The classic trap
Recital 105 informs the interpretation of Article 53(1)(c) of the AI Act: any provider of a general-purpose AI model must implement a copyright compliance policy, and in particular identify and respect rights reservations (opt-outs) expressed under Article 4(3) of Directive (EU) 2019/790. In practice, the trap does not only affect labs training foundation models: it cascades to companies that fine-tune an open-source model on web scrapings, build internal corpora from third-party sites, or integrate a model whose provider has not documented its copyright policy. The EU AI Office (Brussels) will directly supervise this obligation for general-purpose AI models, while civil litigation before national courts remains the primary route for rightsholders.
The opt-out signals your training pipeline must detect
- robots.txt file with directives such as User-agent: GPTBot/CCBot/Google-Extended and Disallow.
- Meta tags 'robots' with content 'noai, noimageai' in HTML.
- HTTP header X-Robots-Tag: noai.
- TDM Reservation Protocol metadata (W3C standard in progress) at resource or domain level.
- Terms of use explicitly prohibiting text and data mining.
- ai.txt or tdmrep.json files at domain root.
- Watermarks and EXIF/IPTC metadata for images (Digital Source Type field).
The 'appropriate manner' test: the key argument
Article 4(3) of Directive 2019/790 requires the reservation to be expressed in an appropriate manner, notably through machine-readable means for online content. A provider can no longer hide behind 'we didn't see the opt-out' if it was exposed in robots.txt or via a standard tag. Conversely, a clause buried in a PDF terms of use without machine signal will be harder to enforce. Your pipeline documentation must demonstrate that you queried these signals before each collection, and retained timestamped evidence.
How Luxgap automates this risk
Our Luxgap Copyright Opt-Out Sentinel makes it impossible to train or fine-tune a model on content whose rightsholders have reserved their rights, by inserting an automated control between your crawler and your dataset. The tool queries machine-readable signals in real time (robots.txt, meta noai, X-Robots-Tag, TDMRep, ai.txt) on every URL collected, cross-references with a Luxgap-maintained opt-out domain database, and blocks ingestion of reserved resources before they reach your training storage (S3, Azure Blob, HuggingFace Datasets, Databricks).
- Scans every URL before ingestion and detects rights reservations expressed via the six most widespread machine-readable standards.
- Automatically blocks the download of opt-out resources and logs the decision in a cryptographically sealed journal.
- Generates the 'sufficiently detailed summary' of training corpus required by Article 53(1)(d) of the AI Act, broken down by license, source domain and content type.
- Produces the Article 53(1)(c) copyright policy ready to publish, formatted to the template expected by the EU AI Office.
- Alerts your ML teams via Slack or Teams whenever a major corpus domain switches to opt-out, enabling a clean retraining before production release.
- Retains evidence enforceable before the EU AI Office and civil courts: for each dataset sample, the timestamp of the control and the state of opt-out signals at collection time.
Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on a real sample of your corpus, with a free 48-hour assessment to measure the opt-out rate already present in your training data.