The GPAI Copyright Policy Obligation, Explained

Article 53(1)(c) of the EU AI Act is short, and it is routinely described as a training-data transparency rule. It is not one. It requires a provider to have a policy, and the policy is about compliance with copyright law — principally with a mechanism that lives in a different instrument entirely.

What the provision actually says

Regulation (EU) 2024/1689, Article 53(1)(c), obliges providers of general-purpose AI models to put in place a policy to comply with Union law on copyright and related rights, and in particular to identify and comply with — including through state-of-the-art technologies — a reservation of rights expressed pursuant to Article 4(3) of Directive (EU) 2019/790. The full text is on EUR-Lex, and the directive it points at is the 2019 Copyright in the Digital Single Market Directive.

Three things are worth noticing about that sentence before anything else. It creates an obligation to have a policy, not an obligation to achieve a particular outcome. It names the substantive law it is a policy about — Union copyright law, which the AI Act does not itself amend. And it singles out one specific mechanism, the Article 4(3) reservation, as the thing the policy must in particular address.

Why it is not a disclosure duty

The disclosure duty is the next point along. Article 53(1)(d) requires a publicly available, sufficiently detailed summary of the content used for training, following an AI Office template — that is the transparency obligation, and it is covered on the training content summary page. Point (c) is separate and does not, on its face, require the policy itself to be published at all.

The distinction matters in practice because the two duties have different audiences and different failure modes. A summary is a document you publish and a rightsholder reads. A copyright policy is an internal control: it describes how the organisation decides what may be ingested, how reservations are detected, what happens when one is found, and who is accountable when the process is not followed. A provider can satisfy (d) with a document and still be exposed on (c) if nothing in the pipeline actually acts on an opt-out.

Nor does Article 53(1)(c) settle whether a particular act of training infringed copyright. It does not create a new exception, it does not narrow one, and it does not decide the questions that are being litigated in national courts about scraping and reproduction. It layers a governance duty on top of whatever copyright law already says. Those underlying questions are dealt with under training data and copyright law, and they are genuinely unresolved.

The Article 4(3) reservation is the hard part

Article 4 of the CDSM Directive creates a general text-and-data-mining exception: reproductions of lawfully accessible works for TDM are permitted, unless the rightsholder has expressly reserved that use. Article 4(3) adds the condition that for content made publicly available online, the reservation must be expressed in an appropriate machine-readable manner.

“Appropriate machine-readable manner” is not defined further in the directive, and that is where the compliance work sits. In practice the candidates a provider has to reason about include robots.txt directives naming AI crawlers, HTTP response headers, per-page metadata, terms-of-service statements that may or may not be machine-readable at all, and newer protocol-level proposals. There is no single register to check.

# The shape of a reservation a crawler is expected to honour.
# robots.txt on example-publisher.eu

User-agent: ExampleAIBot
Disallow: /

User-agent: *
Disallow: /archive/

Two open questions follow, and Article 53(1)(c) does not answer either. First, whether a reservation expressed only in natural-language terms of service is “machine-readable” enough to bite — German litigation and commentary have pulled in different directions, and no Court of Justice ruling settles it. Second, what a provider owes for data it did not crawl itself: models are routinely trained on third-party corpora, and the provision requires the policy to be effective without specifying how far up the supply chain diligence must reach. Both would be settled by a CJEU reference or by harmonised guidance; neither has been.

The phrase “including through state-of-the-art technologies” is doing quiet work here. It means the standard is not static: a detection method that was reasonable in 2024 and is superseded is not obviously still adequate, which is a large part of why this page is marked for revisiting rather than written once.

What a policy has to contain

The Act does not enumerate contents. The GPAI Code of Practice, which the Commission published in July 2025, contains a copyright chapter that sets out commitments its signatories take on, and adherence to it is the route most providers have taken to show what an adequate policy looks like. That route and its legal effect are described on the Code of Practice page. Reading the obligation and the code together, a policy that is doing real work tends to cover:

• Crawling conduct. Which crawlers the provider operates, under what user-agent strings, and a commitment that those crawlers read and respect reservations rather than merely being capable of it.
• Reservation detection. How reservations are identified across the formats above, and what is done about content already collected when a reservation appears afterwards.
• Access lawfulness. Article 4 only applies to lawfully accessible content, so a policy has to address paywall circumvention and known piracy sources rather than treat all reachable URLs as equivalent.
• Third-party datasets. What diligence is applied to corpora obtained from others, since the obligation follows the model provider regardless of who did the crawling.
• Complaints. A route for rightsholders to raise an issue and a named function that owns the answer.

Who owes it, and from when

The duty falls on providers of general-purpose AI models. It is not limited to models with systemic risk, and — this is the point most often got wrong — it is not switched off by the open-source carve-out. Article 53(2) disapplies points (a) and (b) for qualifying free and open-source models; points (c) and (d) survive. That asymmetry is set out on the open-source exemption page.

The GPAI obligations in Chapter V applied from 2 August 2025 under Article 113. Article 111(3) gives providers of models placed on the market before that date until 2 August 2027 to bring them into compliance. Enforcement of GPAI obligations sits with the Commission rather than national authorities, and Article 101 sets a ceiling of 3% of total worldwide annual turnover or EUR 15 million, whichever is higher, for the fines it may impose on model providers.