AI Training Data Provenance and Copyright Guide

Most organisations that train, fine-tune or buy AI models cannot say with evidence where the training data came from, under what licence, and what it contained. That gap now carries legal, regulatory and security cost: courts in the US, UK and Germany have ruled on training data, the EU AI Act requires general-purpose AI providers to publish a summary of training content and keep a copyright policy, and public web crawls have been shown to carry thousands of live credentials. This guide covers how to build a training data provenance record, how copyright exposure arises across the model lifecycle, what the EU rules and recent cases actually require or decided, and how to detect and measure gaps. It is written for AI platform engineers, data and security architects, and the governance, privacy and legal teams who work with them. It complements the AI and Privacy Guide, which covers personal data in training; this guide focuses on provenance, licensing and copyright.

Key takeaways

Provenance is a record, not a belief. For every dataset you need source, licence, collection method, date range, transformations and the models it fed, stored as metadata that survives copying and fine-tuning.
Copyright exposure has three points: acquisition (how the copy was obtained), training (whether an exception, licence or fair use covers it) and output (whether the model reproduces protected works).
How the copy was obtained matters as much as what it is. In Bartz v. Anthropic the court separated training on purchased books from keeping pirated copies in a central library, and the case settled for 1.5 billion US dollars.
EU obligations are live. General-purpose AI providers must publish a training content summary using the Commission template and keep an EU copyright policy, with AI Office enforcement powers from 2 August 2026.
Provenance is also a security control. The same lineage record that answers a rights holder lets you find poisoned samples and leaked secrets, such as the live keys found in Common Crawl.

What training data provenance covers

Provenance answers four questions for each dataset and each model: where the data came from, what rights attach to it, what was done to it, and where it went. The answers must be recorded at ingestion, because they are very hard to reconstruct later from a trained model.

Origin: the issuer, the URL or system of record, the crawler or connector used, the geography and the date range of collection.
Rights: the licence identifier (for example an SPDX identifier on open datasets), any contract or terms of service, opt-out signals honoured, and whether personal data or confidential data is present.
Transformations: filtering, deduplication, secret and PII scrubbing, labelling, synthetic augmentation, and the version of each script used.
Lineage: which dataset versions were used for pre-training, fine-tuning, evaluation and retrieval, and which model versions resulted.

The Data and Trust Alliance Data Provenance Standards (v1.0.0) give a practical field set: 22 metadata fields in three standards. Source covers the dataset title, a unique identifier, the metadata location, the issuer and a description. Provenance covers source metadata, data origin geography, issue date, previous version date, the range of dates for data generation, the method and the data format. Use covers confidentiality classification, consent documentation location, privacy-enhancing technologies applied, processing and storage geography, licence to use, intended use and the presence of proprietary data. Hugging Face dataset cards carry part of this in their YAML header (license, language, task_categories, tags), but a card is a self-declaration by the uploader, not evidence.

OWASP's Top 10 for LLM Applications 2025 treats this as a security matter. LLM03 Supply Chain lists dataset licensing risk and weak model provenance, and recommends a licence inventory kept in bills of materials. LLM04 Data and Model Poisoning recommends tracking data origins and transformations with tools such as OWASP CycloneDX or an ML-BOM and using data version control to detect manipulation. See the AI Supply Chain and AI-BOM Guide.

Where copyright exposure arises

Copyright exposure is not one question about "training". It sits at different points in the pipeline, and each point has different evidence and different controls.

Stage	Exposure	Evidence you need	Typical control
Acquisition	Copies from pirate sources, circumvention of paywalls or other technological measures, breach of site terms	Source list, crawler logs, purchase or licence records	Approved source list; block known infringing sites; no circumvention
Storage	Retaining a permanent general library beyond what training needs	Retention schedule, deletion logs	Retention limits per dataset; delete raw copies once processed where licence requires
Text and data mining	Use of works whose rights holder reserved TDM rights (EU), or use outside fair use (US)	Opt-out checks at crawl time, robots.txt snapshots, licence terms	Honour machine-readable reservations; record what was checked and when
Fine-tuning	Customer or third-party content used outside contract terms	Contract clauses, data processing terms, consent records	Contractual review before any customer data is used for training
Model artefact	Memorised works in the weights treated as a reproduction (German court view)	Memorisation and extraction test results	Deduplication, memorisation testing, release gates
Output	Model reproduces lyrics, code, articles or watermarked images	Output filter logs, red-team results, complaints	Output safeguards, acceptable use terms, complaint handling

Deployers who only call a third-party model still carry output exposure and contractual exposure. Ask suppliers for their training content summary, their copyright policy and their indemnity terms, and record the answers in your third-party risk file. See the Third-Party AI Risk Guide.

