Training Data Summary: The GPAI Disclosure Under Article 53(1)(d)

A training data summary is the public, "sufficiently detailed summary" of the content a general-purpose AI model was trained on, which the model's provider must draw up and make public under Article 53(1)(d) of the EU AI Act, Regulation (EU) 2024/1689. It has applied since 2 August 2025.

Two things make it distinctive, and both are routinely missed. First, it is a public transparency document, not internal engineering paperwork — it is meant to be read by copyright holders, regulators and the public, not filed in a drawer. Second, it survives the open-source carve-out: even a GPAI model released under a free and open-source licence must publish it.

---

What it is — and what it is not

The summary describes, at a general level, the data used to train a GPAI model: the main data sources and types, so that parties with a legitimate interest — notably rights-holders — can understand what went into the model. It is written against a template published by the AI Office, the EU body inside the Commission that supervises GPAI models, which standardises the format so summaries across providers are comparable.

It is not the model's technical documentation (Article 53(1)(a), detailed in Annex XI) and not the downstream information pack given to those who build on the model (Article 53(1)(b), Annex XII). Those are detailed, often confidential, and aimed at regulators and downstream providers. The training data summary is the opposite: deliberately high-level and public.

---

Who must publish it

The duty falls on the provider of the GPAI model — the party that develops a general-purpose AI model and places it on the EU market — not on the downstream companies that merely use the model through an API. A general-purpose AI model, defined in Article 3(63), is one that shows significant generality and can perform a wide range of distinct tasks; the large language and image models behind common AI tools are the typical examples.

Crucially, the summary survives the open-source carve-out. Article 53(2) relieves providers of GPAI models released under a free and open-source licence from the technical-documentation and downstream-information duties — but it expressly preserves the copyright policy (53(1)(c)) and the training data summary (53(1)(d)). So an open-weights model provider still publishes the summary. (This is the model-provider open-source carve-out under Chapter V; do not confuse it with the separate Article 2(12) open-source exemption for AI systems.) Systemic-risk GPAI models — those presumed under Article 51 at the 10²⁵-FLOP compute threshold — keep the duty in full and carry added obligations under Article 55 on top.

---

Timeline and enforcement

The duty has applied since 2 August 2025, when the Chapter V GPAI obligations took effect. GPAI models placed on the market before that date have until 2 August 2027 to bring themselves into line (the transitional provision). The Digital Omnibus deferral of the high-risk regime — adopted, European Parliament 16 June 2026, Council 29 June 2026 — does not touch Chapter V, so the training-data-summary timing is unchanged.

Enforcement of GPAI-provider duties sits with the Commission, which can fine GPAI model providers up to €15 million or 3% of total worldwide annual turnover under Article 101 — a separate regime from the Article 99 fines that apply to providers and deployers of AI systems.

---

Worked example: who actually has to do this

Most companies reading this are on the receiving end of the summary, not the publishing end.

Take Verda Models SAS, a fictional French start-up — about 40 employees, ~€6M turnover — that trains and releases its own general-purpose language model under an open-source licence. As the GPAI model provider, Verda must draw up the training data summary using the AI Office template and publish it — and because Article 53(2) preserves this duty for open-source models, the open licence does not excuse it. Verda is also relieved of the Annex XI/XII documentation duties (unless the model is systemic-risk), but the summary and the copyright policy stay.

Now take Kontor B2B GmbH, a fictional German SaaS firm — ~90 employees — that builds a product on a third-party GPAI model via an API. Kontor is a deployer / downstream provider, not the model provider. It does not publish a training data summary; that is the upstream model provider's job. Kontor's interest in the summary is practical: it reads the upstream provider's published summary as part of its own vendor due diligence — to understand data provenance and copyright exposure — but the publication obligation is not Kontor's.

---

How Confir helps

Confir's focus is the deployer and system-provider side that fits an SMB user: it classifies the AI systems you build or deploy on GPAI models — by intended purpose, under Articles 5, 6 and 50 — and records which model sits underneath each, so you can see where the GPAI provider's duties (including the Article 53(1)(d) summary) end and yours begin. The engine is deterministic and rule-based — the same intake yields the same cited finding. Confir's coverage of GPAI provider obligations themselves is partial and on the roadmap.

---

Related guides

• What is a GPAI model?
• Training, validation and testing data (Article 10)
• Article 53: obligations for all GPAI providers
• Open-source AI under the EU AI Act
• GPAI obligations explained
• The Digital Omnibus, defined