Code of Practice

Laws are often worded in general terms. A law might require a company to “provide sufficient information about risks” – but it doesn’t say which form to fill out for that. This is exactly the gap a Code of Practice fills. It’s a written guide in which companies within an industry agree on concrete work steps intended to fulfill a law. No one has to sign it: participation is voluntary. But those who do sign are more easily considered compliant during inspections, because the authority accepts the agreed-upon steps as a recognized form of implementation. The German term for this is usually “Verhaltenskodex.”

The bridge between legal text and everyday business practice

For companies, legal uncertainty is costly. When it’s unclear exactly what a regulation requires, you have to pay lawyers and still risk penalties. A Code of Practice reduces this risk because it translates requirements into a checklist. This is especially important for smaller firms that don’t have their own legal department.

For the state, the process has a different advantage: it’s fast. Amending a law in the EU often takes years, because both parliament and member states must agree. A guide can be rewritten within months. For technologies that change as quickly as AI, that’s a real difference.

Criticism exists nonetheless. Those who help write the rules they will later have to follow tend to write them conveniently. Consumer advocates therefore sometimes speak of self-regulation serving as a fig leaf. Others counter: a somewhat too-lenient guide that is actually followed has more impact than a strict law that nobody understands.

How such a code comes about and what it achieves

At the start, there is usually an authority that invites parties to the table. For the European AI Code, this was the AI Office of the EU Commission, a supervisory body for artificial intelligence established in 2024. Also involved are companies, academics, and organizations from civil society. Over several rounds, drafts emerge on which all participants provide comments. For the AI Code, there were around a thousand participants and three drafts before the final version in the summer of 2025.

The finished text is not a law and creates no new obligations. It merely describes how existing obligations can be fulfilled. That’s why it typically doesn’t say “the company must,” but rather “the signatory commits to.” Those who sign are listed on a public register.

If a signatory breaks its promise, it loses the presumption of trust. The authority then checks for itself whether the law is being complied with and can impose fines. So the code is less a contract than an offer: stick to our proposals, and we’ll ask fewer questions.

The EU Code for AI models and other examples

The best-known case in tech news is the EU’s General-Purpose AI Code of Practice. It targets providers of large, versatile AI models, such as those behind chatbots like ChatGPT. It has three chapters: transparency, copyright, and safety. Specifically, providers are expected to, among other things, document what data they trained on and respect websites that prohibit automated scraping of their content.

Among those who signed are OpenAI, Google, Microsoft, and Anthropic. Meta declined, citing legal uncertainty and overregulation as reasons. Such decisions are newsworthy because they show how the balance of power between corporations and regulators is evolving.

However, Codes of Practice exist far beyond AI: in advertising, mining, and the food industry. The term is easily confused with a Code of Conduct. The latter usually governs the behavior of a company’s own employees, covering topics like corruption or workplace conduct. A Code of Practice, by contrast, is directed outward and explains how an entire industry fulfills a legal requirement.