The EU rules: Article 53, the template and the Code

Article 53 obligations for general-purpose AI providers

Under Article 53(1)(c) of the EU AI Act, providers of general-purpose AI models must put in place a policy to comply with EU copyright law, in particular to identify and comply with rights reservations made under Article 4(3) of the Copyright in the Digital Single Market Directive (EU) 2019/790. Article 4 of that Directive creates a general text and data mining exception, which does not apply where the rights holder has expressly reserved its rights in an appropriate manner, such as machine-readable means for content made publicly available online. Article 53(1)(d) requires a sufficiently detailed public summary of the content used for training, following the template provided by the AI Office.

The training content summary template

The Commission published the Explanatory Notice and Template for the public summary on 24 July 2025 and last updated the page on 26 March 2026. The Commission's FAQ states that using the template is mandatory. Its main sections are:

General information: provider and model identity, content modalities (text, images, audio, video) and size per modality in broad ranges.
List of data sources: large publicly available datasets, private datasets licensed or obtained from third parties, data scraped online, user data and synthetic data. For scraped data: crawler names, collection period, a description of the content and the top 10% of domain names by size (SMEs report the top 5% or 1,000 domains, whichever is lower).
Relevant data processing aspects: information relevant to rights holders, including how text and data mining reservations were respected and measures to remove illegal content.

Models placed on the market from 2 August 2025 must publish the summary when placed on the market. Models placed on the market before that date have until 2 August 2027, and gaps that cannot be filled despite best efforts must be stated and justified. Summaries are updated every six months, or sooner when new training data makes a material difference. The AI Office's enforcement powers, including fines of up to 3% of worldwide annual turnover or 15 million euros, whichever is higher, apply from 2 August 2026.

The Copyright chapter of the GPAI Code of Practice

The General-Purpose AI Code of Practice was published on 10 July 2025, is voluntary, and has been confirmed by the Commission and the AI Board as an adequate tool for showing compliance. Its Copyright chapter contains one commitment with five measures, as summarised by law firm analyses of the final text:

Copyright policy: draw up, keep up to date and implement one policy covering all general-purpose models placed on the EU market.
Lawfully accessible content: reproduce only lawfully accessible works, do not circumvent effective technological measures (including paywalls and subscriptions), and exclude websites recognised by EU or EEA courts or authorities as persistently and repeatedly infringing on a commercial scale; an EU list of such sites is envisaged.
Rights reservations: crawlers follow robots.txt and other appropriate machine-readable protocols, and providers publish information about their crawlers and how they honour reservations.
Infringing outputs: appropriate and proportionate technical safeguards against infringing outputs, and a prohibition of infringing uses in acceptable use policies.
Point of contact and complaints: a point of contact for rights holders and a complaint mechanism with responses in reasonable time.

Signatories listed by the Commission include Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI and OpenAI; xAI signed only the Safety and Security chapter and must show copyright compliance by other adequate means. See the EU General-Purpose AI (GPAI) Code of Practice Guide.

What recent cases decided

Case law is moving quickly and differs by jurisdiction. The table records status as checked on 24 October 2026; confirm the current position before relying on any of it.

