Published document record

GPAI Code third-draft safety and security chapter

Official metadata

Official title: Third Draft General-Purpose AI Code of Practice — Safety and Security
Document type: Code of practice
Document date: 2025-03-11
Document date kind: Publication
Document-date evidence: European Commission · Third-draft page field 'Publication 11 March 2025' and download 'Third Draft – Safety and Security' (113608). — Establishes 2025-03-11 as this exact record's publication-based document date.
Publication date: 2025-03-11
Publication-date evidence: European Commission · Third-draft page field 'Publication 11 March 2025' beside exact Safety and Security file 113608. — Establishes 2025-03-11 as first official publication for this exact version or release.
Version label: Third draft — Safety and Security
Legal status: Non binding
Language: en

Research classifications

These are researcher classifications used to organise and analyse the corpus; they are not official EU metadata.

Record level

Attachment

Version status

Draft

Temporal collection

Contemporary EU AI policy

Relevance class

Direct AI relevance

Policy stage

Consultation

Corpus tier

Core

Sectors

Policy membership

Classification evidence

Relevance class: Direct AI relevance · European Commission · Exact Safety and Security artifact 'Third Draft General-Purpose AI Code of Practice — Safety and Security': named commitments, measures or form fields implementing GPAI transparency, copyright or systemic-risk obligations. — The artifact directly governs, interprets, evaluates or operationalises EU artificial-intelligence policy rather than merely mentioning AI.
Sector tags: General cross sector · European Commission · Commission download 113608, Third Draft GPAI Code of Practice - Safety and Security: introductory note, PDF p.1; recitals (a)-(c), PDF p.2, especially recital (b)'s scope restriction to providers of GPAI models with systemic risk rather than AI systems. Lifecycle/value-chain risk assessment supports the cross-sector tag, not applicability to every model or system. — The retained general_cross_sector tag is supported by the artifact's horizontal AI-policy scope.
Provenance tags: Officially published · European Commission · Third-draft page field 'Publication 11 March 2025' beside exact Safety and Security file 113608. — The exact version is distributed through an official EU institutional endpoint.
Sector tags: Intellectual property · European Commission · Third-draft Safety and Security, official linked PDF 113608, p.40 Measure II.11.1 and p.43 continuation of the Summary of changes from the second draft. — The proposed external-assessor access condition protects commercially confidential information; the accompanying explanatory box specifically identifies trade-secret protection and explains refusal of assessors who will not respect it. This is bounded trade-secret subject coverage, not a claim that this chapter contains copyright-compliance measures. Model-weight security, licensing references and a keyword search alone are not the basis.
Sector tags: Cybersecurity · European Commission · Third-draft Safety and Security, PDF 113608, pp.26-28 Commitment II.7 and Measures II.7.1-II.7.8; p.56 Appendix 1.1(1). — Proposes specific cybersecurity, access-control and incident-response safeguards and identifies offensive cyber capabilities as a selected systemic-risk type.
Sector tags: Critical infrastructure · European Commission · Third-draft Safety and Security, PDF 113608, p.45 Measure II.12.3(1); p.56 Appendix 1.1(1). — Specifies an incident-reporting timetable for serious irreversible disruption of critical infrastructure and expressly identifies attacks on critical systems in risk selection.
Sector tags: Health · European Commission · Third-draft Safety and Security, PDF 113608, p.45 Measure II.12.3(2)-(3); p.57 Appendix 1.2(1). — Distinguishes serious health harm and grave physical-integrity harm in proposed incident-reporting triggers and identifies public-health risks for consideration. This is health-risk governance, not a claim of medical-device regulation.
Sector tags: Agriculture and environment · European Commission · Third-draft Safety and Security, PDF 113608, p.45 Measure II.12.3(3); p.57 Appendix 1.2(3). — Specifically addresses serious environmental harm in reporting and environmental risks in the taxonomy. The combined vocabulary term is supported by environment, not agriculture.
Sector tags: Research and innovation · European Commission · Third-draft Safety and Security, PDF 113608, p.18 Measure II.4.9; pp.41-42 Measure II.11.2; p.57 Appendix 1.1(4). — Proposes exploratory research, API access and credits for independent non-commercial research, a conditional researcher safe harbour, and assessment of autonomous AI research/development risks. These are substantive provisions, not references to scientific publications alone.
Sector tags: Employment and labour · European Commission · Third-draft Safety and Security, PDF 113608, pp.46-47 Commitment II.13 and its explanatory material. — Proposes non-retaliation protection for workers reporting model systemic risks. The draft commitment is distinguished from its potential recital summarising whistleblower law.
Sector tags: Defence and security · European Commission · Third-draft Safety and Security, PDF 113608, p.56 Appendix 1.1(2); p.58 Appendix 1.4.1(2). — Identifies AI-enabled chemical, biological, radiological and nuclear weapon acquisition/proliferation and attacks as systemic-risk concerns. This is security-risk coverage, not an assertion that the draft authorises military uses or governs defence procurement.
Sector tags: Consumer protection · European Commission · Third-draft Safety and Security, PDF 113608, p.23 Measure II.4.14, paragraph on cooperation with licensees, downstream providers and end-users. — Specifies that consumer end-users should be offered an opt-in choice when sharing post-market information in this proposed cooperation mechanism. This is a bounded consumer-choice safeguard, not a general consumer-law code.
Sector tags: Financial services · European Commission · Third-draft Safety and Security, PDF 113608, p.57 Appendix 1.2(3), read with p.10 Measure II.3.1 and p.31 Measure II.8.3(1). — Expressly identifies financial-system stability in the operational taxonomy of other risks for potential selection and documentation. This is conditional systemic-risk subject coverage, not financial-service authorisation or an assertion that it is one of the four selected risk types in Appendix 1.1.
Sector tags: Media and culture · European Commission · Third-draft Safety and Security, PDF 113608, p.57 Appendix 1.2(2)-(3), read with p.10 Measure II.3.1 and p.31 Measure II.8.3(1). — Identifies freedom of expression, synthetic intimate/abuse imagery and illegal, violent, hateful or false content in the taxonomy of other risks for potential consideration. The label denotes information/content risks, not a cultural-industry programme or an Appendix 1.1 selected risk type.

