Feedback on the Third Draft of the GPAI CoP

The third draft of the "General Purpose AI Code of Practice" promises some ground rules for large AI providers. However, questions of liability and the role of external evaluations remain unclear. "The planned rules could expose start-ups and smaller companies to unpredictable risks, as it remains unclear when companies will have to assume comprehensive liability when fine-tuning existing AI models," explains cep digital expert Anselm Küsters, who wrote the analysis and submitted it to the European Commission as part of the multi-stakeholder process. "There is an urgent need for threshold values to determine when these companies are considered independent AI providers."

The cep analysis warns of weakening earlier versions of the Code. The risk taxonomy has been watered down and external audits have been severely restricted. "These loopholes jeopardise the level playing field by favouring dominant market players who can carry out internal audits more easily," warns Küsters. The dismantling of explicit whistleblower protection measures also harbours the danger that critical information about AI risks will not be discovered in time. Further risks would arise from the elimination of regular reassessments of AI systems. Following the current draft, they would be conducted on an ad hoc basis. According to Küsters, this opens up governance gaps: "AI technology is developing exponentially, and risks can arise unexpectedly - regular checks are therefore crucial".

The cep calls for significant improvements. The Code must do more than simply reflect the status quo. "The current draft is largely limited to codifying the current practices of large American technology companies. This does not go far enough to proactively protect fundamental rights and prepare for future threats," argues Küsters. "The AI Code needs to promote innovation, protect small companies, and set clear standards - instead of merely modelling existing market structures."