The GPAI Code of Practice Copyright Chapter: Training Data Summaries, TDM Opt-Outs, and What the AI Office Can Now Enforce

Of all the obligations on general-purpose AI (GPAI) model providers, the copyright duties are the easiest for a regulator, a journalist or a rights-holder to check from the outside. Either a public training data summary exists, in the Commission's format, or it does not. Either a copyright policy and a complaints channel exist, or they do not.

That matters now. Since 2 August 2026, the European AI Office can request information, access models and impose fines of up to EUR 15 million or 3% of global annual turnover on GPAI providers that breach their obligations. This guide focuses on the copyright side of GPAI compliance: what Article 53 requires, what the Copyright chapter of the GPAI Code of Practice adds, how to fill in the training data summary template, and what rights-holders can do. For the full set of baseline and systemic-risk duties, see our GPAI obligations guide.

TL;DR

• Every GPAI provider must have a copyright policy (Article 53(1)(c)) and publish a training data summary using the Commission's mandatory template (Article 53(1)(d)).
• Models placed on the market from 2 August 2025 had to comply at launch. Older models have until 2 August 2027.
• The Code of Practice Copyright chapter turns those duties into concrete commitments: lawful crawling, honouring machine-readable opt-outs such as robots.txt, output safeguards and a complaints mechanism.
• Signing the Code is voluntary and helps demonstrate compliance, but it is not a guarantee.

Why copyright is the enforcement-ready chapter

The GPAI Code of Practice, published on 10 July 2025, has three chapters: Transparency, Copyright, and Safety and Security; the Transparency and Copyright chapters apply to all GPAI model providers, while Safety and Security applies only to models with systemic risk. (European Commission)

Transparency documentation largely flows to the AI Office and downstream providers, so outsiders cannot easily inspect it. The training data summary, by contrast, is public by design. That makes gaps visible. In the run-up to 2 August 2026, Tech Times reported that one major Code signatory's pre-enforcement compliance statement detailed its transparency and safety work but did not address the Copyright chapter or link a training data summary. The same report cited a mid-2026 benchmark study finding that Code signatories score only marginally higher than non-signatories on upstream disclosures about training data and copyright-relevant data use. Whatever the AI Office does with individual cases, the lesson for every provider is the same: the copyright deliverables are concrete, public and checkable.

What Article 53 actually requires

Two of the four baseline GPAI duties are about copyright:

• Article 53(1)(c): a copyright policy. Providers must put in place a policy to comply with EU copyright and related rights law, and in particular to identify and comply with rights reservations expressed under Article 4(3) of the Copyright in the Digital Single Market Directive (the text-and-data-mining opt-out), including through state-of-the-art technologies.
• Article 53(1)(d): a public training data summary. Providers must draw up and make publicly available a sufficiently detailed summary of the content used for training, following a template provided by the AI Office.

The European Commission published the mandatory template for the public summary of GPAI training content on 24 July 2025. (WilmerHale)

Timing. Models placed on the EU market from 2 August 2025 had to comply from the day they launched. Models already on the market before then have until 2 August 2027. Enforcement powers, including fines, have applied since 2 August 2026.

Open-source models. The open-source carve-out in Article 53(2) exempts qualifying models from the technical documentation duties, but not from the copyright policy or the training data summary. See our open-source exemption guide.

The Copyright chapter, as a checklist

The Code's Copyright chapter translates Article 53(1)(c) into a set of commitments. Use this as an internal audit list.

Commitment	What it means in practice	Evidence to keep
Copyright policy	A written policy covering all the measures below, with clear internal ownership	Approved policy document, named owner, review date
Lawful access only	Crawlers reproduce only lawfully accessible content and do not circumvent paywalls or technical protection measures	Crawler configuration, access rules, logs
Exclude infringing sources	Exclude websites recognised by courts or authorities in the EU as persistently and repeatedly infringing	Exclusion list and update procedure
Honour machine-readable opt-outs	Respect robots.txt and other appropriate machine-readable protocols for rights reservation	Crawler documentation, protocol list, compliance tests
Transparency about crawlers	Publish information about your crawlers and how you handle opt-outs	Public crawler page (user agents, purposes)
Mitigate infringing outputs	Technical safeguards against reproducing protected content, and acceptable-use terms that prohibit infringing uses	Output filters, red-team results, terms of use
Point of contact and complaints	A designated contact and an electronic mechanism for rights-holders to submit complaints, handled diligently	Contact page, complaint log, response SLAs

Sources: European Commission, contents of the Code; artificialintelligenceact.eu introduction to the Code.

