The EU AI Act: Practical Checklist for Data Teams

If you build AI models, provide data for teams that train LLMs, or manage scraping infrastructure that feeds any of them, you have probably heard about the EU AI Act – alongside fines and responsibilities. The majority of headlines make it look like it only concerns big data labs. However, the rules reach way down the chain – concerning in-house teams that create AI models for internal usage, data providers, and proxy vendors. In this article, DataImpulse, an ethical proxy vendor, explains who exactly the Act applies to, what changed on August 2, 2026, and what those changes mean for you – depending on where in the data chain you stand. 

What is the EU AI Act? 

The EU AI Act is a European Union document that regulates AI. It does not treat all models the same – instead, it categorizes systems depending on a risk level (prohibited, high risk, limited risk, minimal risk) and applies different responsibilities for each of those levels. 

A part, which is the most relevant for data- and scraping teams, is written in a separate chapter, which tells about General-Purpose AI (GPAI) – models like Gemini, Claude, ChatGPT, and others alike, that one can adapt for numerous tasks. As data collected by scraping public sources is used for training such models, the Act includes rules regarding how that data has to be collected. 

Who the EU AI Act applies to 

The term “GPAI providers” makes it a bit confusing to understand who is actually affected by the Act, so let’s break it down:

• Companies and teams that create GPAI models and use them – even if only internally, without selling them or launching for public use. If your business trains or fine-tunes a general-purpose model and uses it in its activities, you are a provider according to the law, holding the same responsibilities as a commercial AI lab. 
• Companies that delegate model creation and training to outsource companies. Even if you entrust all the processes to the third party, you are still a provider – a legal responsibility is not transferred along with technical tasks. 
• Anyone who modifies or fine-tunes an existing model. The thing is that if you initiate a major modification, you become a provider of that modified version, with respective responsibilities.
• Non-EU companies, if their models interact with EU markets. The point is not where a company is registered, but whether it is represented on EU markets or whether model work results touch EU markets. 
• Open-source model providers, as an open license does not mean the absence of legal responsibilities, and the necessity to follow laws. 

There is an exception – models that are on the stage of research, development, or prototyping, and are not yet used for backing up a real product or service. However, the moment a model is used for something else, even if it is internally and for free, all the requirements become active. 

Technically, there is one group the law does not regulate directly – data providers and scraping/proxy vendors. The one who develops an AI model is held responsible – not the one who uses it. Practically, though, that group is not omitted completely.

What exactly changed since August 2, 2026

Actually, no new rules were introduced on 08.02.2026 – only controlling mechanisms that monitor whether existing rules are followed. 

Technically, responsibilities regarding GPAI have been effective since August, 2025. However, during the previous year, the EU regulators could only “informally collaborate” with AI companies. There were no real punishments for breaking regulations. Now, the AI office can officially investigate, demand documents, evaluate, and issue fines. 

Also, new requirements written in Article 50 are now effective. They include the necessity to mark AI-generated content (deepfakes, synthetic media, disclosing when someone speaks to a bot, etc). It revolves around the AI outputs, not data collection, so it has less meaning for data and scraping providers; however, it remains part of the same regulations. 

Another news is that a separate delay – the “Omnibus” – postponed the strictest changes. So now providers of high-risk AI models – those include hiring tools, credit scoring tools, and tools used in medicine – have more time to adjust, presumably till December 2027-August 2028. This delay does not touch GPAI rules, copyright rules, and training data, which remain active. 

At the same time, older models were granted an extended transition period. This way, a GPAI model launched before August 2025 has until August 2027 to fully comply. Newer models have to be compliant from the start. 

Regarding data collection, there are two main responsibilities: 

• Publish the summary of training data. GPAI providers have to provide a structured public summary of all data categories used for model training – public datasets, licensed data, scraped content, users’ data, synthetic data, etc. It does not mean that you have to list every single source, but the list still has to be specific and honest enough to be meaningful. 
• Support the copyright compliance policies. Vendors have to have documented policies to prove that they get data in a legal way, that they detect and respect opt-out signals like robots.txt, ai.txt, metadata-based TDM warnings, and also terms of service written in human language (according to at least one debatable decision of the European Court). If a provider scrapes data and trains its model on content derived against restrictions, such a vendor loses the legal protection that usually covers text-and-data mining, opening the door to copyright claims. 

