Short answer: The headline is directionally right but too broad. The European Union’s AI Act requires providers of general-purpose AI (GPAI) models placed on the EU market to maintain a copyright-compliance policy and publish a structured summary of the content used to train each model. It does not require every business that uses an AI service to list copyrighted works, and it does not automatically make training on copyrighted material illegal.
What the EU rule actually is
The requirement comes from Article 53 of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689). It applies to providers of general-purpose AI models—often called foundation models—capable of performing a wide range of tasks.
A covered provider must maintain a policy for complying with EU copyright law, including respecting rights reservations used to opt out of commercial text-and-data mining. It must also publish a “sufficiently detailed” public summary of the content used to train each covered model, using the European Commission’s mandatory template. The provider has additional technical-documentation duties under the Act.
The obligations began applying on August 2, 2025. The Commission’s AI Office begins enforcement of the GPAI obligations on August 2, 2026. Models placed on the EU market before August 2, 2025 have until August 2, 2027 to make the corresponding summaries available.
Recommended Free Tools
Which companies are covered?
Article 53 is primarily a provider obligation, not a general rule for anyone who uses artificial intelligence. Whether a business is covered depends on its role, the model and how the model is placed on the EU market.
| Entity | Likely Article 53 position |
|---|---|
| Foundation-model provider | Covered when it places a GPAI model on the EU market. |
| Company fine-tuning or modifying a base model | Must analyze whether it becomes a provider of a GPAI model and document the additional data used. |
| Enterprise using an API internally | Usually not the Article 53 provider merely because it uses ChatGPT, Gemini, Claude or another service. |
| Open-source model provider | Still subject to the copyright-policy and public training-summary duties, even if some other GPAI obligations are reduced. |
| AI application deployer | May have separate duties, including transparency rules for certain generated or manipulated content. |
The Commission’s guidance confirms that free and open-source licensing does not create a blanket exemption from the two copyright-related duties. Providers outside the EU may also be in scope when a covered model is placed on the EU market; headquarters alone does not answer the jurisdiction question.
What counts as a general-purpose AI model?
The Commission identifies models trained above a specified compute level and capable of generating language as GPAI models. Its fact page gives a general threshold of more than 1023 floating-point operations (FLOP) for the relevant category and identifies 1025 FLOP as the threshold associated with presumed systemic risk, subject to review. Those figures do not mean that every generative-AI product is automatically covered.
Classification can depend on the model’s capabilities, training compute, the company’s legal role, whether the model is placed on the EU market and whether a specific exemption or compliance route applies.
Rank #2
What the public training summary can contain
The Commission’s template and FAQ organize the disclosure into broad categories rather than a universal inventory of individual works.
General model and data information
- The provider and model identity.
- Covered model versions.
- Training modalities, such as text, images, video, audio or other data.
- The scale and general characteristics of the training content.
Sources of training data
- Public and private datasets.
- Licensed or third-party data.
- Material scraped from online sources.
- User data, where applicable.
- Synthetic data.
- Large publicly available datasets.
- Online domains from which data was collected.
For scraped material, the template can require the crawlers used, collection periods, a detailed description of the content and the top 10% of scraped domains. For small and medium-sized enterprises, the domain disclosure is the top 5% or 1,000 domains, whichever is lower.
Processing and copyright practices
- Filtering, cleaning and other processing methods.
- How rights reservations and text-and-data-mining opt-outs were handled.
- Removal of illegal content.
- Relevant licensing and provenance practices.
- Whether user interactions were used for training.
The Commission says the template does not require publication of personal information about individual users.
What the rule does not require
Not necessarily a work-by-work list
A public summary is different from a complete list of every book, article, image, song, video or software file in a training corpus. Article 53 requires meaningful source and content information while taking account of trade secrets and confidential business information. The level of detail varies by source and data type.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
Not a public license ledger
Listing a dataset or domain does not prove that the provider held a license, that a text-and-data-mining exception applied, or that no rightsholder reserved rights. Conversely, leaving an item out of a summary does not by itself prove infringement.
Not a finding that training was unlawful
The disclosure duty and the legality of a particular training use are separate questions. EU copyright rules, licenses, rights reservations and the facts of collection determine legality. The European Commission has explained that Article 53 oversight concerns the required policy and summary; it is not a work-by-work copyright adjudication.
