OpenAI maps its safety stack to EU AI Act as enforcement looms

OpenAI published a detailed overview explaining how its existing safety practices line up with the EU AI Act’s new General-Purpose AI Code of Practice, a move that comes as companies scramble to document compliance before the rules bite. The company is effectively arguing it’s already doing most of what the Code requires. It points to a stack of internal frameworks—the Preparedness Framework and the newer Frontier Governance Framework—which jointly cover risk assessment, model reporting, security posture, and incident response. “Those two documents govern risk assessment, safeguards, model reporting, security posture, incident response, and how external experts get pulled into the process,” OpenAI states.

On the transparency front, the company is hanging its hat on two technical signals. Content Credentials built on the C2PA standard attach provenance data directly to files, while Google DeepMind’s SynthID watermarking acts as a backup when metadata gets stripped—a common occurrence when content bounces between platforms. Coverage currently spans images and is expanding to audio, with text provenance flagged as a future goal once the tooling matures. OpenAI is candid that no single method is a silver bullet. The approach relies on layering multiple imperfect signals rather than pretending any one mechanism closes the gap.

Perhaps the most concrete update is a European deployment of its cybersecurity programme. OpenAI says it launched an EU Cyber Action Plan in early May 2026, working with EU and national cyber agencies to give vetted defenders access to its most advanced cyber models. The stated goal is boosting continental cyber resilience, aligning with the European Commission’s own action plan on cybersecurity and AI. The company provides no independent verification of defensive outcomes, so for now the programme’s impact remains a claim rather than a demonstrated fact.

For any team building on OpenAI’s models in regulated European markets, the documentation is a moving target, not a finished compliance package. The system cards and governance frameworks are a useful starting point for due diligence but don’t replace it. OpenAI itself says it expects to keep adjusting its approach as the AI Act’s implementation unfolds and regulators sharpen their expectations.