely to be across the EU."
Supporting documentation
Accompanying the new Code are supporting materials, including an AI Model Documentation Form and detailed guidance for General-Purpose AI system providers. These documents are intended to help companies interpret and fulfil their responsibilities under the EU's new AI regime.
Cleghorn commented further on the significance of the Code's introduction:
"This is a landmark moment in the regulation of AI," Cleghorn adds. "Companies in the UK, EU, US and beyond must get a firm grasp of the AI systems they develop, deploy or use. From there, they need to assess how the EU AI Act, and overlapping regulatory regimes, apply to them. In most cases, this requires assembling multidisciplinary internal teams and seeking targeted legal and regulatory advice. Staying ahead of the evolving rules is no longer optional."