How to fill in the training data summary template

The template is designed to be "sufficiently detailed" without forcing disclosure of trade secrets. Category-level description is the norm; dataset-by-dataset lists are required only for the main sources. Work through it in this order:

1. General information. Provider and model identification, modalities (text, image, audio, video), approximate size of training data per modality, languages, and the knowledge cut-off.
2. List of data sources. Broken down by source type:
   • Publicly available datasets: name the large ones, with identifiers or links.
   • Private, non-public datasets licensed from third parties: describe categories; name them where the template requires.
   • Data crawled and scraped from online sources: crawler names, purposes, collection periods, content types, and a narrative of the most relevant domains (the template asks for a summary of the top domains by volume).
   • User data: whether data from users of your services was used, and from which services.
   • Synthetic data: whether it was used and, where generated by another model, which one.
   • Other sources.
3. Data processing aspects. How you identified and respected TDM opt-outs during collection, and measures taken to remove illegal content.

Practical tips:

• Build the summary from your data lineage, not from memory. If you cannot reconstruct which crawls fed which training run, fix that first.
• Publish it where people will look: the model card, your EU AI Act page and the model's distribution page.
• Version it. A new model version with materially different training data needs an updated summary.

Handling TDM opt-outs in practice

Under EU law, text-and-data mining of lawfully accessible content is permitted for commercial purposes unless the rights-holder has reserved their rights "in an appropriate manner, such as machine-readable means". The Code makes robots.txt the minimum standard, and providers should also track other emerging protocols.

• Respect robots.txt at crawl time, using a published, identifiable user agent for your training crawler, separate from any search or live-retrieval crawler.
• Monitor other reservation signals, such as the TDM Reservation Protocol (TDMRep) and metadata-based reservations, and document which ones you honour.
• Apply reservations prospectively and record the date each crawl took place, so you can show what the opt-out status was at collection time.
• Handle licensed and third-party datasets through contractual warranties that the supplier respected opt-outs, and keep those contracts on file.

Fine-tuners: are you a provider?

Many companies modify an existing model rather than train one. Under the Commission's GPAI guidelines, a downstream modifier becomes the provider of a new GPAI model only where the compute used for the modification exceeds one third of the compute used to train the original model. If you cross that line, your obligations, including the copyright policy and training data summary, are limited to the modification: you summarise the data you used for fine-tuning, not the original pre-training corpus. Most enterprise fine-tuning stays well below the threshold, but document the calculation.

If you build an AI system on top of someone else's model, ask your supplier for its training data summary and copyright policy as part of procurement. Our guide to buying AI without becoming its provider covers the contract terms.

What rights-holders can do

• Use the provider's complaints mechanism. Every signatory must have one. Keep records of what you sent and when.
• Check the public summary to see whether crawlers and sources relevant to your content are disclosed.
• Reserve your rights in machine-readable form (robots.txt at minimum) and keep dated evidence of the reservation.
• Escalate to the AI Office where a provider has not published a summary or ignores complaints. The AI Office supervises GPAI providers directly. See our review of the first 60 days of AI Act enforcement for how the complaints channels have been working.
• Remember the AI Act does not decide infringement. Whether a specific use infringes copyright is still a question for national courts under copyright law.

A 30-day action plan for GPAI providers

1. Week 1: Confirm which models are in scope, which were placed on the market before or after 2 August 2025, and who owns copyright compliance.
2. Week 2: Reconstruct data lineage for each in-scope model and map it onto the template sections.
3. Week 3: Draft or update the copyright policy, publish crawler information, and test opt-out handling against a sample of reserved domains.
4. Week 4: Publish the training data summary, launch or audit the complaints mechanism, and brief your AI Office contact point.

FAQ

What is the GPAI Code of Practice? A voluntary code published in July 2025 that sets out how GPAI providers can meet their AI Act obligations. It has Transparency, Copyright, and Safety and Security chapters.

Is signing the Code mandatory? No. Signing is voluntary. It is a recognised way to demonstrate compliance, but providers that do not sign must show compliance by other adequate means, and signatories still have to deliver what the Code commits them to.

Does the training data summary require listing every dataset? No. It requires a sufficiently detailed, mostly category-level summary following the Commission template, with named entries for the main public datasets and a summary of the most relevant crawled domains.

What are the fines for missing a training data summary? Up to EUR 15 million or 3% of global annual turnover, whichever is higher, imposed by the Commission since 2 August 2026.

Does the UK have the same rules? No. The UK has no equivalent GPAI regime, and its text-and-data-mining exception remains limited to non-commercial research after the government dropped plans for a broad commercial exception in March 2026.

This article is general information, not legal advice.