Production provenance

Provenance tags

Named bibliographic authors

Matthias Samwald · European Commission · Exact linked Safety and Security chapter names its chairs and vice-chairs as authors.
Yoshua Bengio · European Commission · Exact linked Safety and Security chapter names its chairs and vice-chairs as authors.
Marietje Schaake · European Commission · Exact linked Safety and Security chapter names its chairs and vice-chairs as authors.
Marta Ziosi · European Commission · Exact linked Safety and Security chapter names its chairs and vice-chairs as authors.
Daniel Privitera · European Commission · Exact linked Safety and Security chapter names its chairs and vice-chairs as authors.
Anka Reuel · European Commission · Exact linked Safety and Security chapter names its chairs and vice-chairs as authors.
Alexander Zacherl · European Commission · Exact linked Safety and Security chapter names its chairs and vice-chairs as authors.
Nitarshan Rajkumar · European Commission · Exact linked Safety and Security chapter names its chairs and vice-chairs as authors.
Markus Anderljung · European Commission · Exact linked Safety and Security chapter names its chairs and vice-chairs as authors.

Institutions and roles

European AI Office · Commissioner · role evidence · Official Commission page expressly says the AI Office appointed the chairs and vice-chairs leading drafting.

Official sources and identifiers

Official source · Publisher/host: European Commission
Official source · Publisher/host: European Commission

Parent or principal record

Parent or principal record: GPAI Code third draft

Part of · Official relationship · Verified

Research assessment

Inclusion rationale: Verified official English text within the AI Act implementation and amendment corpus.
Researcher notes: Official metadata is transcribed from the cited source; corpus tier and policy-stage classification are researcher assessments.
Review status: verified

Relationships

No additional published relationships touch this record.

Verification

Expanded evidence review: Verified

Reviewed by: Yichen Hao
Evidence review date: 2026-09-05T18:07:46Z

The evidence review date is not a separate human sign-off date. Review credit and evidence-review actions

Last verified: 2026-09-05T17:58:09Z · Live official-page review on 5 September 2026. The Commission page names the thirteen chairs and vice-chairs leading the GPAI Code drafting process and expressly states that the AI Office appointed them; it is used for named external-author and commissioning evidence, not as evidence that the Commission or AI Office authored the Code.
Last verified: 2026-09-05T17:58:09Z · Official library page published 11 March 2025 supplies the third-draft overview and separate Commitments, Transparency, Copyright, and Safety and Security English files (newsroom documents 113606, 113607, 113605, 113608). Narrow verification on 2026-09-05 checked the landing-page structure, stated purposes and download labels recorded in research/migrations/2026-09-05-relationship-evidence-migration.json; linked binary file interiors and retained bytes were not verified in this review, and no source snapshot was retained. Live re-review by AI-assisted reviewer on 5 September 2026 checked the official endpoint and exact-version identity, substantive scope, relevant dates and institutional attribution; prior verification history and retrieved_at are retained.

Return to the Corpus