How does my company or organisation develop ethically responsible and reliable AI?

Since the world's first AI law, Regulation (EU) 2024/1689 ("AI Regulation"), was adopted, this regulation has been gradually applied throughout the EU since last year and will continue to become applicable in the coming years. At present, many companies and organisations are struggling with the question of what exactly is expected of them in practice with regard to the development and use of AI technology.

 

What is allowed and what not?

In the Netherlands, many companies and organisations are currently grappling with questions such as:

"Our developers want to create reliable, transparent and ethically responsible AI, but how do they do that?" Or,

"We see providers of AI tools on the market that can be integrated to change our working methods and services, but how do I know if they are sufficiently secure and whether we are allowed to use this option within our sector?"

Digital Omnibus

Developments in the field of AI implementation are progressing at a rapid pace. At this early stage, legal advice on the applicable framework is still limited. Developments in the field of applicable legislation and regulations are also progressing very rapidly. On 19 November 2025, the European Commission published a proposal for the 'Digital Omnibus', a proposal to, among other things, relax certain obligations under the AI Regulation and postpone the timetable for full implementation, so that not all legal obligations will apply from 2 August 2026. The proposal for the Digital Omnibus is just one example of sudden developments that are shifting the regulatory framework during the rise of AI.

Practical guidance

In this article, we answer the question of what practical guidance is available to tackle the ethical development of AI within your company or organisation, despite uncertainty about the circumstances, future legal developments and the rapid advancement of technology.

AI policy for developers

We previously wrote about drawing up your own AI policy:

Part II - AI & Law: How to draft an AI policy for my company or organisation? (dutch)

It is not a legal requirement to draw up an AI policy, but it is wise to record the choices currently being made in writing. This is precisely because, at this early stage, no one can predict exactly how the regulatory frameworks will develop.

General policy insufficient

Depending on the nature of the services provided by a company or organisation, general policy regarding the use of AI may not be sufficient for all employees within a company or organisation.

• Does your company or organisation provide a lot of professional development education?
  • It may be necessary to make separate arrangements for beginners and job trainers, for example, to ensure that AI does not take over too many 'beginner' tasks that are suited to building work experience.
• Does your company or organisation engage in a lot of technical development? For example, because you are an IT supplier or provider of online services?
  • Developers, programmers or other technicians may be more in need of concrete guidance ("Do I place the button on the right or the left?"), i.e. a translation into practice rather than
    • an overly abstract discussion about values,
    • human-centricness and,
    • the prevention of automated decision-making without human intervention.
  • Conversely, someone who works with people in a customer-oriented way likely does not need a major translation between ethical values, such as
    • preventing automated decision-making without human intervention, or,
    • in the sense of taking into account the capacity of people from the target demographic in relation to whom AI is used, compared to their existing work experience.
  • In fact, it is probably not at all useful to provide service or sales employees with a comprehensive manual with technical specifications in your new AI policy ("To get to grips with machine learning, the basis is your knowledge and experience with the Python programming language and the principles of data science. Recent breakthroughs in NLP research...").

In other words, an overly technical approach to your AI policy may be unsuitable for employees for whom an AI tool to be integrated will only be a small part of their new daily tasks and who are unable to tinker with the 'back end' themselves, for example because the AI system to be integrated is not developed internally by the company or organisation itself, but is an application provided by a supplier.

In the latter case, the trustworthiness of that supplier must be assessed by the employer in light of legal accountability obligations, including those under the AI Regulation and the General Data Protection Regulation (GDPR), before its use is permitted in the workplace. After all, violation of these legal requirements entails fines and liability risks, and the employer is liable for errors made by subordinates, or at least may be liable for such errors. If, for example, the provider of the AI system is a supplier based outside the European Economic Area (EEA), legal restrictions may apply to the transfer of data.

No clear-cut answers

In short, at this early stage of the emergence of AI and its regulation, there are no clear-cut answers for every company or organisation, nor for every position within these companies or organisations. In order to deal with this uncertainty, it is therefore advisable to document the choices that the company or organisation is currently making in 'version 1.0' of the internal AI policy. In this way, future insights and shifts in the applicable legal and regulatory framework can be incorporated when more clarity is available.

Copyright and AI for developers

 We previously wrote about the intellectual property aspects of AI:

Part I - AI & Dutch Law: How does AI and copyright law work in the Netherlands?

