Will, Encouraged, May: How to Read a Code of Practice

Codes of practice have a drafting convention that most readers skim past, and it carries nearly all the practical information. Each commitment is marked according to how strongly it binds: some are phrased as things a signatory will do, some as things a signatory is encouraged to do, and some as things a signatory may do. The EU AI Office’s transparency code is structured that way, split into a provider section and a deployer section, with every commitment labeled.

Those three words are the difference between a document that reads as a wall of obligations and one you can actually act on. Teams that work through a code without noticing the gradations come away either paralyzed, because everything appears mandatory, or dismissive, because nothing appears enforceable. Both reactions skip the work the drafters already did on your behalf.

What each level is telling you

A mandatory commitment is the floor. Signing and then not doing it creates a straightforward inconsistency between a public statement and actual practice, which is the specific failure that turns a voluntary commitment into a liability. These are the ones to confirm you can genuinely satisfy before the signature rather than after it.

A recommended commitment is where judgment lives. The drafters think it is good practice but recognize it will not fit every signatory, usually because of size, sector, or system type. This is the tier worth reading closely, because adopting the recommended items that suit your work is most of what separates a credible commitment from a minimal one, and declining the ones that do not fit is a legitimate decision rather than a gap in your position.

An optional commitment is something the drafters wanted on the record without implying anyone should take it. Treating this tier as an expectation is the most common way teams make a voluntary framework feel far heavier than it was designed to be.

How to work through one

The approach that produces a defensible position rather than an anxious one is mechanical. Take the section that applies to you, provider or deployer, and ignore the other entirely. Go through the mandatory items and answer honestly whether each is true today, not whether it could be made true. Anything that is not true is either work to do before signing or a reason not to sign yet, and both of those are acceptable outcomes.

Then go through the recommended items and choose deliberately. The useful test is whether a client asking about that commitment would get a real answer. Where it would, adopt it and record the decision. Where it would not, note why it does not apply to your work, because a documented reason for declining is itself evidence that you read the document rather than signed it unread.

Write down what you decided

The step almost everyone skips is keeping a record of the assessment itself. Six months later nobody remembers which recommended items were adopted or why two were set aside, and reconstructing that from memory produces exactly the tidy, unfalsifiable document that carries no weight on the day it matters. A short note made at the time, listing what was committed to and what was consciously not, is worth more than a polished retrospective written under pressure.

Qonera is the AI governance platform for professional teams, and the review and approval workflow is designed so that the commitments a transparency code asks about are answerable from records rather than recollection: what evidence an output rested on, where independent models disagreed, which claims carry citations, and who approved the result before it was delivered. How we approach our own obligations is set out in the conformity assessment. Reading a code of practice properly takes about an hour, and it is an hour that converts a vague sense of obligation into a short list of specific decisions you can actually make.

This article is for general information only and does not provide legal advice. Organisations should consult qualified legal counsel about how the EU AI Act and any voluntary code of practice apply to their specific systems, workflows, and obligations.