The GPAI Copyright Policy Obligation in Practice

Since 2 August 2025 a provider placing a general-purpose AI model on the EU market has had to have a copyright policy. Almost every summary of that obligation conflates it with the separate duty to publish a training-content summary, and with the voluntary Code of Practice that sits on top of both. They are three different things with three different legal statuses.

What Article 53(1)(c) requires

Regulation (EU) 2024/1689 — the AI Act — imposes obligations on providers of general-purpose AI models in Article 53. Point (c) of Article 53(1) requires the provider to put in place a policy to comply with Union law on copyright and related rights, and in particular to identify and comply with reservations of rights expressed under Article 4(3) of Directive (EU) 2019/790, the CDSM Directive. The text is at EUR-Lex.

Three features of that wording do most of the work. It requires a policy, meaning an internal, operative arrangement rather than a public statement — the Act does not on its face require the policy to be published. It is tied specifically to the machine-readable rights reservation mechanism in Article 4(3) of the CDSM Directive, so it is an obligation about honouring opt-outs, not a general licensing mandate. And by Article 2(1) and the Act’s territorial provisions it reaches providers placing models on the EU market wherever they are established, which is why non-European labs are in scope at all.

Three documents that get confused

• The copyright policy — Article 53(1)(c). Mandatory. An internal policy covering compliance with Union copyright law and the identification and observance of Article 4(3) reservations. Publication is not itself the obligation.
• The training-content summary — Article 53(1)(d). Mandatory, and this one is explicitly public: the provider must draw up and make publicly available a sufficiently detailed summary of the content used for training, according to a template provided by the AI Office. The template was published by the Commission in July 2025, and it is the reason these summaries look alike across providers — the structure is prescribed. See the training-content summary for what the template asks for.
• The Code of Practice. Voluntary. Adherence is a means of demonstrating compliance under Article 56, not a separate obligation, and a provider may demonstrate compliance by other adequate means.

Getting these apart matters practically. A reader who searches for “where is OpenAI’s Article 53(1)(c) copyright policy” may find nothing published and conclude something is wrong; the document that is required to be public is the training-content summary, and the copyright policy may be disclosed voluntarily, referenced in the summary, or held internally and produced to the AI Office on request.

The Code of Practice copyright chapter

The General-Purpose AI Code of Practice was published by the European Commission on 10 July 2025, developed through a multi-stakeholder process convened by the AI Office. It has three chapters — transparency, copyright, and safety and security, the last applying only to models with systemic risk. The copyright chapter is the one that gives Article 53(1)(c) an operational shape, and it is where the substantive commitments live.

Its commitments run broadly to: reproducing only lawfully accessible content when crawling; not circumventing technological protection measures; identifying and complying with rights reservations expressed through robots.txt and other machine-readable means, including reservations expressed after a crawl; taking reasonable measures to mitigate the risk of a model producing outputs that reproduce protected training content; and designating a point of contact for rightsholder complaints. The Commission publishes the Code and the associated guidelines at its digital strategy site.

The robots.txt anchoring is the part with the most engineering consequence, and also the part with the least settled meaning. Article 4(3) of the CDSM Directive requires a reservation to be expressed in a machine-readable manner for content made publicly available online, and it does not say how. Whether a natural-language notice in terms of service qualifies, and whether a reservation must be honoured retroactively for data already collected, are both genuinely unresolved — the Code takes a position, but a Code of Practice is not an authoritative interpretation of a Directive, and only a court or the Court of Justice can settle it.

Who signed, and what signing means

Signature is public and is the observable fact here. Following publication in July 2025 the Commission published a list of signatories that included, among others, OpenAI, Anthropic, Google, Microsoft, Amazon, IBM, Mistral AI, Cohere and Aleph Alpha. Meta stated publicly in July 2025 that it would not sign. At least one signatory adhered to some chapters and not others, which the Code permits.

What signature buys is procedural. Under Article 56 the Commission may approve a code as adequate, and adherence is then a route to demonstrating compliance — one the Commission has said it will take into account in enforcement. It does not convert the Code’s commitments into statutory obligations, and it does not immunise a signatory: the legal duty remains the Article 53 duty, and a provider who signs and then fails to do what the Code says has a compliance problem under Article 53 rather than under the Code.

Finding what a provider has published

Rather than characterise documents second-hand, go to them. Three places hold the primary material: the Commission’s Code of Practice page above carries the Code text, the training-content summary template and the signatory list; each provider’s own EU-facing legal or transparency pages carry its published summary, usually titled as a public summary of training content; and the AI Act text itself supplies what the summary must contain. Read the provider’s summary against the template rather than against a press description of it — the template’s section headings make omissions visible in a way prose does not.

For the obligation itself rather than its practice, see the Article 53(1)(c) obligation, and for how the whole GPAI chapter fits together, GPAI obligations.