European Union: GDPR, AI Act, TDM Exception and Data Act for AI Training Data

EU law on AI training data is a set of regulations and directives (the AI Act, the DSM Directive, the GDPR, the Data Act and the Trade Secrets Directive) that apply in all 27 member states, with national copyright and employment rules added on top.

This page lists 13 EU instruments and 27 member states as of 2026-11-09, each with its citation and date, and it is free to read. It shows where the EU side of AI training data licensing is final, where it is only proposed, and which questions a company holding data must settle before a license.

Each rule below cites the Official Journal text, a court record or a regulator page; the method for sourcing and dating every figure is public.

What EU Law Decides When a Company Licenses Data for AI Training

EU law decides four things in a data deal: whether the content may be used for training, whether personal data in it may be disclosed, which license terms bind, and whether the data stays protected after delivery.

• Rights to the content: the DSM Directive and its national transpositions.
• Personal data: the GDPR and the national employee-data rules allowed by its Art. 88.
• License terms: the unfair-terms test in Art. 13 of the Data Act.
• Confidentiality: the Trade Secrets Directive.

The AI Act binds the buyer that builds a general-purpose model, not the seller, but two of its duties reach licensed data.

EU Instruments That Apply to a Training Data Deal

Thirteen EU instruments shape a training-data license; each row gives the CELEX number, the dates it took effect and whether it is final. The table compares them as of 2026-11-09, in deal order, and a row links to its page where the site has one.

How Each EU Rule Reaches the Seller and the Buyer

The table lists each instrument; the sections below show what each one asks of a seller or a buyer.

AI Act Duties of the Model Provider That Touch Licensed Data

The AI Act binds the provider of a general-purpose AI model, not the data seller, but two of its duties reach licensed data: a copyright policy and a public summary of training content.

Under Art. 53(1)(c) the provider must honor rights reservations under DSM Art. 4(3), and under Art. 53(1)(d) it must publish the summary. Art. 53(2) exempts open-source models only from points (a) and (b), so they still owe both duties. The duties apply from 2025-08-02, and AI Office enforcement with Art. 101 fines of 3% of worldwide turnover or EUR 15,000,000, whichever is higher, starts on 2026-08-02. Models placed on the market before 2025-08-02 comply by 2027-08-02 (Art. 111(3)).

The Commission template (C(2025) 8311 final, 2025-12-05) asks only whether licensed datasets were used, as Yes or No plus modality, so a seller is not named, and summaries are updated at six-month intervals or earlier if material. The voluntary GPAI Code of Practice (2025-07-10) adds Measure 1.3, which has providers respect robots.txt under RFC 9309.

Copyright Reservations and Contract Override Under the DSM Directive

Under Directive (EU) 2019/790, anyone with lawful access may mine content for commercial purposes unless the rightholder reserved it in an appropriate manner, such as machine-readable means for online content (Art. 4(3)). Art. 3 allows research mining with no opt-out. Art. 7(1) protects only Arts. 3, 5 and 6 from contract override, so a license may exclude Art. 4, and a seller can sell the rights the exception would otherwise hand to every miner.

The Court of Justice has Art. 4 before it in Like Company v Google (C-250/25). Advocate General Szpunar's opinion of 2026-11-03 proposes that the training questions are inadmissible as hypothetical and says in passing that training falls as a rule within the exception; an opinion is not a judgment, and the judgment is pending as of 2026-11-09. The page on Like Company v. Google (CJEU C-250/25) follows the reference.

Personal Data in the Set: The GDPR Layer in Brief

Any personal data in a licensed set needs a GDPR legal basis before disclosure, and the full rules sit on the GDPR page. Regulation (EU) 2016/679 applies from 2018-05-25 and asks for a legal basis (Art. 6), a compatibility test for a new purpose (Art. 6(4)), a condition for special categories (Art. 9), notice before further processing (Art. 13(3)), notice within one month where the data came from a third party (Art. 14(3)(a)), an impact assessment for high risk (Art. 35) and a transfer tool outside the EU (Chapter V). The full rules on GDPR and AI training data cover each step, and EDPB Opinion 28/2024 of 2024-12-17 states that a model trained on personal data is not anonymous in every case.

Art. 88 lets member states set employee-data rules, but in C-34/21 (2023-03-30) the Court of Justice held that national rules not meeting Art. 88(2) must be disregarded, which is why § 26(1) BDSG went unapplied in BAG 8 AZR 209/21 (2025-05-08). Pseudonymized data is judged from the recipient's means, not treated as personal in every case (C-413/23 P, 2025-09-04).

Unfair License Terms Between Businesses (Regulation (EU) 2023/2854, Art. 13)

The Data Act makes a contract term on data access and use not binding when one enterprise imposed it unilaterally on another and it is unfair, which covers data licenses between companies. The regulation entered into force on 2024-01-11 and applies from 2025-09-12. The Commission's non-binding model terms, Recommendation (EU) 2026/2394 of 2026-10-29, appeared in the Official Journal on 2026-11-06.

• Black list, Art. 13(4): terms that are always unfair, such as excluding liability for intent or gross negligence.
• Grey list, Art. 13(5): terms presumed unfair, such as termination at unreasonably short notice.

The test does not reach the main subject matter or the adequacy of the price (Art. 13(8)). The page on AI data licensing agreements shows how these terms appear in clauses.

Keeping a Licensed Dataset Confidential After Delivery

A dataset licensed under confidentiality stays a trade secret only while reasonable secrecy steps continue, and Directive (EU) 2016/943 makes use beyond an agreed limit unlawful. Member states had to transpose it by 2018-06-09. Art. 4(4) extends unlawful use to a recipient who knew or ought to have known that the secret came from someone using it unlawfully, and Art. 8(2) caps the limitation period at 6 years.

