A small team in Zurich has trained a language model. Next month they want to offer it to customers in the EU. On Friday their lawyer sends one line. Where is your public training summary?
This guide explains what that summary is and what the EU template asks for. It then shows how to keep records that back the summary up.
Who has to publish a training summary
The AI Act makes every provider of a general-purpose AI model publish a summary of its training content.
The rule sits in Article 53(1)(d) of the EU AI Act. Providers of general-purpose AI models shall "draw up and make publicly available a sufficiently detailed summary about the content used for training of the general-purpose AI model, according to a template provided by the AI Office."
Open-source models do not escape this duty. Article 53(2) of the AI Act lifts some duties for open-source models, but only points (a) and (b). The summary in point (d) still applies.
The duty has applied since 2 August 2025 (re-checked on EUR-Lex, 21 October 2026). Models placed on the market before that date get more time. Their summary must be public no later than 2 August 2027 (re-checked in the Commission notice, 21 October 2026).
The three sections of the template
The Commission template has three sections, and each one asks for a broad picture of the data.
The AI Office published its Explanatory Notice and Template on 24 July 2025. Every summary must follow it. The template has three sections.
- "1. General information" names the provider and the model. It states the kinds of content the model learned from and how much of each, within broad ranges. It gives the general character of the training data.
- "2. List of data sources" names the main datasets. It describes data scraped online in words. It also covers all other sources, such as user data or synthetic data.
- "3. Relevant data processing aspects" has three parts. Part 3.1 is "Respect of reservation of rights from text and data mining exception or opt-out". Part 3.2 is "Removal of illegal content". Part 3.3 is "Other information (optional)".
Section 2 is split further. It covers public datasets, private datasets, scraped data, user data and synthetic data. Private datasets are split again. One part is data licensed from rights holders. The other part is data from other third parties.
Domain names and the update rule
You list the biggest websites you scraped, and you refresh the summary when you train the model further.
Section 2.3 of the template covers data crawled and scraped online. It asks for a list of domain names. You give the names "in the top 10 % of all domain names determined by the size of the content scraped". Small and medium companies have a lighter rule. They list "the top 5%, or the top 1000 domains".
The summary is also a living document. When you train the model further, you update it. The notice asks for updates at six-month intervals, or sooner if the new data is significant. Each update carries its date.
Where and when to publish it
The summary goes on your website, clearly visible, at the latest when the model reaches the EU market.
The notice says the summary "should be made publicly available at the latest when the model is placed on the Union market." It also says where. "It should be published on the provider's official website in a clearly visible and accessible manner". The summary also travels "together with the model across all its public distribution channels".
In plain terms, you need an easy-to-find page on your site. You also need a copy wherever people download the model.
What the template does not ask
You do not have to list every work or file the model learned from.
Paragraph 16 of the notice is clear on this. The template "does not require disclosure of the details for the specific data and works used to train the model". Recital 107 of the AI Act says the summary should be "generally comprehensive" but not "technically detailed".
The notice also states the purpose. The summary serves "providing meaningful public transparency and facilitating parties with legitimate interests to exercise and enforce their rights under Union law". A rights holder reads it to see if their work might be inside. Then they may ask you questions. You will want records to answer them.
Back the summary up with sealed records
Seal your dataset manifests, licence files and the summary itself as dated versions, so you can show what you held and when.
The summary is a public claim. One day a rights holder or the AI Office may ask what stood behind it. Say your section 2.2.1 lists data licensed from rights holders. You will want those licence files as they were on the day you trained. Say your section 3.1 says you honoured opt-outs. You will want the dataset manifest and the opt-out list as they stood that day.
On Swiss Trust Layer you upload these files into a folder and seal it. The platform computes a fingerprint of each file and of the sealed package. Only the fingerprint goes to Swisscom Trust Services, a qualified trust service provider. The file itself does not. Swisscom signs the fingerprint and adds a timestamp under RFC 3161. Every sealed version gets a certificate of proof, a signed PDF. It lists each file name and its fingerprint, plus the version number. A QR code on it opens a public verification page that needs no login.
Each time you update the summary, add a new version of the folder. The folder keeps a Version History, and each version keeps its own seal. Any change to a file gives a different fingerprint. So a dated chain of versions shows what you held on each date.
What a seal proves and what it does not
A seal proves the record existed on a date and has not changed since; it does not prove the data was lawfully used.
Be honest about the limit. A seal proves this exact file existed at that moment and has not changed since. It does not prove who created the content, that the content is true, or that the sealer holds the rights. It does not prove that your training data was lawfully used. A seal does not create copyright. Copyright arises with creation. A sealed licence file shows what licence text you held on that day. Whether that licence covers your use is a legal question the seal cannot answer.
Seal your dataset manifest, licence files and draft summary as version one on Swiss Trust Layer today.
