Fourth GPAI meeting: post-market monitoring, systemic risk and copyright

The fourth meeting of the GPAI Signatory Taskforce, held on 17 July 2026, focused on two parts of the General-Purpose AI Code of Practice: safety and security, and copyright. The European Commission’s AI Office presented material on both chapters.

On safety and security, the AI Office outlined how analysis of model usage can contribute to post-market monitoring under Measure 3.5 and can be relevant to the assessment of systemic risk. The central point is that information gathered from how a model is used, and from its behaviour during use, can add to evidence from evaluations conducted before deployment. According to the meeting account, that additional information can inform several stages of the risk-assessment process. This places post-deployment observation alongside pre-deployment evaluation, rather than presenting either source of information as sufficient on its own.

That relationship matters because the meeting treated model use and behaviour as potentially relevant evidence for understanding risks after a model has entered use. The article does not specify a single method for analysing usage, identify particular models, or report the outcome of an individual systemic-risk assessment. It therefore confirms the subject of the AI Office presentation and the taskforce discussion, but leaves open how the relevant information would be collected, evaluated and applied in individual cases. It also does not state that the meeting itself changed the requirements of Measure 3.5.

The taskforce additionally examined the connection between so-called marginal-risk clauses in Safety and Security Frameworks and a provider’s systemic-risk management. As described in the meeting report, such clauses address a situation in which competitors begin to push capability frontiers by deploying unsafe models, after which another provider could consider doing the same. The AI Office stressed that these clauses could be invoked only in exceptional circumstances and with appropriate evidentiary and procedural safeguards. The meeting briefly discussed those safeguards.

The copyright portion of the meeting focused on Measure 1.3, especially the obligations identified in Measure 1.3(4) for GPAI model providers that are signatories. Under that provision, signatories commit to taking appropriate measures that allow affected rightsholders to obtain information about the web crawlers used and their robots.txt features. They also commit to sharing other measures adopted to identify and comply with rights reservations when crawling takes place. The information in question must be public, and signatories must provide a way for affected rightsholders to be automatically notified when it is updated.

This discussion is relevant to providers that have signed the Code, as well as to affected rightsholders seeking information connected with crawling and rights reservations. The meeting account is specific about the transparency elements highlighted by the AI Office: public information on crawlers and robots.txt features, disclosure of other relevant measures, and automatic update notifications. At the same time, the article does not name individual signatories, describe particular crawler practices, or state whether any provider has already implemented these commitments.

The meeting ended with an AI Office overview of current initiatives related to the GPAI Code of Practice and a short exchange on the organisation of future taskforce sessions. Taken together, the meeting covered how information about model use and behaviour can complement pre-deployment evaluations in systemic-risk assessment; marginal-risk clauses and safeguards; copyright-related information for affected rightsholders; and the organisation of future meetings.