Skip to content
aidataset.broker home

Regulation / buyer side

EU AI Act training data documentation from suppliers

The EU AI Act makes general-purpose model providers document their training data and publish a summary of it on a Commission template. Several answers in that summary depend on facts only the data supplier holds: token counts, source category, nature of the content, languages and screening. This page lists what to collect from a supplier and the contract clauses that secure it.

A compliance officer and a researcher discussing a thick printed document in a glass meeting room at night, binders and a laptop on the table

The obligations in three lines

Article 53 of the AI Act asks providers of general-purpose AI models to do three things that touch training data. First, keep technical documentation, set out in Annex XI, that covers the type and provenance of training data, how it was obtained and selected, its main characteristics, and the methods used to detect unsuitable sources and biases. Second, maintain a policy to comply with EU copyright law, including opt-outs from the text and data mining exception in Directive 2019/790. Third, publish a sufficiently detailed summary of the content used for training.

The Commission published the template for that summary on 24 July 2025 (template and explanatory notice). The obligation applies from 2 August 2025; models already on the market before then must have a summary by 2 August 2027.

What the summary template asks

The template has three parts.

  • General information. The provider, the model, the modalities in the training data, and for each modality a size range: under 1 billion tokens, 1 billion to 10 trillion, or over 10 trillion.
  • Data sources. Public datasets, private datasets from third parties, crawled content, user data, synthetic data and other sources, each in its own section.
  • Processing. Measures to respect text and data mining opt-outs, and measures to remove illegal content.

Licensed enterprise data in the template

Private datasets from third parties are split in two. Section 2.2.1 covers data under commercial licensing agreements with rightsholders or their representatives; for it, the template asks only whether such agreements exist and which modalities they cover. Section 2.2.2 covers private data obtained from other third parties, such as database providers and intermediaries without such a licence; for it, providers list the datasets if they are publicly known, and otherwise give a general description of modality, nature of content (for example personal data) and linguistic characteristics.

Which section a delivery belongs in depends on the supplier's position in the chain of rights. That makes the rights record a compliance document, not just a legal one. Ask for it with the sample, and record the answer in section 9 of the datasheet.

High-risk systems are a separate track

If you build a high-risk AI system rather than a general-purpose model, Article 10 applies to training, validation and test data: documented collection processes and origin, preparation steps, examination for bias, and identification of gaps. The same supplier inputs listed below cover most of what that requires.

A lawyer reviewing a printed agreement with a pen at a long boardroom table in the evening, a colleague reading a laptop opposite

Supplier inputs

What to collect, item by item

Each row pairs a documentation need with what the supplier must provide to meet it.
Summary 1.3: modality and size range
Token count per modality, with the tokenizer used, so you can place it in a range
Summary 2.2: source category
The chain of rights: is the supplier the rightsholder, its representative, or an intermediary?
Summary 2.2.2: general description
Nature of content (personal data, business records), linguistic characteristics, period
Summary 3.1: TDM opt-outs
Confirmation that the data is licensed private records, not crawled content
Summary 3.2: illegal content
What was screened for, with which method, and what was removed
Annex XI: provenance and curation
Export route, selection rules, filtering, conversion and de-identification steps
Annex XI: data points and characteristics
Record counts, languages, sectors, functions, known gaps and skews
Annex XI: unsuitable sources and bias
Checks run for skew, duplication and unsuitable content, and their results

Licence checklist

Clauses that back the documentation

Documentation is only as good as the obligation behind it. These clauses make the supplier's answers binding. The procurement page puts them in the order of a deal.
  1. 01Grant: the licensed uses named one by one (training, fine-tuning, evaluation, RL environments)
  2. 02Warranty that the supplier holds or represents the rights, with the chain of title attached
  3. 03Third-party content: what was found, what was removed, who carries the risk for the rest
  4. 04De-identification warranty tied to the datasheet's method and evidence
  5. 05Ban on re-identification and on linking with other data to single out people
  6. 06Delivery of a completed datasheet and updates when the data changes
  7. 07Cooperation: the supplier answers questions from you or a regulator about the data
  8. 08Withdrawal: what happens when a person or rightsholder asks for records to be removed
  9. 09Term, territory and exclusivity, with end dates
  10. 10End of term: deletion or return of data, and the status of models already trained
  11. 11Liability and indemnity sized to the realistic exposure
  12. 12Sanctions and export screening of both parties

FAQ

AI Act training data questions

What does the EU AI Act require about training data?

Providers of general-purpose AI models must keep technical documentation that describes training data, put in place a copyright policy that respects text and data mining opt-outs, and publish a summary of training content using the Commission's template (Article 53).

When do the training-data obligations apply?

From 2 August 2025. Providers of models placed on the market before that date have until 2 August 2027 to publish the summary. The AI Office's supervision and enforcement starts on 2 August 2026, according to the Commission's explanatory notice.

Do labs have to name the companies they licensed data from?

For data commercially licensed from rightsholders or their representatives, the template asks for limited information: whether such agreements exist and which modalities they cover. It does not ask to list licensors by name.

Is a data broker a rightsholder's representative?

It depends on the contracts. If the broker licenses on behalf of the rightsholder under a commercial licence, the data fits the licensed category. If not, it may count as a private dataset from another third party, which needs a general description. Ask for the chain of rights.

Which size ranges does the public summary use?

Three broad ranges per modality: less than 1 billion tokens, 1 billion to 10 trillion tokens, and more than 10 trillion tokens. A supplier's token count, with the tokenizer named, helps you add the set to the right total.

Does the AI Act apply to labs outside the EU?

The general-purpose AI model obligations apply to providers that place models on the EU market, wherever the provider is established.

Is this page legal advice?

No. It summarises published texts and turns them into questions for suppliers. Have your counsel confirm how the rules apply to your models.

Keep reading

Datasheet templateSection 9 collects the AI Act inputs.De-identification checklistPersonal data in licensed sets.How labs procure enterprise dataLicence models and diligence steps.

Next step

Need a dataset with the AI Act inputs filled in?

Name the data type, languages, period, volume and intended use. We answer by email with what can be assembled and how it would be documented.

Request a datasetBrowse spec sheets