OpenAI’s compliance playbook for the EU AI Act

OpenAI has published a detailed breakdown of how its safety, security, and transparency work maps onto the European Union’s General-Purpose AI (GPAI) Code of Practice — the rulebook that will govern how foundation models are built and deployed across the bloc. The timing is deliberate. Enforcement of the EU AI Act is creeping closer, and the company wants to show it’s not starting from zero.

The GPAI Code, alongside a separate Code of Practice on Transparency of AI-Generated Content, emerged from multi-stakeholder processes led by the European Commission. Both are meant to translate the AI Act’s broad obligations into concrete, actionable standards. OpenAI says it contributed to and endorsed both documents.

For companies building on OpenAI’s models in Europe, this is more than a regulatory update. It’s a signal about what due diligence will look like in practice.

What OpenAI already does — and what it’s adding

OpenAI’s argument is simple: much of what the GPAI Code demands, it already does. The company points to a stack of existing practices as evidence it operates near the bar set by the Code.

• Pre-release testing of models before they reach the public.
• Published system cards accompanying major launches, detailing capabilities and limitations.
• External red-teaming through its Red Teaming Network, which brings in outside experts to probe for vulnerabilities.
• A public Model Spec document that explains how the company shapes model behavior.

Underneath that work sit two internal governance frameworks. The Preparedness Framework, in place since 2023 and updated in 2025, sets out how OpenAI identifies, evaluates, and manages serious risks from advanced systems. A separate Frontier Governance Framework builds on it, explicitly mapping the company’s safety and security practices onto legal requirements — including the GPAI Code itself.

Together, these two documents govern risk assessment, safeguards, model reporting, security posture, incident response, and how external experts get pulled into the process. That’s a lot of paperwork, but it’s the kind of documentation regulators will expect to see.

The transparency problem: provenance gets harder

The Transparency Code tackles a different problem: helping people tell when content was made or altered by AI. OpenAI’s approach rests on two mechanisms that are meant to reinforce each other.

Content Credentials, built on the C2PA standard, attach context directly to a file — think of it as a digital signature that travels with the content. SynthID watermarking provides a fallback signal for cases where that metadata gets stripped out somewhere along the way. Coverage is expanding from images into audio outputs, and OpenAI says it’s working toward extending provenance measures across further modalities, including text, as the underlying standards mature.

None of this solves provenance outright. Metadata gets lost. Labels don’t always survive a transfer between platforms. No single signal — whether cryptographic or watermark-based — catches everything on its own. OpenAI’s response is a layered approach paired with continued work across the wider standards community, rather than a claim that any one mechanism closes the gap.

Cybersecurity as the test case for adaptive governance

Here’s the tension at the heart of AI regulation: capabilities that help defenders spot and patch vulnerabilities are the same capabilities that could help an attacker find them first. OpenAI believes the answer is its Trusted Access for Cyber programme, designed to give vetted defenders access to more advanced cyber capabilities while limiting exposure for misuse.

That programme now has a European deployment arm. OpenAI says it launched its EU Cyber Action Plan in early May 2026, working with EU and national cyber agencies, private sector partners, and infrastructure operators. The stated aim is to strengthen cyber resilience across the continent. Whether “most advanced” translates into measurable defensive gains inside these agencies is a claim from OpenAI itself; the source material offers no independent verification of outcomes.

The company positions this work as consistent with the European Commission’s Action Plan on Cybersecurity and Artificial Intelligence, which calls for coordinated handling of AI’s risks alongside its use in strengthening defensive capability — including secure access arrangements for cybersecurity purposes specifically.

What this means for developers and enterprises

The GPAI Code and the Transparency Code are still relatively new instruments, and OpenAI’s compliance documentation is a moving target rather than a finished product. Teams building on OpenAI’s models in regulated European markets should treat the current system cards and Frontier Governance Framework as a starting point for their own due diligence, not a substitute for it.

OpenAI says it will keep adjusting its compliance approach as EU AI Act implementation continues, and that it expects to keep learning from regulators and the wider community involved in shaping the rules. The company argues that rules need enough flexibility to adapt as the technology moves, so that businesses and organisations can keep benefiting from it.

For a deeper look at how these rules are shaping up, check out our coverage of AI regulation in Europe and the broader AI safety landscape.

The Numbers That Made Wall Street Cheer

Amazon just dropped its second-quarter earnings, and the market responded like a kid on Christmas morning. Net sales jumped 20%. Cloud revenue? Even better. The stock shot up nearly 10% in after-hours trading.

But here’s the twist: Amazon isn’t slowing its data center spending. Not one bit. The conventional wisdom says investors want companies to tighten the purse strings on AI infrastructure. Amazon didn’t get that memo.

Consider this: Amazon spent $173 billion on property and equipment in the fiscal year ending June 30. That covers GPUs, natural gas turbines, and land — up from $107.65 billion the prior year. And they’re not done. The 2026 capex forecast just went from $200 billion to $220 billion.

Where’s the money coming from? Amazon dipped into cash reserves. The company ended the quarter with $7.6 billion less cash than a year ago — its first negative free cash flow period this year.

Why AWS Revenue Changes the Conversation

Normally, ballooning expenses would spook investors. But Amazon has a revenue engine that justifies the splurge. AWS revenue grew 37% year over year, hitting $42 billion for the quarter.

That doesn’t mathematically balance the capex. But it shows demand is growing alongside supply. And given the years-long lag between breaking ground on a data center and selling its capacity, that’s reassuring.