It is important to bear in mind that (excessive) use of generative AI, for example, has intellectual property implications, either because it may infringe on the copyrights of others or because there is a risk that software created using generative AI will not be subject to copyrights on which licences can be sold.

creations of 'the human mind'

After all, copyright protects creations of 'the human mind'; the original legislator did not yet take into account a 'non-human' mind as the creator of software. The Dutch Copyright Act was introduced in 1912 and has since been updated to take account of

• technological developments and
• European harmonisation

but a legislative amendment to include a clear position on generative AI and 'non-humanity' may be many years in the making. In the meantime, developers will have to take into account the current laws and regulations in the field of copyright, even if these originated before the introduction of commercially available AI systems.

Ai policies for developers

It may therefore be advisable to restrict the use of generative AI in AI policies for developers regarding the most commercially valuable software, or at least to include instructions to save 'prompts' in case evidence is ever needed that software is protected by copyright.

Some guidance may already be found by keeping an eye on case law. For example, a number of judges in various countries have already issued rulings in which AI played a role in the legal matter at hand. However, individual rulings by lower courts at home and abroad are not sufficient in themselves to provide guidance. In order to distil legal rules, the highest courts will have to rule several times about the questions raised by the introduction of AI in practice.

What guidelines can I include in my AI policy for developers?

Without a fully implemented legal framework and with only limited case law, it is difficult for a company or organisation to answer questions such as: "As a developer, what can I do and what can I not do with AI for ethically responsible development?"

We previously wrote about the EU's guidance for developers:

European Commission launches AI tools for researchers and industry (Dutch)

One solution currently available to get a grip on the uncertainty and 'get started with AI' is to seek alignment with codes of conduct within a particular industry or sector, or with ISO 42001 certification for AI management systems.

What is the legal value of a code of conduct on AI?

Although a code of conduct does not in itself contain any legal obligations, an authoritative code of conduct can have a significant legal influence, particularly on the interpretation of more broadly formulated legal obligations and 'open norms', such as 'reliability' or 'appropriate protection'. In practice, the open standard will have to be interpreted by a competent supervisory authority and ultimately by a court, for which a code of conduct from a particular sector can be referred to. 

See Dutch Supreme Court 11 July 2003, ECLI:NL:HR:2003:AF7419, NJ 2005/103 (Kouwenberg/Rabo) and,

Dutch Supreme Court 2 March 2001, ECLI:NL:HR:2001:AB0377, NJ 2001/649 (Trombose), para 3.3.3.

"The Court did not demonstrate an incorrect interpretation of the law by ruling, in the given circumstances, that failure to comply with the protocol must be regarded as an attributable shortcoming."

Philosophical terminology

The AI Regulation and related regulations are a prime example of legal provisions with a high degree of abstraction and open norms, such as 'value-driven', 'human-centric', 'reliable', 'transparent' and 'ethically responsible', legal philosophical terminology that can lead to a great deal of uncertainty for the implementing technician as to what exactly he or she should do in practice.

AI regulation and codes of conduct on AI use

The European legislator has been aware of this, and the AI Regulation therefore explicitly encourages the adoption of sector-specific codes of conduct on AI use:

"Article 95 Codes of conduct for voluntary application of specific rules

1. The AI Agency and Member States shall encourage and facilitate the development of codes of conduct, including related governance mechanisms, intended to promote the voluntary application of some or all of the requirements of Chapter III, Section 2, to other AI systems than high-risk AI systems, taking into account the available technical solutions and best practices of the sector that enable the application of such rules.
   
   
2. The AI Agency and Member States shall facilitate the development of codes of conduct relating to the voluntary application, including by responsible users, of specific requirements for all AI systems, based on clear objectives and key performance indicators to measure the achievement of those objectives, including elements such as, but not limited to:
   1. applicable elements provided for in the Union ethical guidelines on trustworthy AI;
   2. assessing and minimising the impact of AI systems on environmental sustainability, including in terms of energy-efficient programming and techniques for the efficient design, training and use of AI;
   3. promoting AI literacy, in particular among persons involved in the development, operation and use of AI;
   4. facilitating inclusive and diverse design of AI systems, including by establishing inclusive and diverse development teams and promoting stakeholder participation in that process;
   5. assessing and preventing the negative impact of AI systems on vulnerable persons or groups of vulnerable persons, including in terms of accessibility for persons with disabilities, and on gender equality.
      
      
3. Codes of conduct may be developed by individual providers or controllers of AI systems, or by organisations representing them, or both, also involving interested stakeholders and their representative organisations, including civil society organisations and academia. Codes of conduct may cover one or more AI systems, taking into account the similarity in the intended purpose of the systems concerned.
   
