The distinction compliance teams need to preserve
For GPAI providers, Annex IV and the GPAI Code of Practice serve related but different compliance functions. Annex IV is the required technical documentation baseline. It is the structure providers must be prepared to maintain and file, with current information about the model, development and training process, testing and evaluation results, limitations, and cybersecurity protections.
The GPAI Code of Practice is not the same document. It is a voluntary conformity-support framework under the AI Act. Its role is to help providers demonstrate how they meet GPAI obligations across transparency, copyright, and, for systemic-risk models, safety and security.
The practical takeaway is straightforward: treat Annex IV as the documentation structure, and use the Code as an evidence-mapping framework. That mapping can organize governance records, security controls, audit trails, and operational compliance practices around the obligations they support.
GPAI Code of Practice vs EU AI Act Annex IV
The comparison below separates the mandatory documentation baseline from the voluntary operating framework and the runtime evidence that can support compliance operations.
| Artifact | Role for providers | Evidence focus |
|---|---|---|
| Annex IV | Mandatory technical documentation covering model description, training, testing, evaluation, limitations, and cybersecurity protections. | Current documentation describing the model, development and training process, testing and evaluation results, limitations, and cybersecurity protections. |
| GPAI Code of Practice | Voluntary conformity-support framework organized around transparency, copyright, and safety and security commitments. | Evidence that helps providers demonstrate how they meet GPAI obligations across transparency, copyright, and, for systemic-risk models, safety and security. |
| Operational evidence | Runtime policies, access controls, audit logs, incident records, and evaluation artifacts can help support documentation and regulator responses. | Governance records, security controls, audit trails, and operational compliance practices mapped to Annex IV fields and Code commitments. |
What Annex IV expects providers to document
Annex IV is the statutory technical documentation baseline for general-purpose AI model providers. It requires current documentation describing the model, development and training process, testing and evaluation results, limitations, and cybersecurity protections.
Because Annex IV documentation is the filing baseline, compliance teams should keep it distinct from broader governance programs. Governance materials can support Annex IV, but the Annex IV package should remain structured around the required documentation categories.
How the Code changes the operating model
The GPAI Code of Practice is a voluntary compliance tool under the AI Act. It helps providers demonstrate how they meet GPAI obligations across transparency, copyright, and, for systemic-risk models, safety and security.
In practice, the Code can function as an evidence-mapping framework. It can help teams connect Annex IV documentation to governance records, security controls, audit trails, and operational compliance practices. That connection matters because regulator requests and internal assurance reviews often require both the formal documentation baseline and the evidence showing how governance works in deployed environments.