G7 Hiroshima AI Code of Conduct

Applies To

Overview

The G7 Hiroshima AI Code of Conduct was adopted on October 30, 2023 as part of the broader Hiroshima AI Process (HAIP), launched by G7 Leaders at the Hiroshima Summit in May 2023 in response to the rapid proliferation of large-scale generative AI and frontier model capabilities. The process tasked G7 Digital Ministers with developing practical governance instruments for advanced AI on an accelerated timeline. The Code of Conduct was the principal output of that mandate and was accompanied by the G7 Hiroshima Process International Guiding Principles for Advanced AI Systems. The code is explicitly voluntary and does not carry legal force in any jurisdiction. However, it has significant soft-law weight (persuasive influence without legal force): G7 governments, representing the United States, United Kingdom, European Union, Germany, France, Italy, Japan, and Canada, collectively encouraged AI developers and deployers to adhere to its provisions, and several jurisdictions subsequently incorporated its principles into national AI policy frameworks and procurement standards. Its eleven actions cover risk management across the AI lifecycle, post-deployment misuse, transparency reports, incident sharing, governance policies, and security. They also cover content provenance (showing whether AI made content), risk research, global challenges, international standards, and protection of personal data and intellectual property. A key structural feature is the code's emphasis on frontier and general-purpose AI systems, reflecting concern about the distinctive systemic risks of large foundation models (base models that many other AI products are built on). In 2024 the G7 backed a reporting framework for the code, developed with the OECD. It was piloted in mid-2024 and launched on 7 February 2025. Enterprises that publicly commit to the code, as several major AI developers have done, should treat adherence as a reputational and contractual matter even in the absence of legal enforceability.

Key Requirements

• •Action 1: Identify, evaluate, and mitigate risks across the AI lifecycle.
• •Action 2: Identify and mitigate vulnerabilities, incidents, and patterns of misuse after deployment.
• •Action 3: Publicly report capabilities, limitations, and appropriate and inappropriate uses.
• •Action 4: Work toward responsible information sharing and reporting of incidents.
• •Action 5: Develop, implement, and disclose AI governance and risk management policies.
• •Action 6: Invest in robust security controls, including physical security and insider threat safeguards.
• •Action 7: Develop and deploy content authentication and provenance mechanisms, such as watermarking.
• •Action 8: Prioritize research to mitigate societal, safety, and security risks.
• •Action 9: Prioritize AI that addresses global challenges such as the climate crisis, health, and education.
• •Action 10: Advance the development and adoption of international technical standards.
• •Action 11: Protect personal data and intellectual property through appropriate data input measures.

What Your Organization Must Do

• →Map your existing AI governance policies against the code's eleven voluntary actions to spot gaps.
• →Decide, with leadership, whether to make a public commitment to the code and document that choice.
• →Treat any public commitment as a reputational and contractual promise, since no fines apply.
• →Check G7 government procurement requirements, as some have begun incorporating the code's principles.
• →Combine work on EU AI Act risk, transparency and incident duties with the code's overlapping actions.
• →Review the reporting framework developed with the OECD, launched 7 February 2025, for voluntary disclosures.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

Governance Controls

Operational controls that implement requirements from this regulation.

Frequently Asked Questions

Is the G7 Hiroshima AI Code of Conduct legally binding?

No. The code is explicitly voluntary and carries no legal force in any jurisdiction. However, G7 governments have encouraged adherence, and several national AI policy frameworks and government procurement standards have begun incorporating its principles, giving it meaningful soft-law weight for companies operating in G7 markets.

Which companies does the Hiroshima AI Code of Conduct apply to?

The code targets developers and operators of frontier and general-purpose AI systems, including large AI laboratories, major cloud and platform providers, and enterprise technology vendors deploying foundation models at scale. Enterprises in financial services, healthcare, and defence that publicly commit to the code should treat adherence as part of their ESG and vendor due diligence obligations.

What are the consequences of non-compliance with the Hiroshima AI Code of Conduct?

There are no direct fines or regulatory penalties because the code is voluntary. The primary risks are reputational: companies that publicly commit to the code but fail to adhere face scrutiny from G7 governments, civil society, and counterparties. Non-alignment may also become a disqualifying factor in government AI procurement in G7 member states.

How does the Hiroshima AI Code of Conduct relate to the EU AI Act?

The two instruments are complementary but distinct. The EU AI Act is binding law with enforcement mechanisms; the Hiroshima code is a voluntary international framework. Several EU AI Act obligations, including risk assessments, transparency reporting, and incident reporting for general-purpose AI models, overlap substantially with the code's eleven principles, so joint compliance programs are feasible.

What does the Hiroshima AI Code of Conduct require on incident reporting?

Action 4 asks organizations to work toward responsible information sharing and reporting of incidents with industry, governments, civil society, and academia. Action 2 covers finding and mitigating incidents and misuse after deployment.

Does the Hiroshima AI Code of Conduct address watermarking and AI-generated content disclosure?

Yes, action 7 asks developers to deploy content authentication and provenance mechanisms, such as watermarking, where technically feasible. The code does not name a specific standard such as C2PA.