The AI Act places the training-data obligations on the developer, not on the company that supplies the data. Providers of general-purpose AI models must keep technical documentation that describes their training data, have a policy to comply with EU copyright law, including rightholders' opt-outs from text and data mining, and publish a summary of the content used for training on the Commission's template. Those duties apply since 2 August 2025. A developer can only meet them if its suppliers can tell it where each dataset came from, on what rights, and how it was prepared, so those questions reach the seller as due diligence requests, warranties and documentation obligations in the licence.
Who carries the obligations
The AI Act regulates providers of AI models and systems. A Greek company that licenses a dataset to a developer is not, for that reason alone, a provider, and the Act does not impose training-data duties on it directly. The pressure arrives through the contract. The developer has obligations it cannot meet without information only the seller holds, and it will write that information into the licence.
What providers of general-purpose models must do
Article 53 of the Act sets four obligations for providers of general-purpose AI models. Two concern the training data directly. First, they must put in place a policy to comply with EU copyright law and, in particular, to identify and comply with rightholders' reservations against text and data mining, using state-of-the-art technologies. Second, they must draw up and publish a sufficiently detailed summary of the content used for training, according to a template provided by the AI Office.
The other two concern documentation. Providers must keep technical documentation for the authorities and supply information to companies that build the model into their own systems. The documentation for the authorities must describe, among other things, the type and provenance of the training data, the curation methods such as cleaning and filtering, the number of data points, their scope and main characteristics, and how the data was obtained and selected.
Providers of models released under a free and open-source licence, with their weights published, are exempt from the two documentation obligations, but not from the copyright policy or the training-content summary, unless the model presents systemic risk, in which case the exemption does not apply at all.
Dates, the template and the code of practice
The general-purpose model obligations have applied since 2 August 2025. Models already on the market before that date have until 2 August 2027 to comply. From 2 August 2026 the Commission can fine providers up to 3% of worldwide annual turnover or EUR 15 million, whichever is higher. The Digital Omnibus on AI, Regulation (EU) 2026/1744, published on 24 July 2026, postponed several high-risk deadlines but did not amend Article 53.
The Commission published the template for the training-content summary on 24 July 2025. For a seller it contains a point worth knowing. Where the provider has concluded commercial licensing agreements with rightholders, the template asks only whether such agreements exist and which kinds of content (text, image, video, audio, other) they cover; the explanatory notice explains that limited disclosure is required for licensed data because the rightholders are parties to the agreements. Private datasets obtained from other third parties, such as providers of private databases or data intermediaries, must be named only if they are publicly known, and are otherwise described in general terms. A licence does not, by itself, mean that the seller's name will appear in a public summary.
The General-Purpose AI Code of Practice, published on 10 July 2025, is a voluntary tool that the Commission and the AI Board have confirmed as adequate for showing compliance. Its copyright chapter commits signatories to a written copyright policy, to crawling only lawfully accessible content, to respecting machine-readable opt-outs, to mitigating infringing outputs, and to a point of contact and complaint mechanism for rightholders.
High-risk systems and the origin of the data
Some buyers are not building general-purpose models but specialised systems, for example in recruitment, creditworthiness checks or medical devices, which the Act classifies as high-risk. For those, the training data must be subject to data governance practices covering, among other things, the data collection processes and the origin of the data and, for personal data, the original purpose of collection. After the Digital Omnibus these rules apply from 2 December 2027 for systems listed in Annex III and from 2 August 2028 for those covered by Annex I. Buyers in these fields are already asking the questions.
What a buyer will ask the seller to warrant or document
The requests vary with the buyer's size and sector, but the core list is fairly stable.
- A provenance statement for each source: generated in-house, received from clients, purchased, collected online, open-source.
- Confirmation of the rights chain: that the seller holds the rights it is licensing, including through its contracts with employees, contractors and clients.
- For material collected online, confirmation that it was lawfully accessed and that rightholders' reservations against mining were respected.
- A personal data statement: what was removed, how anonymisation was done and tested, and whether any personal data remains and on what basis.
- A description of curation: cleaning, filtering, de-duplication, labelling, and whether any part of the data is itself machine-generated.
- Volumes, formats, modality and the time period covered.
- Cooperation if a regulator or rightholder asks the buyer questions about the data.
What the seller should keep in mind
Good documentation raises the price of a dataset, because it lowers the buyer's compliance cost. But warranties should match what the company actually knows. A company can warrant what it created and what its contracts say; it cannot reasonably warrant that nothing in a decade-old archive was ever copied from elsewhere. Knowledge qualifiers, a defined list of disclosed exceptions, and a liability cap tied to the price are the usual tools, discussed on our page on licence terms. It is also worth keeping a dated record of the documentation delivered, since the buyer's obligations continue for as long as its model is on the market.
Questions clients ask
Does the AI Act apply to our company if we only sell data?
Not directly, as far as training-data obligations go. They rest on the providers of AI models. In practice they reach the seller through the buyer's due diligence and the warranties in the licence.
Will our company be named in the developer's public training summary?
Not necessarily. For content licensed from rightholders, the Commission's template asks only whether licensing agreements exist and which kinds of content they cover. Confidentiality of the deal is still a matter for the contract.
Did the 2026 Digital Omnibus change the training-data rules?
Regulation (EU) 2026/1744 did not amend Article 53. It mainly moved the dates for high-risk systems and made other targeted changes.
Sources
- Regulation (EU) 2024/1689 (AI Act), Articles 10(2), 53(1)-(2), 101(1), 111(3), 113 and Annex XI; recital 107
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), OJ L 24.7.2026, point (40) amending Article 113
- European Commission, Explanatory Notice and Template for the Public Summary of Training Content for general-purpose AI models (published 24 July 2025), sections 2.2.1 and 2.2.2
- European Commission, The General-Purpose AI Code of Practice (published 10 July 2025), Copyright chapter, Measures 1.1-1.5
- Directive (EU) 2019/790, Article 4(3) (reservation of rights against text and data mining)
This page is general information, not legal advice; the answer in any real case depends on its facts and documents.
L+A advises Greek companies on data protection, data licensing and the regulation of artificial intelligence.
