AITBM

TIER 4 · GPAI GOVERNANCE

GPAI Code of Practice to AITBM Mapping

Relates transparency, safety, security, and copyright commitments to AITBM evidence and assessment boundaries.

Tr-4Tr-1Tr-3Pr-1Pr-3Ro-1Ro-4Ro-3

How to use this crosswalk

External requirements, controls, threats, and practices identify evidence to collect or tests to run. Only measured evidence from the assessed deployment determines AITBM rubric placements, IVP, ORP, ACI, MVT findings, and ERS.

Mapping content last verified 2026-08-13. No endorsement by the external framework owner is implied.

GPAI Code of Practice

GPAI governance

General-Purpose AI Code of Practice (GPAI CoP) · European Commission / EU AI Office

The GPAI Code of Practice is the voluntary EU governance instrument through which GPAI model providers operationalize AI Act Articles 53–55 commitments. This AITBM-authored crosswalk offers an optional technical-risk measurement approach for relevant evidence artifacts; it neither signs the Code nor establishes or discharges any legal obligation.

GPAI CoP Chapter Primary AITBM Sub-Metrics Evidence Use / Notes
Transparency - Documentation / Model Documentation FormTr-4Tr-1Tr-3ACI Pc; Tr axis + confidence; Art 53
Copyright - copyright policy, TDM opt-out, lawful crawlingPr-1Pr-3Tr-4ACI Pc; Pr axis; Art 53 (legal lawfulness not scored)
Safety & Security - model evaluations + adversarial testingRo-1Ro-4Ro-3ACI Ec + Tf reset on each re-run; Art 55
Safety & Security - systemic-risk identification / analysis / acceptanceORP Cp, Rf evidenceScenarios and dependency records feed the SDG; Cp remains graph-derived; Art 55
Safety & Security - safety mitigations (harmful output)Cn-2Cn-3Fa-1Fa-4Cn / Fa axes; Art 55
Safety & Security - security mitigations (model-weight cybersecurity)Cn-4Cn-1Cn-5Cn axis; Art 55
Safety & Security - serious-incident reporting + documentationTr-3Tr-4ACI Pc; confidence; Art 55
Safety and Security Model ReportTr-3Tr-4ACI Pc; consolidated evidence package; Art 55

Key findings

  • The Code addresses provider commitments, while AITBM assesses technical risk, confidence, and evidence freshness. The Code does not prescribe one residual-risk score; this crosswalk offers AITBM as an optional measurement approach, not one specified or endorsed by the EU AI Office.
  • Each commitment produces a concrete artifact (Model Documentation Form, copyright policy, evaluation/red-team reports, Safety and Security Model Report, incident logs) that an assessor consumes as objective evidence, reducing assessor discretion; recurring evaluations are the ideal ACI Tf refresh input.
  • Boundary discipline: a favourable ERS does NOT demonstrate adherence, discharge any AI Act obligation, or carry standing before the AI Office; AITBM scores the evidence, not the signatory commitment - two signatories can have very different ERS profiles.
  • The legacy worked example predates GDCP and the current ERS composition. A current assessment must rebuild the SDG, derive Aa/As/Cp/Rf, and use specification Section 5; systemic-risk designation alone does not set Cp.

GPAI Code of Practice reference →