The EU AI Act, the Code of Practice, and What 'Signatory' Really Means

If you sell or use AI in Europe, the rules are no longer coming — they’re here. The EU AI Act is the first comprehensive law of its kind, and around it sits a set of voluntary instruments that let responsible companies commit early. The vocabulary — Act, Pact, Code of Practice, signatory — gets muddled easily, so here’s a clear map, and where Docent stands on it.

The EU AI Act, briefly

The AI Act regulates AI using a risk-based approach: the higher the risk an AI system poses, the stricter the obligations. Most business tools fall into lower-risk categories, but the Act still introduces obligations that touch nearly everyone — notably around transparency, including that people should be able to tell when content is AI-generated. A helpful independent overview lives at artificial-intelligence-act.eu.

Crucially, the Act governs the AI system, where the GDPR governs the personal data — the distinction we drew in GDPR-Native by Design. A serious tool has to address both, not one.

The AI Pact: committing early, on purpose

The AI Pact is a voluntary European Commission initiative. It invites organisations to start applying the Act’s principles before the legal deadlines bite, and to make public pledges — around transparency, governance, and responsible use. Organisations that sign are listed by the Commission.

Why would a company opt in early? Because for a firm selling trust — as every professional-services vendor is — demonstrable, early commitment is itself the product. It signals that responsible AI is a design value, not a compliance scramble.

Codes of Practice, and what “signatory” means

Alongside the Pact sit Codes of Practice — structured sets of commitments that operationalise parts of the Act, including transparency of AI-generated content. When a company is a signatory to such a code, it means something specific:

• it has formally committed to the code’s obligations;
• it appears on the relevant list maintained by the Commission or the AI Office;
• the commitment is public and verifiable.

It’s worth being precise about what this isn’t. Being a signatory is not a certification that a product has been audited and passed. It’s a documented, public pledge to abide by defined practices. That honesty matters — overstating a compliance status is exactly the kind of thing the transparency rules exist to discourage.

A signatory has publicly promised to meet a defined standard, and put its name on a list where anyone can check. That’s the value: it’s checkable.

Where Docent stands

We treat this as part of the product, not the paperwork. Docent is a signatory to the relevant EU commitments on AI transparency and has committed through the AI Pact — and, just as importantly, we keep the exact, current status public and verifiable on our Trust page rather than in a marketing claim. Alongside those commitments sit independent frameworks like the CSA STAR registry and our EU-native, GDPR-first architecture, covered in Where Your Data Lives Matters.

For firms in accounting, law, and consulting, this is why a vendor’s compliance posture is part of your due diligence: when you adopt a tool, its commitments become part of your risk story.

The takeaway

The EU AI Act sets the rules; the AI Pact and Codes of Practice let responsible companies commit to them early and publicly. “Signatory” means a verifiable, listed pledge — not a rubber stamp, but a real, checkable commitment. Ask any AI vendor where they stand, and whether you can verify it. We keep ours out in the open.

Follow Docent on LinkedIn for the rest of the series.