Which legal duties does "Training-data provenance and copyright register" satisfy?

It is recorded as satisfying 1 and supporting 3 duties across European Union, Colorado (United States) and Nepal. A mapping means the control, operated properly, does the work the duty asks for; the official text decides whether it is enough.

What evidence shows this control is operating?

Training source register, Copyright and rights-reservation policy and Public summary of training content. Owner: Model development lead. Frequency: at launch and on material change.

Process Owner: Model development lead At launch and on material change

Training-data provenance and copyright register

Records the origin, licence and rights status of every source used to train or fine-tune a model so that the organisation can honour opt-outs, answer downstream questions and publish a truthful summary of training content.

Source-linked Context file

Duties satisfied: 1; done properly, does the work
Duties supported: 3; contributes; the duty needs more
Jurisdictions: 3
Evidence items: 3

How is it implemented?

Model developers keep a register of training sources that captures the source, the acquisition route, the licence or legal basis relied on, whether machine-readable rights reservations were checked and honoured, and the date of collection. A written copyright and rights policy sets out how crawls respect opt-out signals, how licensed and public-domain material is distinguished and how takedown or objection requests are handled. From the register the team generates the public summary of training content and the information pack that downstream integrators need. The register is updated on every new training run and reviewed by legal before a model is released.

Which legal duties does it serve?

Satisfies means the control, operated properly, does the work the duty asks for. Supports means it contributes but the duty needs more. The official text decides; open it before relying on either.

European Union 2 duties

satisfies Legal requirement confidence high
Meet general-purpose AI model provider obligations
EU AI Act · Article 53 and Annexes XI–XII · applies from 2 Aug 2025

Produces the copyright policy and the public training-content summary.
supports Legal requirement
Apply data governance and quality criteria to training, validation and testing data
EU AI Act · Article 10 · applies from 2 Aug 2026

Origin and collection records for each source.

Colorado (United States) 1 duty

supports Legal requirement
Developers must document high-risk systems and disclose known risks
Colorado AI Act · C.R.S. 6-1-1702 · applies from 30 Jun 2026

Training-data summaries.

Nepal 1 duty

supports Legal requirement
Collect and use personal information only with consent and for the stated purpose
Nepal Privacy Act 2075 · Chapter on collection and protection of personal information (reviewer to cite sections)

Source register records the basis for each training source.

What evidence shows it is operating?

Evidence this control produces
Evidence	Type	What it shows
Training source register	Register entry	Source, acquisition route, licence or legal basis, opt-out check and collection date per source.
Copyright and rights-reservation policy	Policy document
Public summary of training content	Disclosure or notice

Owner: Model development lead. Frequency: at launch and on material change.

Which risks does it address?

Subdomains of the MIT AI Risk Repository, with the incidents the AI Incident Database has recorded under each. Counts are live; they say how often a risk has materialised, not how well this control prevents it.

6.3 Economic and cultural devaluation of human effort Socioeconomic & Environmental5 incidents · 31 risk entries
2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information Privacy & Security88 incidents · 80 risk entries
6.5 Governance failure Socioeconomic & Environmental3 incidents · 61 risk entries

Which standards clauses does it correspond to?

Clause numbers only. A reference means the standard asks for overlapping work, so evidence may be reusable; it never means the standard discharges a legal duty.

Framework references
Framework	Reference	Note	Confidence
ISO/IEC 42001	Annex A.7.3, A.7.5	Data acquisition and provenance records.	medium
NIST AI RMF	MAP 4.1; GOVERN 6.1		medium
MITRE ATLAS	AML.M0025 Maintain AI Dataset Provenance		medium

Cite this record

AIPolicyTracker (2026). “Training-data provenance and copyright register”. https://aipolicytracker.org/controls/training-data-provenance-and-copyright-register (accessed 24 September 2026). Data licensed CC BY 4.0.

Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.

Governance card

Kind: Process
Owner: Model development lead
Frequency: At launch and on material change
Binding duties: 4 of 4
Review status: Pending human review

Confirm which of the duties above reach you (applicability check).
Assign the owner and the frequency.
Operate the control and keep the evidence listed.
Re-check when a duty changes (change log).

Related controls

Data governance and dataset documentation Process
Privacy and data-protection controls for AI Process
Technical documentation, model cards and instructions for use Process

Report a correction How we verify

Run this control as a tracked task with Certifyi, a separate compliance execution platform. AIPolicyTracker itself stays open and independent.

Frequently asked questions

Which legal duties does "Training-data provenance and copyright register" satisfy?: It is recorded as satisfying 1 and supporting 3 duties across European Union, Colorado (United States) and Nepal. A mapping means the control, operated properly, does the work the duty asks for; the official text decides whether it is enough.
What evidence shows this control is operating?: Training source register, Copyright and rights-reservation policy and Public summary of training content. Owner: Model development lead. Frequency: at launch and on material change.