Code of Practice

A Code of Practice is a set of practical guidelines issued by regulatory bodies to operationalize legal requirements. In the context of the EU AI Act, the European Commission released the final draft of the General-Purpose Artificial Intelligence (GPAI) Code of Practice on July 10, 2025. This document translates abstract legal obligations into specific technical and management measures. It covers three core areas: transparency, copyright, and safety and security. Unlike the AI Act itself, which provides the legal mandate, the Code of Practice provides the 'how-to' for compliance. For enterprises, this means the Code serves as the primary technical specification for AI system development and deployment. It complements international standards like ISO/IEC 42001 by providing sector-specific implementation details. Understanding these codes is essential for any organization deploying AI within the EU market, as they represent the regulator's interpretation of what 'adequate measures' actually mean in practice.

Implementation typically follows a three-stage approach: Gap Analysis, Control Implementation, and Continuous Monitoring. In the Gap Analysis stage, enterprises must map their existing AI systems against the specific requirements of the Code of Practice, such as data-use transparency and model-level safety testing. The second stage involves implementing controls, which might include establishing a 'human-in-the-loop'-supervision mechanism or a copyright-clearing process for training data. For example, a company deploying a generative AI tool would need to document the provenance of all training data to comply with the Code's copyright provisions. The final stage is Continuous Monitoring, where the enterprise maintains real-time-tracking of AI model performance and risks. Successful implementation can lead to a measurable reduction in compliance-related risks—for instance, reducing the risk of regulatory fines by up to 80% through proactive documentation and testing protocols. Companies that integrate these codes into their ISO 42001 management systems typically see a 50% faster path to regulatory approval.

Taiwan enterprises face three primary challenges: Regulatory Interpretation, Technical Resource Constraints, and Supply Chain Complexity. First, the EU AI Act's requirements can be ambiguous; companies should partner with legal experts to interpret the Code of Practice's specific technical mandates. Second, the technical documentation requirements—such as detailed model cards and impact assessments—often exceed the capabilities of smaller firms. The solution is to adopt standardized frameworks like ISO/IEC 42001 or NIST AI RTO from the outset to create a scalable foundation. Third, many Taiwan companies are AI users rather than developers, making it difficult to obtain necessary technical data from overseas vendors. To overcome this, companies must include 'Compliance-as-a-Service' clauses in vendor contracts, requiring suppliers to provide documentation that meets the Code of Practice standards. A phased approach—starting with a 90-day pilot program—is recommended to manage costs and resources effectively.

Winners Consulting Services Co., Ltd. specializes in Code of Practice for Taiwan enterprises, delivering compliant management systems within 90 days. Free consultation: https://winners.com.tw/contact