The EU GPAI public training-content summary is a model-level page about sources, modalities and processing, not a dataset card for the human set you add – training, evaluation, shipping, TTS and faces still need yes-or-no lines next to the object store.
That distinction is now expensive. Article 53 of the AI Act requires providers of general-purpose AI models placed on the Union market to publish a sufficiently detailed summary of training content, against a Commission template. Using the template is mandatory. The obligation has applied since 2 August 2025. The AI Office’s enforcement powers, including fines, applied from 2 August 2026. We are past the informal-collaboration year. A missing or theatrical summary is no longer a 2025 homework item. It is an enforcement object. It is still not a pack for the kitchen speech, the chest-camera hours, or the preference pairs you bolted on last Tuesday.
The market confusion is predictable. Compliance decks treat “we published the summary” as “our training data is governed.” Product teams treat the page as a dataset card they can point an auditor at when the human set is asked about. Neither is true. The summary is a model-level transparency device aimed at parties with legitimate interests under Union law, especially copyright holders. It talks about sources, modalities, size bands, crawlers, user data, synthetic data, and processing such as opt-outs and illegal-content removal. It does not tell anyone whether the people in your fine-tune agreed to shipping, eval, TTS, or faces.
What the template actually asks for
The Commission’s explanatory notice and template, published in July 2025, set a common minimum. Three sections.
General information: who the provider is, which model or versions the page covers, types of training content, size per modality in broad ranges, general characteristics.
List of data sources: publicly available datasets, private datasets, data scraped from online sources, user data, synthetic data, with different levels of detail by source so that trade secrets are not the same conversation as a crawl log. Scraped sources go as far as crawler names, collection window, a description of what was taken, and a list of the top slice of domains.
Relevant data processing: the parts that help rightsholders and other legitimate-interest parties, including copyright reservations and removal of illegal content. Each section allows extra voluntary detail.
Who must publish: any provider of a GPAI model on the Union market, including open-source releases, including models with systemic risk. When: no later than placing the model on the market, on the official site, clearly which model it covers, and alongside the model on public distribution channels. Updates: at six-month intervals, or sooner if further training makes a material change, whichever comes first. Downstream modifiers who become providers of a new GPAI model summarise only the content used for the modification, with a pointer to the base model’s summary. Failure to publish can be enforced from 2 August 2026, with fines of up to 3 percent of worldwide turnover or 15 million euros, whichever is higher. Older models placed before August 2025 have until 2 August 2027, with a best-efforts gap clause if retrieval of historic sources is disproportionate.
That is a real page with a real deadline. It is also a press-adjacent object if you read it as a substitute for records you do not have. The template is explicit that it will not demand personal information about users. Further detail on personal data, it says, lives in privacy statements. Copyright holders get domain lists and crawler names. The people in a consented speech set do not get a line that says commercial training, evaluation, shipping, TTS, faces. Those lines were never the point of Article 53(1)(d).
We already wrote that Brussels is rewriting who may train on what, and that Article 10 is a data spec wearing a regulation. The summary is the GPAI transparency cousin of those two tracks. Copyright policy under 53(1)(c) is a different obligation again, and the Code of Practice is voluntary. The template is not. Do not glue them into one slogan called “AI Act data.” Crawls, high-risk systems, and the human set you just collected are three conversations.
What the page will not do for a human set
A familiar week in a lab that sells into the Union. Counsel asks for the training-content summary. Someone pastes the URL. A buyer then asks whether the fine-tune speakers licensed commercial shipping. Silence. A second question: are eval people held out. Silence. A third: is TTS in scope, and are faces in the video takes. The summary says the model saw audio and video in some size band, lists a few public corpora, describes a crawl, and notes that user interactions may have been used. None of those sentences is a yes or no about your files.
Off-the-shelf research corpora make the hole obvious. A Hugging Face card that says research use is how those files enter companies. The prototype works. The product owner asks when it can ship. Nobody read the sentence that forbade commercial training. The GPAI summary might mention that a public dataset was used. It will not repair the licence. Expanding a research purpose after the weight exists is a new negotiation, often an impossible one.
