Executive Summary

Four numbers compress the shape of this story before the rest of it begins: the size of the penalty that genuinely goes live on August 2, how often a summary must be refreshed, the share of providers who replaced the boxes with prose, and the count of actual fines confirmed since enforcement switched on.

The line going around about August 2 — "now you have to disclose your training data" — has the sequence backwards. The duty for a GPAI provider to summarize and publish the content used in training has been a legal obligation since August 2, 2025, the day Chapter V of the EU AI Act took effect. It was mandatory from the start, not a recommendation. The year that followed was simply an adjustment window in which the AI Office held no supervisory or enforcement powers.

What changed on August 2, 2026 is exactly those powers. From that day the AI Office can request documents from providers, evaluate models, order corrective action, restrict or recall products from the market, and levy fines. The ceiling is the greater of €15M or 3% of worldwide turnover (Article 101). So "the grace period is over" means the grace on enforcement ended, not the grace on the obligation. The rules were already there a year ago; now they have teeth.

That distinction shapes a practical judgment. The arrival of enforcement power itself was already covered in our report last July. So this piece does not repeat "what switches on August 2." With the enforcement tools now in hand, it looks instead at what those tools will be aimed at — the state the already-published summaries are actually in.

The article asks for a "sufficiently detailed summary." On its face the phrase reads like free-form writing. It is not. When the AI Office released its "Explanatory Notice and Template for the Public Summary of Training Content" on July 24, 2025, the summary became a standard form with a fixed set of boxes to fill. In practice, "publish a summary" turned into "fill in these boxes."

The template asks roughly for the following: the modality of the data (text, image, audio, and so on), the scale (size bands), languages, collection period, identifiers for the main public datasets used, the specifications and purpose of web crawlers, whether commercially licensed data was used, and how text-and-data-mining opt-outs were honored. Nor is it a write-once document. It must be refreshed every six months, or sooner if there is a material change such as further training.

The researcher Kieran Maynard placed 11 summaries from 7 providers side by side. The result splits into two camps. Google (Gemini 3 Pro), Meta (Muse Spark), Microsoft (Phi-4), OpenAI (GPT-5.5), and the open-source side such as Swiss AI, SpeakLeash, and Hugging Face filled in the template's boxes. Anthropic (Fable 5), Mistral, and xAI, by contrast, replaced the boxes with narrative phrasing along the lines of "a proprietary mix of publicly available information and licensed data."

Fairness requires one caveat. Many of the models from the three that answered in prose are existing models released before August 2, 2025, whose compliance deadline runs to 2027. They are not in breach; they are still inside the grace window. Even allowing for that, the difference in direction remains. At the same moment, some filled in the boxes and some wrote sentences.

Maynard's sharper point is about the side that filled in. Even the completed summaries are hard to compare against one another. Almost every provider checks "publicly available datasets." The category is loosely defined, absorbing everything from curated research corpora to indiscriminate web scraping, so the checkmark alone distinguishes nothing. The scale box is the same: most report "more than 10 trillion tokens," and past that point the number loses its power to differentiate.

The meaningful differences come from elsewhere: whether user data was used for training (OpenAI and Meta acknowledge it; open-source labs deny it), commercial licensing and crawling practices, and whether a model is text-only or multimodal. The trouble is that there is no registry collecting the summaries. They are scattered across each company's website in its own format, with no external verification. There are self-reported checkboxes but rarely any proportions or quantitative detail. Maynard likened the state of things to a "treasure hunt" — better than before, but stopping short of real comparability.

A story that could have ended as impressionistic critique was backed with numbers by academic work: a paper from Trinity College Dublin (ADAPT Centre) and the Mozilla Foundation, presented at the 2026 ACM FAccT conference. The authors adapted best practices in software-documentation quality control to build an evaluation framework for measuring the quality of Article 53(1)(d) summaries. It was designed to be usable both by a developer drafting a summary and by the Commission judging "good-faith compliance."

This framework is not an abstract rubric; it actually separates pass from fail. Of five summaries reviewed in the early disclosure period, Microsoft's Phi-model summary did not clear the bar, while Hugging Face's SmolLM family passed. Recall from Section 3 that Phi was classified among those that "filled in the template," and the point sharpens: filling in the boxes and having those boxes clear a quality bar are two different things. The fact that a form was completed guarantees nothing on its own.

