AI Governance Briefing — April 7, 2025
With EU AI Act codes of practice due in May, Zeph Tech is standardising general-purpose AI model cards, training data lineage, and risk disclosures for Commission review.
Executive briefing: Regulation (EU) 2024/1689 gives general-purpose AI (GPAI) providers nine months from entry into force to help establish voluntary codes of practice that cover model documentation, safety testing, and risk mitigation. The Commission’s Q&A emphasises that these codes will be assessed by the AI Office ahead of the August 2025 binding obligations. Zeph Tech is therefore consolidating GPAI transparency artefacts—model cards, dataset provenance, evaluation dashboards—so our submissions on show mature governance.
Regulatory checkpoints
- Model documentation. Article 53 and Article 56 expect GPAI providers to describe capabilities, limitations, and intended use conditions.
- Data provenance. Providers must explain training data composition, licensing, and data-governance safeguards, highlighting steps to respect copyright and fundamental rights.
- Risk disclosures. Codes of practice should outline how providers communicate systemic-risk triggers, red-team results, and mitigations to downstream deployers.
Operational safeguards
- Ensure transparency artefacts align with NIST AI RMF documentation profiles so customers can integrate them into their own governance programmes.
- Implement review cadences where legal, privacy, safety science, and security leads validate each model card before submission.
- Track open issues from prior evaluations and show remediation plans to strengthen credibility with the EU AI Office.
Next steps
- Finalize contribution packets for industry code-drafting sessions, including technical annexes and deployment guidance.
- Update Zeph Tech’s customer-facing transparency portal with the same artefacts to deliver consistent messaging.
- Map transparency gaps that could elevate a model to systemic-risk status and feed them into the June readiness programme.