Internal prototype use is still a purpose. The moment you add a human set to a GPAI base, you have a second pack. The base-model summary is the provider’s problem until you modify the data picture. If your fine-tune is itself a GPAI model on the Union market, you owe a summary of the modification content. That summary still will not be a dataset card. It will say you used private data of such-and-such modality. The auditor who wants names of uses, consent language, age gates, withdrawal, and whether eval copies may be kept is asking for the pack next to the object store.
Faces, voices, and first-person rooms were never saved by robots.txt. You can have a perfect crawler identity, a domain list, and a copyright-reservation process, and still have no licence to ship a speech model trained on people who rang a shop, or a manipulation policy trained on a household that thought it was helping a robot lab for research. Consented training data is a person who was told the capture and the use. A rights-cleared dataset is a chain you can show. The GPAI page is a model-level story about sources.
Synthetic data has its own row in the template. Labelling a file “synthetic” on the summary does not clear an uncleared seed, and it does not create a human baseline. If the generator was trained on homes or faces you could not license, the overlay is those homes with extra steps. Put lineage on the card of the human set. Do not expect the GPAI page to do it.
Eval is the other quiet miss. The template cares about training content. Validation and test sets, for high-risk systems, are Article 10’s language. For everyone else they are still how you know the product moved. A summary that lists sources will not tell you whether the same contractors wrote the SFT and the quarterly metric, whether speakers were held out, or whether gold items were folded into the fine-tune because they were labelled and convenient. Hold eval out. Write it down. The Commission page will not.
What should sit next to the object store
How the set was collected. Who is in it. What they agreed to. Which uses are licensed, as separate yes or no lines: training, evaluation, shipping, TTS, faces. How gold and disagreement work. Whether eval people are held out. Known gaps: night-time, a locale you did not collect, a device you do not support. You do not need signed forms on a marketing site. You do need redacted templates and a chain you can show an auditor or an acquirer.
Off-the-shelf is allowed when the object matches and the pack exists. A catalogue dump with no card is not a governance practice, and pointing at the base model’s GPAI summary does not become one. Listen or look with the actual trainer before you scale. Custom when the kitchen, the locale, the faces decision, or the high-risk workflow is yours.
If you crawl, the summary is your homework: sources, crawlers, windows, domains, opt-outs, illegal-content process, six-month updates. Do that. It is mandatory. If you buy or collect humans, do the other homework on the same calendar, because enforcement energy on GPAI will pull questions about everything else you added. Buyers in the Union are already writing both into RFPs. US acquirers ask where the human inputs came from whether or not you think you are “not in Europe.”
Do not relabel a US booth corpus as Union-ready because the summary is live and the inference runs in Frankfurt. Hosting is not the setting. A diversity slide is not the pack. A model-level page that says “audio, private datasets, some user data” is not yes-or-no on TTS. Fine-tunes sitting inside a high-risk workflow inherit Article 10 even when the base model has a beautiful summary. Write the setting into the collection. Write the uses into the consent. Hold eval out.
The Act did not invent dataset cards. It made the missing one a diligence finding, and it made the model-level cousin a public enforcement object. Teams who treat the summary as the card will pass a web check and fail a file check. Teams who keep both will be able to answer the only question that matters when a human set is on the table: what did these people agree to, for which uses, and can you still prove it.
If you are scoping a human collection against a model that will be on the Union market, publish the summary because you must. Then write the pack because the summary will not. Training, evaluation, shipping, TTS, faces. Separate lines. Next to the files. That is the work the template left for you.
People4.ai will not pretend a Commission page is a consent chain. hello@people4.ai · Contact
FAQ
Does publishing the GPAI summary cover the speech or video we fine-tuned on?
No. The summary is a model-level account of sources, modalities and processing. The human set still needs its own card: who is in it, what they agreed to, and yes-or-no on training, evaluation, shipping, TTS and faces.
If we only fine-tune, does Article 53 still apply to us?
The base provider owes the original summary. If your modification makes you the provider of a GPAI model on the Union market, you summarise the additional content and point at the base page. You still need rights on the human files you added either way.
Is the summary enough for Article 10 as well?
No. Article 10 is about training, validation and test sets matching the setting for high-risk systems. A public source list does not prove the booth is the kitchen, or that eval people were held out. Spec the setting. Collect it. Keep the pack.
Related reading
Article 10 is a data spec wearing a regulation · Brussels is still rewriting who may train on what