Addressing GDPR’s Shortcomings in AI Training Data Transparency with the AI Act
In July 2025—just weeks before the EU Artificial Intelligence Act (AI Act) comes into force—two long-anticipated transparency tools finally pulled back the curtain on how general-purpose AI (GPAI) models are trained. On July 10, the Model Documentation Form (MDF) was published as part of the voluntary GPAI Code of Practice, and on July 24, the European Commission released the updated Public Summary Template (PST), requiring for the first time public disclosure of basic information about training datasets.
Both instruments are grounded in Article 53 of the EU AI Act and share the same overarching purpose: to enhance transparency about the datasets that power GPAI models. But they are designed for different audiences and involve distinct levels of disclosure, with significant implications for data protection rights.
Originally published on Tech Policy Press — read the full version on Tech Policy Press
In July 2025—just weeks before the EU Artificial Intelligence Act (AI Act) comes into force—two long-anticipated transparency tools finally pulled back the curtain on how general-purpose AI (GPAI) models are trained. On July 10, the Model Documentation Form (MDF) was published as part of the voluntary GPAI Code of Practice, and on July 24, the European Commission released the updated Public Summary Template (PST), requiring for the first time public disclosure of basic information about training datasets.
Both instruments are grounded in Article 53 of the EU AI Act and share the same overarching purpose: to enhance transparency about the datasets that power GPAI models. But they are designed for different audiences and involve distinct levels of disclosure, with significant implications for data protection rights.
Two tiers of transparency: Regulatory oversight vs. public accountability
The transparency obligations in the EU AI Act concerning the training data of GPAI models can serve different purposes. They help providers of AI systems better understand the capabilities and limitations of these models and comply with their regulatory duties; support the enforcement of copyright and related rights; and make it easier to exercise and enforce data protection rights, among others. This article focuses on the latter—examining what these new transparency rules mean for personal data protection.
When it comes to the training data of GPAI models, the EU AI Act divides transparency into two tracks: a deep, confidential stream for regulators, and a shallow, public stream designed to build trust without giving away the full picture.
The first track operates through the Model Documentation Form (MDF), mandated under Article 53(1)(a) and (b) of the AI Act. It compels providers to disclose detailed technical and operational information, including the provenance, source, and composition of training, validation, and testing datasets. This information is submitted to the AI Office (AIO) and national competent authorities (NCAs) (see Art 3(48) of the AI Act ) but remains strictly confidential under Article 78 of the AI Act, protected by trade secret provisions. The MDF is designed primarily as a tool for regulatory oversight: it equips authorities to investigate compliance, detect violations, and impose corrective measures, including fines or market restrictions.
The MDF was first introduced on July 10, 2025, as part of the voluntary GPAI Code of Practice, a soft-law instrument meant to encourage early compliance. Its rollout, however, immediately highlighted the tension between regulators and Big Tech. Meta publicly announced it would not sign the code, arguing that it introduced “measures which go far beyond the scope of the AI Act”.
Yet, legally speaking, such opposition may soon become moot. On August 2, 2025, the AI Act takes full effect, making transparency obligations for GPAI legally binding. As a transitional measure, companies that sign the code are granted a one-year grace period—until August 2026—before enforcement begins. But as Meta’s refusal illustrates, some providers may choose to test regulators’ resolve, betting on the slow pace of enforcement and the complexity of cross-border oversight rather than embracing early compliance.
The second track, by contrast, is designed for public-facing accountability. The PST, grounded in Article 53(1)(d), obliges GPAI providers to publish a high-level summary of their training data sources, addressed to individuals, civil society organizations, and rightsholders. Recital 107 of the AI Act explicitly requires the summary to be “simple” and “effective,” accessible even to non-expert audiences. Yet the level of disclosure is deliberately limited to protect trade secrets. Providers must indicate the most relevant domain names crawled, the time period of data collection, and offer a general description of the type of content, including its geographic or linguistic profile. What they do not have to share—at least publicly—are URL-level data, user-specific identifiers, or detailed breakdowns of dataset composition.
Consequently, individuals cannot verify with certainty whether their personal data was used. But for the first time, they can make reasonable inferences: if the PST lists x.com (formerly Twitter) as a major source for the period 2021–2023, a Twitter user active during that time could reasonably suspect their posts were processed, even if they cannot prove it directly.
Wasn’t the GDPR alone enough?
The GDPR already imposes transparency obligations, but it was never designed for the scale and complexity of training data used in general-purpose AI models. Its rules address transparency primarily on a case-by-case basis, making them ill-suited for the vast, scraped datasets that power GPAI. To read the full article, please visit Tech Policy Press