   
4. The AI Agency and Member States shall take into account the specific interests and needs of SMEs, including start-ups, when encouraging and facilitating the development of codes of conduct.

The General Purpose AI (GPAI) code of conduct

Is there no code of conduct within your industry or sector for your company or organisation to adhere to for your own AI policy for developers? You can, for example, consult the GPAI code of conduct as a source of inspiration. If you are not developing an AI system internally but are considering integrating an AI system provider, you can check whether the intended supplier has signed up to the GPAI code of conduct, for example as part of your supplier assessment test.

The GPAI code of conduct consists of three chapters, derived from the principles of the AI Regulation and intended for practical application:

1. Safety and Security
2. Transparency
3. Copyright

 European Union AI Office

On 2 August 2025, providers of GPAI models had to submit information to the European Union's AI office. The AI office is the European Union's centre of expertise for AI and AI regulation. Providers of GPAI models submitted information on:

• General information about the provider and the model
• Model characteristics
• Distribution and licensing methodology
• Use
• Training process
• Data used for training, testing and validation
• Computing power used
• Energy consumption

10^23 fpo

 By 2 August 2025, potential providers of general-purpose AI models that consume more than 10^23 fpo and are capable of generating

1. language (text or audio)
2. (text-to-image) or,
3. (text-to-video)

had to disclose their models and training data to the European Union's AI office. An AI model which could become General Purpose AI (GPAI), could, for example, be ChatGPT from OpenAI, CoPilot from Microsoft, or Grok from x.com.

It should be noted that small and medium-sized enterprises (SMEs) that do not offer or integrate GPAI into their services are not required to sign the three chapters of the GPAI, but this code of conduct for large tech companies could, in practice, serve as a starting point for the company's or organisation's own AI policy for developers.

 

Signatories to the GPAI code of conduct

Amidst the heated debate about the pace of AI regulation and whether or not to postpone it, it has been uncertain for some time whether the more critical tech companies would sign the GPAI code of conduct.

Google hesitated for a long time, but ultimately signed the code of conduct. On 30 July 2025, Google's president of global affairs published a blog post in which he made the following statement:

"We will join several other companies, including U.S. model providers, in signing the European Union's General Purpose AI Code of Practice. We do so with the hope that this Code, as applied, will promote European citizens' and businesses' access to secure, first-rate AI tools as they become available. Prompt and widespread deployment is important. Europe stands to gain significantly, potentially boosting its economy by 8% (€1.4 trillion) annually by 2034.

While the final version of the Code comes closer to supporting Europe's innovation and economic goals than where it began — and we appreciate the opportunity we have been provided to submit comments — we remain concerned that the AI Act and Code risk slowing Europe’s development and deployment of AI. In particular, departures from EU copyright law, steps that slow approvals, or requirements that expose trade secrets could chill European model development and deployment, harming Europe’s competitiveness.

We are committed to working with the AI Office to ensure the Code is proportionate and responsive to the rapid and dynamic evolution of AI. And we will be an active voice in supporting a pro-innovation approach that leads to future investment and innovation in Europe that benefits everyone."

• Kent Walker | President of Global Affairs, Google & Alphabet

The GPAI Code of Conduct has been signed by:

• Accexible
• AI Alignment Solutions
• Aleph Alpha
• Almawave
• Amazon
• Anthropic
• Bria AI
• Cohere
• Cyber Institute
• Domyn
• Dweve
• Euc Inovação Portugal
• Fastweb
• Google
• Human Technology
• IBM
• Lawise
• Microsoft
• Mistral AI
• Open Hippo
• OpenAI
• Pleias
• Re-AuditIA
• ServiceNow
• Virtuo Turing
• WRITER

 The company xAI has only signed up to the chapter on safety and security; xAI did not sign the other chapters.

 Meta has announced that it will not sign the code of conduct.

 Questions?

The rise of AI is happening at breakneck speed. Are you involved in ethically responsible and reliable AI development? Do you have questions about what the rise of AI means for you? Are you looking for guidance amid all these developments? You don't have to face this alone.

Make sure you don't fall behind. Contact our IT lawyers today. They will be happy to assist you!

Advice

Would you like to make use of our ready expertise and contact us on a regular basis? Take out a subscription to the Virtual Legal Department. Please email me directly and you will receive the terms and conditions, with no obligation.

Want to know more? Feel free to call or email:

1. +31(0)70-3819281 
2. info@wisemen.nl 

For the latest updates, sign up now for the

WiseMen Newsflash!