Miju LabsThe compliance argument is usually made backwards. The AI Act is presented to a European data company as a burden it has to survive. It is the opposite: it is the reason a buyer has to pay for documentation it could previously ignore, and the documentation costs you almost nothing because you were already producing most of it for the database right.
The obligation that creates the demand
Article 53(1) of Regulation (EU) 2024/1689 requires providers of general-purpose AI models to maintain technical documentation per Annex XI, provide documentation to downstream providers per Annex XII, put in place a policy to comply with Union copyright law and in particular to identify and comply with rights reservations under Article 4(3) of the DSM Directive, including through state-of-the-art technologies, and draw up and make publicly available a sufficiently detailed summary of the content used for training, according to a template provided by the AI Office (artificialintelligenceact.eu).
Chapter V obligations applied from 2 August 2025. The AI Office published the training-data summary template in July 2025 (WilmerHale; Paul, Weiss). Commission enforcement powers — fines up to 3% of global turnover or €15 million — became exercisable on 2 August 2026, four weeks before this dossier was written, and summaries must be refreshed every six months or sooner on material change (Pebblous).
The Digital Omnibus on AI, Regulation (EU) 2026/1744 of 8 July 2026 (OJ 24 July 2026), delayed the high-risk obligations in Chapter III — to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I — but did not delay the Chapter V GPAI obligations (EUR-Lex OJ L 2026/1744). [WEAK] on the negative: what the instrument changed in Chapter III was verified directly; the absence of a Chapter V amendment was not verified against the full text and should be before it appears in a pitch.
Compliance is patchy, which is the whole opportunity
As of early August 2026, Google (Gemini 3 Pro), Meta (Muse Spark), Microsoft (Phi-4), OpenAI (GPT-5.5), Hugging Face, SpeakLeash and Swiss AI had completed the template, while Anthropic (Fable 5), Mistral and xAI substituted narrative prose for it. Microsoft's Phi-4 summary filled the boxes but failed an independent quality assessment by Trinity College Dublin and Mozilla Foundation researchers, where Hugging Face's SmolLM passed. No fines or formal investigations had been announced (Pebblous). [UNVERIFIED] — single secondary source, and the model names should be spot-checked before any of this reaches a client document.
The pattern in that list is worth reading carefully, because it says what the difficulty actually is. Nobody is failing this because the template is hard to fill in. They are failing it because web-scraped data of unclear provenance is the hardest thing in the world to describe honestly and the most embarrassing thing to publish. Prose is what you write when the boxes would look bad.
A commissioned, consented, contract-backed corpus is the easiest line a lab will ever write into that template. Named supply channel, dated agreements, per-record provenance, a consent basis, a jurisdiction. It is one paragraph and it is the only paragraph in the whole summary that will not attract a follow-up question.
The pitch, compressed: every record we sell you arrives with the paperwork that fills in your template. That is worth real money to a compliance function, it removes a task from the buyer's critical path, and it is a line a scraped-data competitor cannot say.
The related obligation is quieter and lands harder over time. Article 53(1)(c) requires a copyright policy that identifies and complies with Article 4(3) reservations using state-of-the-art technologies. A lab that has to demonstrate this is a lab that has to know, per corpus, where the data came from and what reservations attached to it. Licensed data is the only category where that question has a one-word answer. And for buyers building high-risk systems, Article 10's data-governance obligations name "annotation, labelling" in the statute and require documented bias examination — from 2 December 2027 and 2 August 2028 respectively. That is a later, larger version of the same demand.
