The EU Artificial Intelligence Act and the Challenge of Data Traceability
On August 2, 2024, the European Union’s Artificial Intelligence Act (AI Act) came into force, marking a major regulatory milestone for emerging technologies. But its scope extends beyond algorithms — it introduces new obligations regarding how data is sourced, used, and documented in the development and training of AI systems.
At Across Legal, we break down the key legal and strategic takeaways of this new framework, its real-world impact, and how to prepare for responsible and legally sound innovation.
This need becomes even more urgent as of August 2, 2025, when the provisions of the AI Act applicable to general-purpose AI models (GPAIs) come into effect — significantly expanding the scope of its enforceable obligations.
A New Dimension of Regulatory Compliance
The AI Act introduces a dedicated legal framework for artificial intelligence systems and general-purpose AI models (GPAIs). More significantly, it reinforces and expands existing obligations concerning the lawful use of third-party data — particularly data protected by copyright, neighbouring rights, and the sui generis database right.
Any organization that trains, fine-tunes, integrates, or deploys AI models will now be required to justify and document:
- The origin, characteristics, and method of collection of the datasets used.
- The legal basis for data use — including open licences (such as Creative Commons), restrictive licences, public domain sources, or specific exceptions (such as for research, education, or Text and Data Mining under Directive 790/2019 and its national transpositions).
- The technical and legal traceability of all datasets, including those reused or obtained from third parties.
Transparency, Documentation, and Proactive Compliance
Developers of GPAIs will also face new obligations such as:
- Implementing internal guidelines to ensure compliance with EU copyright and related rights legislation.
- Detecting and honouring opt-out declarations made by rights holders.
- Publishing a sufficiently detailed summary of the datasets used to train the model — one that enables independent audits.
This requirement introduces a critical tension between regulatory transparency and the protection of trade secrets. Organizations will need to strike a careful balance between legal compliance and safeguarding competitive advantage.
The Data Management Plan: Cornerstone of Compliance
The AI Act does not replace existing regulations — it builds upon them. This means that in addition to the AI-specific rules, companies must still comply with the Copyright Act (RDL 1/1996), the GDPR, Spain’s LOPDGDD, and any contractual obligations relating to data usage.
In this context, a robust Data Management Plan (DMP) becomes essential. It must:
- Outline the entire data lifecycle — from collection through reuse or deletion.
- Align with FAIR principles (Findable, Accessible, Interoperable, Reusable).
- Anticipate and mitigate legal, regulatory, ethical, and reputational risks associated with poor data traceability.
Due Diligence: Data Is Now Part of the Valuation Equation
Data governance is increasingly becoming a core component of Due Diligence processes, particularly in M&A and venture capital transactions.
Today, data management and compliance can influence:
- The valuation of intangible assets.
- Investor decision-making.
- The successful — or failed — execution of transactions.
A lack of documentation or failure to meet transparency obligations can become a serious liability.
Innovating with Traceability: The New Market Standard
The AI Act does not simply set out new rules — it raises the bar for how data must be handled, justified, and audited in practice. It’s no longer enough to merely comply with the law — organizations must be able to prove compliance at every stage of the data lifecycle.
Those that invest in strong data governance, thorough technical documentation, and reinforced legal compliance will be better positioned to compete, innovate, and build trust in a fast-evolving regulatory landscape.
📩 At Across Legal, we help companies, funds, universities, and research centres audit, legalise, and structure their data use in AI contexts. If your organisation is ready to get ahead, we’re here to support you.
Author: Marcelo Estrella
↳ Discover more content in the section Insight.
↳ Do you want to stay up tp day about the sector related news? Follow us on LinkedIn.
