OpenAI Adopts EU AI Act Safety Standards for General Purpose AI Compliance

OpenAI has outlined how it aligns safety, security, and transparency work with the EU AI Act's GPAI Code as enforcement approaches. The company has contributed to and endorsed the EU's General-Purpose AI (GPAI) Code of Practice and the Code of Practice on Transparency of AI-Generated Content. Both emerged from multi-stakeholder processes.

📋 GPAI Code Compliance Framework

The GPAI Code sets a shared bar for transparency, safety, and security across general-purpose models sold or deployed in the EU. OpenAI points to a stack of existing practices as evidence it already operates near that bar:

• Pre-release testing of models
• Published system cards accompanying major launches
• Outside red-teaming through its Red Teaming Network
• Public Model Spec document describing how it shapes model behaviour

Two internal frameworks sit underneath that work: The Preparedness Framework (in place since 2023, updated in 2025) identifies, evaluates and manages serious risks from advanced systems. A separate Frontier Governance Framework maps safety and security practices onto legal requirements including the GPAI Code specifically.

Together, OpenAI says, those two documents govern risk assessment, safeguards, model reporting, security posture, incident response, and how external experts get pulled into the process.

OpenAI cites its participation in the Frontier Model Forum alongside collaborations with the US Center for AI Standards and Innovation and the UK AI Security Institute, plus contributions to third-party evaluation standards more broadly. The stated goal is shared safety research and clearer testing benchmarks across the industry, not just within one company's walls.

🔍 Provenance Gets Harder as Modalities Multiply

The Transparency Code commitments centre on a different problem: helping people tell when content was made or altered by AI.

OpenAI's approach rests on two mechanisms that are meant to reinforce each other:

• Content Credentials — built on the C2PA standard, attach context directly to a file
• SynthID watermarking — provides a fallback signal for cases where metadata gets stripped out

Coverage is expanding from images into audio outputs, and OpenAI says it's working toward extending provenance measures across further modalities, including text, as the underlying standards and tooling mature. The company is also building signals and guidance aimed at developers who need to meet their own transparency obligations when building on top of its models.

🔐 Cybersecurity as the Test Case for Adaptive Governance

Capabilities that help defenders spot and patch vulnerabilities are the same capabilities that could help an attacker find them first. OpenAI believes the answer is its Trusted Access for Cyber programme, designed to give vetted defenders access to more advanced cyber capabilities while limiting exposure for misuse.

That programme now has a European deployment arm. OpenAI states it launched its EU Cyber Action Plan in early May 2026, working with EU and national cyber agencies, private sector partners, and infrastructure operators to give them access to its more advanced cyber models.

The stated aim of the plan is to strengthen cyber resilience across the continent. Whether "most advanced" translates into measurable defensive gains inside these agencies is a claim from OpenAI itself; the source material offers no independent verification of outcomes from the programme.

The company positions this work as consistent with the European Commission's Action Plan on Cybersecurity and Artificial Intelligence, which calls for coordinated handling of AI's risks alongside its use in strengthening defensive capability, including secure access arrangements for cybersecurity purposes specifically.

🔄 Ongoing Adaptation and Implementation

OpenAI says it will keep adjusting its compliance approach as EU AI Act implementation continues, and that it expects to keep learning from regulators and the wider community involved in shaping the rules. The company argues that rules need enough flexibility to adapt as the technology moves, so that businesses and organisations can keep benefiting from it.