Training-data provenance and copyright register
Records the origin, licence and rights status of every source used to train or fine-tune a model so that the organisation can honour opt-outs, answer downstream questions and publish a truthful summary of training content.
What this label means
- Verified
- — a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
- Pending review
- — linked to the official source and in the queue for a reviewer to confirm.
- Source-linked
- — linked to the official source, not yet confirmed by a reviewer.
On this page 6 sections
- Duties satisfied
- 1
- done properly, does the work
- Duties supported
- 3
- contributes; the duty needs more
- Jurisdictions
- 3
- Evidence items
- 3
In brief
Training-data provenance and copyright register is a process, owned by the model development lead and run at launch and on every material change. 4 recorded duties in 3 jurisdictions rely on it, and it satisfies 1 of them outright. It produces 3 kinds of evidence an auditor can ask for.
How is it implemented?
Model developers keep a register of training sources that captures the source, the acquisition route, the licence or legal basis relied on, whether machine-readable rights reservations were checked and honoured, and the date of collection. A written copyright and rights policy sets out how crawls respect opt-out signals, how licensed and public-domain material is distinguished and how takedown or objection requests are handled. From the register the team generates the public summary of training content and the information pack that downstream integrators need. The register is updated on every new training run and reviewed by legal before a model is released.
Which legal duties does it serve?
Satisfies means the control, operated properly, does the work the duty asks for. Supports means it contributes but the duty needs more. The official text decides; open it before relying on either.
European Union 2 duties
-
satisfies Legal requirement confidence highMeet general-purpose AI model provider obligations
EU AI Act · Article 53 and Annexes XI–XII · applies from 2 Aug 2025
Produces the copyright policy and the public training-content summary.
-
supports Legal requirementApply data governance and quality criteria to training, validation and testing data
EU AI Act · Article 10 · applies from 2 Dec 2027
Origin and collection records for each source.
Colorado (United States) 1 duty
-
supports Legal requirementDevelopers must document high-risk systems and disclose known risks
Colorado AI Act · C.R.S. 6-1-1702
Training-data summaries.
Nepal 1 duty
-
supports Legal requirementCollect and use personal information only with consent and for the stated purpose
Nepal Privacy Act 2075 · Chapter on collection and protection of personal information (reviewer to cite sections)
Source register records the basis for each training source.
What evidence shows it is operating?
| Evidence | Type | What it shows |
|---|---|---|
| Training source register | Register entry | Source, acquisition route, licence or legal basis, opt-out check and collection date per source. |
| Copyright and rights-reservation policy | Policy document | |
| Public summary of training content | Disclosure or notice |
Owner: Model development lead. Frequency: at launch and on material change.
Which risks does it address?
Subdomains of the MIT AI Risk Repository, with the incidents the AI Incident Database has recorded under each. Counts are live; they say how often a risk has materialised, not how well this control prevents it.
- 6.3 Economic and cultural devaluation of human effort Socioeconomic & Environmental5 incidents · 31 risk entries
- 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information Privacy & Security88 incidents · 80 risk entries
- 6.5 Governance failure Socioeconomic & Environmental3 incidents · 61 risk entries
Which standards clauses does it correspond to?
Clause numbers only. A reference means the standard asks for overlapping work, so evidence may be reusable; it never means the standard discharges a legal duty.
| Framework | Reference | Note | Confidence |
|---|---|---|---|
| ISO/IEC 42001 | Annex A.7.3, A.7.5 | Data acquisition and provenance records. | medium |
| NIST AI RMF | MAP 4.1; GOVERN 6.1 | medium | |
| MITRE ATLAS | AML.M0025 Maintain AI Dataset Provenance | medium |
Cite this record
AIPolicyTracker (2026). “Training-data provenance and copyright register” [AIPT-CTL-0026, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-CTL-0026 (accessed 8 November 2026). Data licensed CC BY 4.0.
Permanent id AIPT-CTL-0026: it never changes or gets reused, and its address keeps working if this page moves.
BibTeX
@misc{aipolicytracker2026_trainingdataprovenancean,
author = {{AIPolicyTracker}},
title = {{Training-data provenance and copyright register}},
year = {2026},
howpublished = {\url{https://aipolicytracker.org/controls/training-data-provenance-and-copyright-register}},
url = {https://aipolicytracker.org/controls/training-data-provenance-and-copyright-register},
urldate = {2026-11-08},
note = {Data licensed CC BY 4.0. Accessed 8 November 2026}
}
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.
Frequently asked questions
Which legal duties does "Training-data provenance and copyright register" satisfy?
It is recorded as satisfying 1 and supporting 3 duties across European Union, Colorado (United States) and Nepal. A mapping means the control, operated properly, does the work the duty asks for; the official text decides whether it is enough.
What evidence shows this control is operating?
Training source register, Copyright and rights-reservation policy and Public summary of training content. Owner: Model development lead. Frequency: at launch and on material change.