The Chip Bet Nobody’s Talking About

Amazon’s AI play isn’t just about building bigger warehouses for servers. The company is betting big on custom silicon — the Trainium chip and the Arm-based Graviton processor. These projects don’t show up in capex numbers, but they could meaningfully improve AWS margins down the road.

CEO Andy Jassy put it plainly during the earnings call: “We see the AI business following very much the same margin trajectory we saw in the core business before.” He added that AWS and Amazon Bedrock can succeed without a frontier model of their own — “there’s not going to be a single model to rule them all.”

The Divergence: Cloud Hosts vs. AI Labs

This pattern isn’t unique to Amazon. Microsoft and Google both saw shares pop after strong cloud earnings. Meanwhile, Meta — which has heavy capex but no clear revenue source for AI — saw its stock fall 8% after earnings. Investors focused on its cash flow crunch.

The lesson? Investors treat AI cloud hosts as the most reliable part of the AI stack. They’re skeptical about the economics for AI labs and startups.

But here’s the uncomfortable truth: Amazon’s hosting revenue is someone else’s AI bill. In Anthropic’s case, it’s literally the same money. If that spending isn’t sustainable for the big labs and their clients, the revenue won’t be stable for Amazon either.

The $3 Trillion Question

It all comes back to what Sequoia’s David Cahn called the $3 trillion question. Is there enough real demand to justify this buildout, or isn’t there?

Cloud hosts like AWS are a few steps removed from that demand problem. But that doesn’t make them immune. If the AI bubble deflates, everyone gets wet — even the ones selling shovels.

For now, investors are cheering. But the math is simple: revenue needs to keep climbing, or that $220 billion capex forecast becomes a liability, not a strength.

I was a serial plant killer. Then I handed my phone to Gemini.

By every reasonable measure, I am a serial plant killer. I’ve lost count of the pothos, the peace lilies, and the one very expensive fiddle-leaf fig that judged me silently for a month before giving up entirely. My problem was never a lack of love. It was that I’d either drown them out of guilt or forget they existed for a fortnight, with no middle ground.

So when I started leaning on Gemini for the odd everyday question, letting it babysit my plants wasn’t some grand plan. It happened almost by accident. Now my flat looks like something a person with their life together would own.

It started with a yellow leaf and a photo

The whole thing began the way most of my plant emergencies do: a leaf turning a color it definitely shouldn’t. Instead of doom-scrolling through contradictory Google searches like I usually would, I snapped a photo, handed it to Gemini, and asked what was wrong. What I got back was a proper answer — the first of many.

Gemini Live figured out I was loving my plants too much

The feature that really won me over was Gemini Live. Instead of trying to describe what I was seeing, I could simply point my phone at a struggling plant, snap a photo, and ask what was wrong. It would identify the plant, explain what it was noticing, and tell me what was most likely causing the problem.

One time, I noticed a few leaves turning yellow and immediately assumed I wasn’t watering the plant enough. I was already reaching for the watering can when Gemini pointed out the opposite: I’d actually been overwatering it. The soil was staying too wet, and my help was making things worse.

That completely changed how I look after my plants. I no longer have to guess whether I’m dealing with root rot, a nutrient deficiency, or something else entirely. I just take a photo, get an easy-to-understand explanation, and know what to try next. For someone who isn’t exactly a gardening expert, that’s been surprisingly reassuring.

I finally stopped killing things with kindness

The biggest lesson Gemini taught me had nothing to do with fertilizers or fancy plant care tricks. It was knowing when not to do anything. Before this, I thought being a good plant parent meant watering my plants whenever they looked a little sad.

Gemini helped me understand that every plant is different. The pothos sitting in my bright window, for example, dries out much faster than the one tucked away in a darker corner. Instead of following a rigid watering schedule, it encouraged me to check the soil first and only water when the plant actually needed it.

Looking back, I realized most of the plants I’d lost weren’t neglected — they were over-loved. Having something explain that in simple terms completely changed my approach. These days, I’m much more comfortable leaving my plants alone. Ironically, they’re healthier because of it.

The best plant care tip? Stop relying on your memory

My problem was never knowledge alone. It was consistency. I’d learn the right thing to do, only to completely forget to do it. So I started asking Gemini to help me build an actual schedule, plant by plant, and to remind me when things were due.

I can ask it to set reminders, and because it ties into the rest of Google’s world, those nudges actually reach me instead of dying in a notes app I never open. Every few days I get a prompt telling me which plants need checking. Instead of a chaotic once-a-month panic, watering has become a five-minute habit.

For someone who could never stick to a routine on their own, having one gently handed to me made all the difference. I even started using it for the bigger decisions. When I wanted to move a plant to a brighter spot, I asked whether the new window got too much harsh afternoon sun. When one outgrew its pot, I asked when and how to repot it without shocking the roots.

It’s like having a patient friend who happens to know a great deal about plants and never gets tired of my basic questions.

My plants finally found someone who understood them

I never planned on becoming someone who cared this much about plants. I just got tired of buying them, watching them slowly struggle, and eventually having to throw them away. Somewhere along the way, between asking Gemini why a leaf looked unhappy and letting it remind me when to water, I went from constantly replacing plants to actually keeping them alive.

Now my home is filled with greenery that is genuinely growing. And the best part is that I didn’t suddenly develop a magical green thumb. I just stopped guessing and started understanding what my plants actually needed.

If you’re someone who loves the idea of having plants around but somehow turns every new one into a rescue mission, this is probably the easiest place to start. Take a photo, ask a question, and let Gemini help you figure out what your plant is trying to tell you. For more on how AI can simplify everyday life, check out our guide to Google Gemini tips and tricks or read about the best AI apps for home organization.