For commercial text-and-data mining, rightsholders can reserve their rights under the EU framework. Providers therefore need processes for identifying and honoring those reservations, but the AI Act does not declare all training on copyrighted material illegal.
How modified and fine-tuned models are handled
If a provider modifies an existing GPAI model with different training or fine-tuning data, its summary can focus on the additional data. It should identify the original model and link to the original provider’s summary. This is relevant to enterprise fine-tunes, specialized language checkpoints, regional versions and models adapted with proprietary customer data.
Key dates and enforcement
| Date | Event |
|---|---|
| June 13, 2024 | Official date of the AI Act text. |
| July 10, 2025 | General-Purpose AI Code of Practice published. |
| July 24, 2025 | Commission published the training-content summary template. |
| August 2, 2025 | GPAI obligations began applying. |
| August 2, 2026 | AI Office enforcement of GPAI obligations begins; Article 50 output-transparency duties also apply from this date. |
| August 2, 2027 | Deadline for corresponding summaries for models placed on the EU market before August 2, 2025. |
The Commission’s template FAQ says failure to publish the required summary can lead to enforcement from August 2, 2026, with fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher. The applicable amount depends on the specific infringement and the Act’s enforcement provisions.
The Code of Practice is voluntary
The General-Purpose AI Code of Practice is not the statute. Providers may sign it as a recognized route to demonstrate compliance, but providers that do not sign must use alternative adequate means and be able to explain them.
The Code has Transparency and Copyright chapters relevant to all GPAI providers, plus a Safety and Security chapter for models with systemic risk. The Commission’s signatory list includes Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI, OpenAI, Cohere, Aleph Alpha, ServiceNow, WRITER, Black Forest Labs and Bria AI, among others; the list can change. The Commission says xAI signed only the Safety and Security chapter and must show compliance with transparency and copyright duties through alternative adequate means.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why creators and publishers may care
A summary can help a rightsholder determine whether a provider used scraped online material, which major datasets and domains were involved, whether rights reservations were considered and whether a licensing or legal inquiry is worth pursuing. It does not by itself establish that a particular work was copied or that a claim will succeed.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The European Parliament has considered proposals for more granular, potentially itemized transparency—including later uses such as retrieval-augmented generation and fine-tuning—but those proposals should not be confused with current Article 53 law. See the Parliament document for the proposal’s status and text.
Practical compliance checklist for providers
- Classify the model. Determine whether it is GPAI, whether the company is the legal provider and whether the model is placed on the EU market. Assess systemic-risk status separately.
- Inventory data sources. Record public, licensed, private, scraped, user, synthetic, third-party and fine-tuning data.
- Document copyright controls. Record rights-reservation handling, crawler identification, opt-out processes, filtering, illegal-content removal and provenance controls.
- Complete the Commission template. Identify model versions, modalities, major datasets, online collection practices, domains and processing methods. Explain any information gaps and why they exist.
- Publish the summary. Put it on the provider’s official website, make its model coverage clear and meet the applicable placement or transition deadline.
- Choose a compliance route. Implement the Code of Practice or document alternative adequate means.
- Maintain version control. Keep base-model and fine-tuning records separate, preserve evidence supporting the public summary and prepare for possible AI Office information requests.
Do not confuse Article 53 with AI-output labeling
Article 53 concerns a GPAI provider’s copyright policy and training-content summary. Article 50 addresses transparency for certain AI systems and generated or manipulated content, including labeling or marking deepfakes. The Commission’s guidance on Article 50 obligations is at the AI Act Service Desk.
Those are different questions: what trained a model, whether users are told content was AI-generated, whether a deepfake is marked and whether a company uses AI internally. One obligation does not automatically imply the others.
What businesses should take from the headline
For an ordinary company buying access to an AI model, the immediate issue is usually vendor due diligence rather than publishing a list of copyrighted material. Ask the provider whether it is in scope, where its public summary is, how it handles rights reservations and what model version the summary covers.
Free tools Windows power users keep installed
One-click scans. No signup required.
For a model provider, a generic statement that it “complies with copyright law” is not enough. The provider needs a documented policy, source inventory, Commission-format public summary and records that support the disclosure.
The most accurate interpretation is therefore narrower than the headline: the EU AI Act requires covered foundation-model providers to disclose structured information about training content and maintain copyright controls. It does not impose a universal disclosure duty on every AI user or decide, merely from the existence of copyrighted material in training data, whether a particular use was lawful.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