Case	Court and status	What it means for provenance
Bartz v. Anthropic	US District Court, N.D. California. June 2025 ruling (Judge Alsup) held training on lawfully purchased books fair use but not keeping pirated copies in a central library. Class settlement of 1.5 billion US dollars for over 400,000 books, about 3,000 dollars per book, given final approval on 20 July 2026.	The source of each copy is decisive. A record showing purchase or licence is worth more than any argument about transformation.
Thomson Reuters v. Ross Intelligence	US Court of Appeals, Third Circuit, 29 September 2026, affirmed that copying 2,243 Westlaw headnotes to train a legal research tool was not fair use, and recognised a market for licensing training data. The system was non-generative, which the panel distinguished.	Where a licensing market exists for the data, the fourth fair use factor can weigh against training without a licence.
Getty Images v. Stability AI	High Court of England and Wales, [2025] EWHC 2863 (Ch). The case narrowed before trial and the court did not decide whether training infringed; model weights held not to be an infringing copy; trade mark claims succeeded in part over generated watermarks. Getty was granted permission to appeal on secondary infringement.	Claims about training depend on facts such as where training took place, so record training location as well as data source.
GEMA v. OpenAI	Munich Regional Court I, 11 November 2025. Memorisation of song lyrics in the model was held to be reproduction, outputs of lyrics infringed, and the German TDM exception did not cover this.	In the EU, memorisation test results are evidence about the model artefact itself, not only about outputs.

In the US, the Copyright Office released a pre-publication version of Part 3 of its Copyright and Artificial Intelligence report (Generative AI Training) on 9 May 2025, and says the final version is not expected to change its analysis substantively.

Training data as a security exposure

Provenance gaps are not only a legal problem. Data you cannot trace is data you cannot clean, and web-scale corpora carry secrets, personal data and attacker-placed content.

Secrets in the corpus: Truffle Security scanned the December 2024 Common Crawl archive (about 400 TB, 2.67 billion pages) and found 11,908 secrets that still authenticated, across 219 secret types, with about 63% repeated on multiple pages. See the 12,000 Live Secrets in LLM Training Data 2025 analysis. Scrub secrets before training, and treat any key found in a corpus as compromised: revoke it, do not just delete it from the data.
Poisoned and published datasets: MITRE ATLAS describes Poison Training Data (AML.T0020), Publish Poisoned Datasets (AML.T0019) and AI Supply Chain Compromise: Data (AML.T0010.002). Without lineage you cannot find which models consumed a tainted dataset version. See the AI Data Poisoning and Backdoors Guide.
Extraction from the model: LLM Data Leakage (AML.T0057) and Infer Training Data Membership (AML.T0024.000) show that what the model learned can be pulled back out, which turns training data content into output exposure.
Mitigations in ATLAS: Maintain AI Dataset Provenance (AML.M0025) and Sanitize Training Data (AML.M0007) are the matching mitigations.

Choosing a data sourcing approach

Source	Provenance quality	Copyright exposure	When it fits
Licensed corpus from a publisher or data vendor	High, if the contract includes source lists and warranties	Low, shifted by contract	Commercial models, regulated sectors, customer-facing generation
Own first-party data	High, if collection purpose and terms allow training	Low for copyright; contractual and privacy questions remain	Fine-tuning for internal tasks
Open datasets with declared licences	Medium: licence labels on aggregators are self-declared and can be wrong	Medium: check the upstream sources, not only the dataset licence	Research, prototyping, permissive licences verified upstream
Own crawl honouring opt-outs	Medium to high if crawl logs and robots.txt snapshots are kept	Medium, jurisdiction dependent	Providers with the engineering capacity to log and filter
Third-party web crawl (for example Common Crawl)	Low at item level	Higher; reservations at crawl time are not always recorded	Pre-training only with strong filtering, deduplication and secret scrubbing
Shadow libraries or pirated collections	Known, and unacceptable	High; central to the Bartz ruling	Never

Small and large organisations: most organisations do not pre-train and should focus on supplier evidence, fine-tuning data rights and output controls. Providers that pre-train or publish models for others need the full provenance record, a crawler policy and a public summary. A small team can start with a spreadsheet register keyed by dataset hash; a large one needs a catalogue integrated with the training platform so lineage is captured automatically.

How to implement

Inventory models and datasets. List every model you train, fine-tune or deploy, and every dataset behind it. Include RAG corpora and evaluation sets. Record owner and business purpose.
Define the provenance schema. Adopt the 22 Data Provenance Standards fields or equivalent, plus a content hash, licence identifier, training location and the list of models trained on it.
Gate ingestion. No dataset enters a training bucket without a completed record, an approved licence and a scan for secrets and personal data. Start in report-only mode on existing pipelines for two to four weeks, then enforce for new datasets.
Record crawl evidence. If you crawl, log user agent, timestamp, robots.txt content and any other reservation signals checked, and block domains on your exclusion list.
Version and link. Store dataset versions immutably with data version control, and write the dataset hashes into the model card and AI-BOM of each model built.
Test the model artefact. Run memorisation and extraction tests against known protected works and known secrets before release, and record results.
Set output controls and a complaint route. Add output filters for high-risk content types, prohibit infringing use in terms, and publish a contact point for rights holders.
Plan rollback and takedown. When a dataset is found to be unlicensed or poisoned, the lineage record tells you which models to retrain, roll back to a prior version or retire. Test this once on a small model so the procedure is proven.