Database Right, Health Data and Data Intermediaries

Three further instruments matter for some sellers: the database right, the European Health Data Space and the Data Governance Act. The sui generis database right lasts 15 years from 1 January after completion, and substantial new investment restarts it (Directive 96/9/EC, Art. 10). The European Health Data Space allows secondary use, with AI training a permitted purpose (Art. 53(1)), from 2029-03-26, subject to an individual opt-out (Art. 71), while the Data Governance Act has applied since 2023-09-24.

Final, Pending and Proposed: EU Changes as of November 2026

Two instruments called Digital Omnibus exist: the one amending the AI Act is final and in force since 2026-07-27, the one amending the GDPR and data rules is a proposal. The table lists the eight latest EU steps, newest first, as of 2026-11-09.

The status of the data and GDPR proposal is the one the European Parliament's legislative observatory shows, and no adopted text exists. An Advocate General's opinion is not a judgment, and EDPB guidelines adopted for consultation are not final. Court cases on the same questions sit in the tracker of AI copyright lawsuits over training data.

Member-State Rules on Top of EU Law

All 27 member states apply the EU instruments directly or through transposition, and the table shows where national law sets the reservation form and adds employee or recording rules. "Not recorded" means no national instrument was verified on 2026-11-09, not that none exists; the GDPR and the other EU instruments apply in every row, as of 2026-11-09.

Where National Law Adds a Layer: Reservation Form, Works Councils, Recordings

National law changes three things: the form an opt-out must take, who in the workforce must agree or be consulted, and whether a recording may be passed on.

On the reservation form, Germany (§ 44b(3) UrhG), Croatia, Ireland, Latvia and Poland (with metadata) require a machine-readable reservation for online content, and Austria requires machine-readable marking of a prohibition. Sweden, Denmark and Slovakia ask for an express or appropriate reservation, and Hungary requires the objection in advance. Italy ties AI mining to its own article, art. 70-septies of L. 633/1941, in force 2025-10-10, and makes a breach an offence.

• Consent: the Netherlands (WOR art. 27) and Austria (ArbVG § 96a, replaceable by the Schlichtungsstelle).
• Co-determination: Germany (BetrVG § 87(1) Nr. 6).
• Consultation or information: France (L2312-8), Spain (RDLeg 2/2015 art. 64.4.d) and Sweden (negotiation under MBL).

Recordings add criminal law: § 201 StGB in Germany carries up to 3 years, § 120 StGB in Austria up to 1 year or 720 daily rates, Spain limits workplace sound recording (LO 3/2018 art. 89), and § 3 TDDDG protects telecom secrecy in Germany. The page on employee data and AI training rules compares these rules by jurisdiction.

Benefits, Risks, Downsides and Alternatives of Licensing Data Under EU Law, Including Not Selling

EU law lets a company license data it holds the rights to, but each layer adds cost, and not licensing remains a valid choice.

Benefits

• A reservation under DSM Art. 4(3) plus a license turns mining rights into income.
• Art. 7(1) lets the license set its own terms.
• Data Act Art. 13 lets a company challenge unfair terms imposed on it.

Risks

• Recording offences, such as § 201 StGB in Germany and § 120 StGB in Austria.
• Regulator action: the Garante's decision n. 755 of 2024-11-02 against OpenAI was opposed by OpenAI, and the Tribunale di Roma upheld the opposition in judgment n. 4153/2026 (published 2026-03-18).
• Employee rules after C-34/21 (2023-03-30), which can leave national provisions unapplied.

Downsides

• Cost: notices, an impact assessment and a works-council process come before any income.
• Visibility: the buyer's public summary shows that licensed data was used, as Yes or No.

Alternatives

• License only non-personal or anonymized data.
• Keep the data and record a reservation.
• Collective or sector licensing, which the Parliament resolution of 2026-03-10 favors, without binding force.
• Do not sell or license at all; the options are compared on the page on alternatives to selling data to AI labs.

Beyond the EU Layer: Neighboring Jurisdictions, Courts and the Seller Process

The EU layer stops at the Union's border and at the deal itself; the pages below cover neighbors outside the EU, the courts and the sale.

• All jurisdictions: AI training data law by jurisdiction.
• The steps of a sale: sell or license company data to AI companies.
• United Kingdom rules for licensing data.
• Switzerland rules for licensing data, where no commercial TDM exception exists.
• Norway rules for licensing data.
• Copyright and AI training across jurisdictions.
• Call and meeting recording consent rules.
• Trade secrets in AI data licensing.

How This Page Is Sourced and Dated

Every rule here cites the Official Journal text, a court record or a regulator page, with the date it was checked. The rules for sources and dates are set out in how we source, date and check every figure. This page is general information about EU law, not legal advice for any specific deal.

Frequently Asked Questions

Does EU law allow AI training on copyrighted works?

Yes, under DSM Art. 4 unless the rightholder reserved the use, and research bodies have Art. 3 with no opt-out. C-250/25 is pending, with the Advocate General's opinion of 2026-11-03 not yet a judgment.

Can a license contract exclude the EU text and data mining exception?

Yes, a contract can exclude Art. 4, because Art. 7(1) protects only Arts. 3, 5 and 6. Finland's research-copying rule (13 b § 2 mom.) is the contrast: it cannot be overridden by contract.

Does the AI Act make AI companies name the data they licensed?

No, the template asks only for Yes or No plus modality for licensed datasets. Scraped web data is summarized by its largest domain names, not by licensor (C(2025) 8311 final, 2025-12-05).

Is the Digital Omnibus in force?

The AI Omnibus, Regulation (EU) 2026/1744, is in force since 2026-07-27, but the data and GDPR proposal (COM(2025) 837) is not. Art. 53 of the AI Act is unchanged.