What do the new AI Act changes mean for you 

Depending on how exactly you interact with AI, there are different outcomes of the recent changes for you.

If you develop or fine-tune an AI model:

Whether you sell your model or use it internally for your own needs, the law classifies you as a provider. You have to be ready to provide:

• A summary of training data 
• A documented copyright policy 
• Information on how you obtained your data, whether you respected opt-out signals, and not just reconstructed retrospectively 

It does not lessen your responsibility if you delegate data scraping or model development to outsource teams. You will have to get all the aforementioned documents from the third party you worked with and be ready to provide them.

If you provide data, scraping infrastructure, or proxies for companies that develop AI models: 

Directly, the AI Act does not regulate your performance. However, your clients now have more compliance pressure, so they will look for products and services that meet new requirements and restrictions. As your clients have to provide copyright policies and data summaries even if they did not derive data themselves, but bought it from you, you, in turn, have to be able to provide them with information regarding the datasets you sell. This includes: 

• Categories of content scraped
• Approximate time of data collection 
• Reaction to opt-out signals – whether your crawler checked for their existence and respected them 
• Exclusion of known unreliable sources – pirate websites or platforms that get around access control
• Audit log that proves all aforementioned factors were considered at the moment of data collection 

Technically, you are not obligated to have all of that data. Practically, it will be a no-discussion requirement from your clients. 

If you provide data that is not used for AI training:

In case you provide data for price comparison, ad verification, market analysis, etc., that has nothing to do with training LLMs, the EU AI Act does not concern you directly. Sure thing, it does not mean you can ignore opt-out signals or scrape data from unreliable sources. Moreover, developers are fighting for fresh data that has not yet been used for training, so it is only strategic to try to meet compliance requirements in case your datasets will be used for AI training in the future.

Checklists for data teams

If you are a GPAI provider and you train or fine-tune models, you should have definite answers for the following questions:

• Do you have a published, up-to-date training data summary that fits the Commission’s template?
• Do you have a documented copyright policy regarding detection and respect of opt-out signals? 
• Can we track the scraper’s configuration and the list of opt-out signals active while collecting a particular dataset?
• If we handed model training or data collection over to a third party, can we still have the necessary documentation?
• Was our model launched to a market, or are we still in the clear, being on the research/prototyping stage?
• Do we have a clear process for handling complaints from rightholders regarding our training data?

If you provide training data or proxies, you need to be sure about some things too:

• Do our crawlers check robots.txt and known AI-specific opt-out signals before collecting data?
• Do we log when and how opt-out signals were checked, and can we recreate compliance later, if need be?
• Can we categorize data according to a data source in a way that meets our clients’ needs for data compliance?
• Do we exclude sources known to be pirate websites or those that get around technical access control?
• Do our policies and documentation provide all the necessary information our clients need to fulfill their data summaries?
• Do we treat opt-out signal detection and respect as a one-time event, or do we do it all the time, including change monitoring?

How to choose data and proxy providers in the current circumstances

Now, not only are performance metrics important, but compliance readiness is as well. Especially if the data are used for the AI training – any model that has something to do with the EU market. Do not look only for speed or success rate. Infrastructures that are only optimized for getting around access challenges are not fit for collecting data for AI training – even if it may be alright for other purposes like price monitoring.

It is also important to choose vendors that can provide log audits and data sources. Ask questions about provenance, not only about an IP pool size. On the other hand, do not think that the more expensive automatically means better compliance. Profitable pricing model and compliance can go hand in hand. 

Last but not least, remember that compliance is a process, not a one-time tick on the checklist. Requirements are changing, new rules are shaping all the time, and you need to look for a flexible provider that is ready to communicate and work with you all the time, not just a vendor that currently meets your needs. 

To sum up 

Regardless of what you do – be it AI models training, or data supplying, or even just infrastructure provision – the rule is simple: know where your data comes from and be ready to documentally prove your claims. Even if the EU AI Act does not concern you directly, the tendency is clear – data must always be legally derived, and the process is to be documented. Not only will it rid you of legal issues, but it will also give you a great competitive advantage, as AI developers and data teams will be paying more and more attention to data sources and compliance, not only technical performance metrics like speed or success rate. 

Frequently Asked Questions