Detection and measurement

Log: ingestion events with dataset hash and record ID, crawler requests and reservation checks, training job manifests, model release approvals, output filter hits and rights holder complaints.
Alert on: training jobs that read from unregistered storage paths, datasets whose licence field is empty or unknown, and secret scanner hits in training buckets.

Metrics that show the programme works:

Percentage of training and fine-tuning datasets with a complete provenance record (target 100% for new data).
Percentage of production models whose dataset lineage can be produced within one working day.
Number of live secrets found per million documents in training data before and after scrubbing.
Memorisation test failure rate per release candidate.
Median time to answer a rights holder complaint, and time to identify affected models after a dataset is withdrawn.

Common failure patterns

Trusting aggregator licence labels. A permissive label on a repackaged dataset says nothing about the rights in the sources it was assembled from.
Keeping everything forever. Retaining raw copies as a general library after training creates the storage exposure courts have treated separately from training.
Treating the corpus as clean. Web corpora contain working credentials; the Common Crawl findings show why scrubbing and revocation must be part of preparation.
No lineage from dataset to model. When a dataset is challenged, teams cannot say which models used it, so the only safe response is to retire everything.
Fine-tuning on customer data by default. Contracts and privacy notices often do not permit it, and the exposure is discovered by the customer.
Supplier answers not recorded. Procurement asks about training data once, verbally, and nothing is in the third-party risk file when the question comes back.

Framework mapping

Framework	Reference	Relevance
NIST CSF 2.0	ID.AM-07, ID.AM-08, GV.OC-03, GV.SC-05	Data inventories with metadata, lifecycle management, legal requirements, supplier contract requirements
NIST SP 800-53 Rev. 5	SR-4 Provenance, SR-4(3), CM-8, SA-4, SI-7	Provenance records, validation that data is genuine and not altered, inventory, acquisition terms, integrity
NIST AI 600-1	Intellectual Property and Data Privacy risks; actions such as GV-1.2-001, MP-4.1-010, MS-2.5-005	Documenting data origin, diligence on IP in training data, verifying provenance of training and fine-tuning data
MITRE ATLAS	AML.T0020, AML.T0019, AML.T0010.002, AML.T0057; AML.M0025, AML.M0007	Data supply chain threats and provenance and sanitisation mitigations
OWASP LLM Top 10 2025	LLM03 Supply Chain, LLM04 Data and Model Poisoning	Licensing risk, weak provenance, BOM and data versioning
EU AI Act	Article 53(1)(c) and (d)	Copyright policy and public training content summary

See the MITRE ATLAS Guide and the OWASP Top 10 for LLM Applications Guide.

Practitioner checklist

Inventory every model and every training, fine-tuning, evaluation and RAG dataset, with an owner.
Adopt a provenance schema with source, licence, method, date range, transformations, training location and downstream models.
Block ingestion of datasets without a completed record and an approved licence.
Scan training data for secrets and personal data, and revoke any live credential found.
Keep crawl logs and reservation checks if you crawl; maintain a source exclusion list.
Link dataset hashes to model cards and AI-BOMs so lineage can be produced on request.
Run memorisation and extraction tests before every model release.
Collect training content summaries, copyright policies and indemnity terms from model suppliers.
Publish a rights holder contact point and rehearse dataset withdrawal and model rollback.

Standards and references

Related NHI Mgmt Group resources: AI Supply Chain and AI-BOM Guide · AI Data Poisoning and Backdoors Guide · EU General-Purpose AI (GPAI) Code of Practice Guide · AI Model Provenance and Watermarking Guide · AI and Privacy Guide. This guide summarises copyright, AI Act and case law developments for security and data teams and is not legal advice.

AI Training Data Provenance and Copyright Exposure Guide: Knowing What Your Models Learned