190 Signatures on a Voluntary Code

The day before the transparency obligations began applying, the EU AI Office published a voluntary Code of Practice on Transparency of AI-generated Content. Roughly 190 organizations had signed by the end of July. The word voluntary tends to end the conversation for most readers, which is a mistake, because the interesting detail is not the legal status of the document but who put their name to it.

About half the signatories were small or recently founded companies. That cuts against the assumption that governance commitments are a large-enterprise activity, something you get around to once you have a compliance function and a legal team. A code that is half small firms is a code that smaller firms decided was worth the signature, and the reasons they would decide that are commercial rather than legal.

What signing actually buys

A voluntary code does not create obligations and does not confer compliance, and nobody should sign one expecting it to. What it does is convert a general claim into a specific one. “We use AI responsibly” is unfalsifiable and everybody says it. “We have signed this published code, whose commitments are listed in public” is a statement somebody can check, and checkable statements are worth more than confident ones.

There is a second effect that matters more over time. Codes of practice are how a diffuse expectation becomes a concrete reference. Once a document exists that names specific commitments, procurement teams stop inventing their own AI questions and start asking whether you align with the thing that already exists. That happens regardless of whether the code is binding, because the people writing supplier questionnaires are not looking for law, they are looking for a standard to point at.

The asymmetry for small firms

For a small professional services firm, this is a rare situation where the economics favor you. A large organization signing a transparency code has to reconcile that commitment with dozens of teams, legacy tools, and processes nobody fully owns. A ten-person consultancy can make the commitment genuinely true across its whole operation in a week, because its whole operation is one workflow and four people touch it.

Which means the credible answer to a client’s AI question is currently more available to small firms than to big ones, and that is the opposite of how assurance questions usually work. The constraint is not resources. It is whether anyone has decided to make the review step real rather than assumed, and that decision costs nothing but attention.

The part a signature cannot cover

A commitment you cannot evidence is worse than no commitment, and this is the trap in any voluntary framework. Signing a transparency code and then being unable to show, for a specific piece of client work, what the analysis rested on and who approved it leaves you with a public promise and nothing behind it. That is a weaker position than having said nothing, because now the gap is documented.

So the sequence matters, and most teams run it backward. The record comes first, the commitment describes it second. If you can already answer what evidence an output was grounded in and who signed it off, signing a code is a formality that costs an afternoon. If you cannot, the signature is the least useful thing you could spend that afternoon on.

Qonera is the AI governance platform for professional teams, built around a structured review and approval workflow in which the evidence accumulates as a by-product: sources audited before analysis, per-claim citations back to the passage behind each statement, disagreement between independent models surfaced rather than smoothed, and named sign-off written to a tamper evident audit trail. How we approach our own obligations is set out in the conformity assessment. Half the firms that signed are small, which says something worth noticing: the thing separating teams with a credible answer from teams without one is not size.

This article is for general information only and does not provide legal advice. Organisations should consult qualified legal counsel about how Article 50 and the EU AI Act apply to their specific systems, workflows, and obligations.