What the buyer will actually ask for
Expect every serious buyer to require all of this, and to negotiate hard on exactly one line of it.
| Requirement | What it means in practice | Where it hurts |
|---|---|---|
| Record-level provenance | Who produced it, when, under which agreement version, with what consent, in what jurisdiction | Must be per record, not per corpus — retrofitting is very expensive |
| Consent records | Retrievable per contributor, covering onward sublicensing to the named buyer and to third parties | The grant clause has to have anticipated this |
| No third-party IP warranty | No embedded stock, fonts, brushes, client assets or scraped material | The warranty is easy; the controls behind it are not |
| No personal data warranty | Or a defined, documented processing basis where there is | Trajectory capture is where this breaks |
| IP indemnity | Expect a push for uncapped indemnity for third-party IP and confidentiality claims | This is the negotiation |
| Audit rights | Over process, contributor agreements and the provenance ledger; annually plus for cause | Cheap if the ledger exists, brutal if it does not |
| Security posture | SOC 2 Type II and/or ISO/IEC 27001 as table stakes, tiered environments for sensitive work | Budget it as a year-one cost, not a year-three one |
| Deletion and takedown | What happens when a contributor exercises a statutory right or a client asserts confidentiality | Needs a defined remedy short of a claim |
| Corpus exclusivity | Whether you may sell the same records to their competitor | Price it explicitly; never concede it as a term |
Two of those rows decide whether the business is viable at scale.
Uncapped IP indemnity against a frontier lab's exposure is an existential term for a small vendor. The whole negotiation is the cap, the exclusions and the insurance sitting behind it. A vendor that has never modelled what a claim would cost will agree to something it cannot survive, because the term is presented as boilerplate and the deal is in front of it. Model it before the first term sheet.
Corpus exclusivity is where a specialist's margin lives or dies. A buyer that gets exclusivity over the records for free has converted a product into bespoke work at product prices; a buyer that pays for it has funded the held-out suite you can then sell as a subscription. This is the single line item most likely to be given away by a founder who wants the logo.
Nobody has published the standard, so publish it
No lab has published data-supplier requirements for creative content — not OpenAI, Anthropic, Google, Meta or xAI. The checklist above is assembled from adjacent standards and practitioner commentary rather than from any buyer's own document, and should be read as a well-informed reconstruction rather than a specification. [WEAK]
What exists to build on: Partnership on AI's Vendor Engagement Guidance and Transparency Template (28 August 2024), covering vendor vetting, contract negotiation, monitoring and post-project, with a template for reporting on data-enrichment policies, internal governance and vendor processes (PAI), descended from Responsible Sourcing of Data Enrichment Services (17 June 2021) (PDF); C2PA / Content Credentials for asset-level provenance, now paired with IPTC's 2025.1 metadata specification (Numonic); Croissant as machine-readable dataset metadata; and the Data Provenance Initiative's licence auditing of public corpora.
That gap is the opportunity, and it is a better one than another benchmark. Since no buyer has published a creative-data supplier standard, the first vendor to publish a credible one sets it.
A public Provenance and Consent Standard would contain: a record-level provenance schema; a consent taxonomy; a plain-language summary of the contributor agreement; per-axis reliability reporting; C2PA-signed reference assets; Croissant metadata on every delivered dataset; a published redaction protocol; and panel composition, recruitment channel and pay rates disclosed. Almost none of the benchmark literature discloses even the last of those — annotator provenance is undisclosed across VBench-2.0, MJ-Bench, AgentNet and UI-Bench alike — so publishing it is genuinely differentiating rather than merely virtuous.
It functions as marketing the same way a benchmark does, and it has one property a benchmark lacks: copying it means actually implementing it. A competitor can replicate a leaderboard in a quarter. A competitor cannot replicate a consent ledger it never built, because the records had to exist at the moment each contributor signed. That is the same asymmetry that makes the verification ledger worth keeping from month one — the document is cheap, and the history behind it cannot be bought later.
Adopting PAI's transparency template voluntarily is the cheapest version of this move: it is a third-party-defined standard, it is worker-welfare-first in framing, and its framing maps exactly onto the terms European law compels anyway. Do that in the first ninety days, publish the standard when the first corpus ships, and price the documentation package into the product rather than throwing it in. It costs very little to produce and it is the part of the deal a compliance function will defend internally on your behalf.