The enforcement timeline has quietly crept up on most companies. General-purpose AI model providers face GPAI obligations from 2 August 2025. High-risk AI system requirements and full enforcement come in from 2 August 2026. If you're in the data licensing business — as a buyer or seller — those dates affect your contracts right now.
Here's what actually changes.
The Enforcement Timeline
GPAI model providers must comply with Articles 53–55. This includes publishing technical documentation about training data (Annex VIII and Annex XI summaries). If you're selling data to a GPAI provider, expect due diligence requests.
Full enforcement of the Act. High-risk AI system requirements apply (including Article 10 data governance obligations). High-risk AI deployers must document the data used to train and validate systems. National market surveillance authorities become active.
Ongoing compliance. Systematic surveillance of GPAI models and high-risk AI systems. Fines of up to 3% of global annual turnover for non-compliance with data obligations.
Most companies aren't ready. Not because they're ignoring the Act — they simply haven't mapped how it reaches their data licensing decisions. Here's where it hits first.
The 5 Changes That Matter for Data Licensing
You need a provenance paper trail, not just a contract
Article 53 and Annex XI require GPAI model providers to document training data provenance — not as a nice-to-have, but as a precondition for EU market access. This means your buyers will ask where the data came from, who collected it, what preprocessing was applied, and whether consent was obtained. A data licence agreement with a one-line "source data" clause won't cut it anymore. You need structured provenance documentation: collection method, date range, geographic scope, consent basis, and any processing applied.
Fine-tuning creates a new compliance boundary
If you take a third-party GPAI model and fine-tune it on your own or licensed data, you become the provider of a new AI model — with all the obligations that carries. This catches a lot of companies that assumed "we're just using an existing model." Your fine-tuning data is now subject to Annex VIII technical documentation. The data you licensed for fine-tuning needs to meet the same provenance standards as primary training data.
Copyright compliance is now a data licensing prerequisite
The EU AI Act's Article 53(1)(i) requires GPAI providers to implement a "policy to comply with Union copyright law, and in particular to identify and respect the content reserved for the text and data mining purposes." For data licensors, this means your buyers will need evidence that the data you're licensing was lawfully obtained — particularly where copyright or database rights apply. This isn't just about whether the content is copyrighted; it's about whether the licence permits AI training use. If your standard data licence doesn't explicitly permit AI training or fine-tuning, your buyer may face a compliance gap regardless of what they paid for the data.
Data subject rights travel downstream — and affect training data use
Article 53 and the broader GDPR framework mean that training data containing personal data must be processed with a lawful basis that survives downstream commercial use for AI training. Explicit consent obtained for one purpose (e.g., service delivery) doesn't automatically authorise AI training use. Anonymisation isn't just a privacy measure — it's now a licensing enabler. If data is fully anonymised at source, the consent and lawful basis requirements for training data use fall away. This makes anonymised datasets significantly more valuable as AI training inputs, and makes the provenance of your anonymisation process a material commercial asset.
High-risk AI data requirements extend to deployers
Article 10 of the EU AI Act requires high-risk AI system providers to implement data governance measures covering "data governance practices" for training and validation datasets. Critically, this doesn't only apply to model providers — it applies to anyone deploying a high-risk AI system who also supplies or trains on their own data. If you're deploying a high-risk AI system (credit scoring, hiring, healthcare, infrastructure) and training it on UK or EU personal data, your data governance practices — including how you manage training data provenance and quality — are now within regulatory scope.
Even if your company doesn't fall squarely within "GPAI provider" or "high-risk AI deployer," the Act's requirements are bleeding downstream via supply chain pressure. If you sell data to any company operating in the EU, their compliance team will start asking provenance questions — not as a courtesy, but as a contractual and regulatory requirement they need to satisfy.
What This Means for Your Licensing Agreements
Your existing data licence agreements almost certainly weren't drafted with EU AI Act obligations in mind. The gaps to check:
- AI training use rights. Does the licence explicitly permit use for AI training, fine-tuning, and model development — or is it silent (which creates ambiguity that will frustrate buyers)?
- Provenance disclosure obligations. Does the licence require the seller to provide structured provenance documentation — not just a data schema and sample? Can the buyer share that documentation with regulators or auditors if required?
- Anonymisation warranties. Does the licence confirm that personal data has been anonymised to the standard required for training data use? Is the anonymisation methodology documented and independently auditable?
- Copyright chain of title. Can the seller demonstrate that the data was lawfully obtained and that AI training use is within the scope of the original collection consent or licence?
- Downstream compliance pass-through. If your buyer faces EU AI Act obligations, can they pass relevant documentation requirements down to you as a sub-processor or data supplier?
If you're selling data, these aren't just questions to answer — they're a competitive differentiator. Buyers facing EU AI Act obligations will prefer data suppliers who can provide structured provenance documentation, anonymisation records, and AI training use warranties. The licence agreements that can evidence this will close faster and at better prices.
How Adam Helps
adamn handles the training data compliance pipeline end-to-end — from raw data to documented, compliant training datasets ready for licensing or model development:
- Anonymisation at source. PII is detected and removed before the data enters your licensing pipeline — eliminating GDPR and data subject rights concerns for downstream AI training use.
- Provenance tracking. Every processing step is logged: collection source, date range, anonymisation applied, any transformations. This becomes your audit trail for EU AI Act Article 53 and Annex XI documentation requirements.
- Compliance-ready datasets. Output datasets come with structured metadata — schema, provenance summary, consent basis, geographic scope — ready to attach to a data licence or respond to a buyer's due diligence request.