The core finding goes straight at procurement practice. Companies that signed the GPAI Code of Practice did, overall, score higher than those that did not. But the gap was marginal, and the advantage came almost entirely from a single area — deployer-facing documentation (downstream information). On the comparable MÖVE benchmark, signatories averaged 27.6 against non-signatories' 26.3, a small difference; broken down, the use-and-deployment area widened to 63.0% versus 46.8%, while on the upstream disclosure the regulation actually targets — training data, copyright-related data use, bias mitigation, compute consumption — signing made no difference at all.

OpenAI is the case that shows the blank box is an industry pattern rather than one company's lapse. On July 31, two days before enforcement power took effect, OpenAI issued a statement on its EU AI Act compliance. It went into detail on its safety framework, a provenance-watermarking partnership, and cybersecurity cooperation with European institutions. Yet the copyright chapter — the training-data summary and a documented copyright-compliance policy — was missing from the statement entirely.

This does not mean OpenAI failed to file the training-data summary itself (see the table in Section 3). What stands out is that, in the very venue where it explained its compliance to the public, it quietly skipped the most sensitive box. TechPolicy.Press diagnosed this as "threading the line between good-faith compliance and minimal disclosure," naming OpenAI, Google, and xAI together — a shared posture the large labs adopted before the Commission held fining power.

That line-threading was signaled from the voluntary-signing stage onward. On the GPAI Code of Practice, xAI signed only the security chapter and explicitly excluded the transparency and copyright chapters, while Meta refused to sign at all. Right at the threshold of commitment, the two most sensitive boxes — transparency and copyright — were the first to slip out. The quiet omission of the copyright item in the pre-enforcement statement is merely an extension of the same move.

There is a retreat in the voluntary regime behind it. According to the civil-society group COMMUNIA, the draft GPAI Code of Practice required disclosure of copyright policies and rights-reservation measures, but the final version demoted these to a bilateral obligation between provider and rightsholder and lowered disclosure to a recommendation. Civil society criticized this as a rollback of transparency. This institutional room is part of why the copyright box, in particular, is so easily left blank.

Since August 2, there has been no confirmed report that the AI Office has actually imposed a fine or opened a formal investigation (as of August 7, 2026). So the tense of this piece is not "a fine has landed." It is that the mechanism has just come alive, and that the already-published documents reveal who is prepared and who is not. And it is here that the location of the real risk shifts.

A fine arrives after a violation. What arrives before it is due diligence. The moment the Trinity–Mozilla paper concluded that "signing is no proxy for due diligence," any company procuring or deploying AI in Europe has no choice but to move toward asking for actual data lineage rather than a signature badge. It means asking a vendor not whether it has "the legal craft to write a good training-data summary" but whether it has "the real records to put in the summary's boxes."

Those records are source logs, license agreements, crawler histories, and opt-out reconciliation records. They share one trait: once a model has finished training, you cannot make them retroactively. They are an accumulated asset that has to pile up as a by-product while the pipeline runs. The difference between a provider that hedged the template's boxes in prose and one that filled them quantitatively reduces, in the end, to whether that accumulation was done. A model without lineage loses at due diligence before any fine — because it has nothing to write in the boxes.

Academic

• 1.Blankvoort, D., Pandit, H., & Gahntz, M. (2026). "Quality Assessment of Public Summary of Training Content for GPAI models required by AI Act Article 53(1)(d)." ACM FAccT 2026.

Industry & Press

• 2.Maynard, K. (2026). "What the EU AI Act's Training-Data Summaries Do and Don't Reveal." Kieran Maynard Blog.
• 3.TechPolicy.Press. (2026). "How Big AI Developers Are Skirting a Mandate for Training Data Transparency."
• 4.COMMUNIA Association. (2025). "Our thoughts on the final version of the GPAI Code of Practice."
• 5.WilmerHale. (2025). "European Commission Releases Mandatory Template for Public Disclosure of AI Training Data."

Official Documents

• 6.EU Artificial Intelligence Act. "Article 53: Obligations for Providers of General-Purpose AI Models."
• 7.EU Artificial Intelligence Act. "Enforcement of Chapter V under the EU AI Act."
• 8.European Commission. "Enforcement of the AI Act." Shaping Europe's digital future.