EU AI Act Training Summaries vs AIBOMs: What GPAI Providers Disclose

Under Article 53(1)(d) of the EU AI Act, every provider of a general-purpose AI (GPAI) model placed on the EU market must publish a "sufficiently detailed summary" of its training content, using a template from the Commission's AI Office. That summary is narrative and deliberately high level. It is not an AI bill of materials (AIBOM): it names main datasets and broad source categories, not every dataset, version, licence and hash.

So what do you actually get? A public, versioned document that tells you which kinds of data went into a model, roughly how much, up to what date, which crawler collected web data and how opt-outs were handled. You do not get a machine readable, per-dataset inventory with provenance you can query, diff or scan. A richer set of technical documentation does exist under the Act, but it goes to the AI Office on request and, in part, to downstream providers who integrate the model, not to the public. This guide walks through each layer, compares the template field by field with CycloneDX ML-BOM and SPDX 3 AI and Dataset profiles, shows what Anthropic and OpenAI have published themselves, and ends with what a buyer can record and ask for today.

This post goes one level deeper than our earlier pieces on training data opacity in frontier models and the GPAI Code of Practice signatory list. If you need the AIBOM formats themselves, read our CycloneDX ML-BOM guide and SPDX 3 AI profile guide.

Key takeaways

• Three disclosure layers, three audiences. Article 53 creates a public training content summary (everyone), technical documentation for downstream providers (companies that build the model into their own AI systems), and fuller technical documentation for the AI Office and national authorities (on request only).
• The public summary is narrative by design. Recital 107 says it should be "generally comprehensive in its scope instead of technically detailed", and the Commission's explanatory notice says it does not require details of the specific data and works used.
• The template has three parts: general information (model, modalities, size bands, latest collection date, languages), a list of data sources in six categories (public datasets, licensed data, other private data, crawled data, user data, synthetic data, plus an "other" box), and data processing aspects (text and data mining opt-outs, illegal content removal).
• Size is reported in broad bands. Text is either under 1 billion tokens, 1 billion to 10 trillion, or more than 10 trillion. The template does not require the exact mix of sources.
• Dates matter. GPAI obligations applied from 2 August 2025. AI Office enforcement powers started on 2 August 2026. Models placed on the market before 2 August 2025 have until 2 August 2027 to publish their summaries.
• An AIBOM answers different questions. CycloneDX ML-BOM and SPDX 3 AI and Dataset profiles can list every dataset with a version, licence, hash, sensitivity flag and relationship to the model. No EU rule requires a GPAI provider to publish that.
• Both Anthropic and OpenAI are on the Commission's list of Code of Practice signatories. OpenAI publishes per-model training content summaries in the Commission template format; we fetched its GPT-5.5 summary. Anthropic publishes a training data section in each system card and model report; we did not locate a document in the template format on its public pages when we checked.
• What you can do now: save and hash each summary, record it in your own AIBOM as an external reference, ask for the downstream documentation in procurement, and write contract clauses that oblige the vendor to notify you of model changes.

Timeline: how the training content summary came about

Every date below was checked against a Commission document or the provider's own page.

One note on dates. The Commission's library page now serves the formal Communication dated 5 December 2025 (C(2025) 8311 final). Several secondary sources date the template's first presentation to 24 July 2025; we could not confirm that day on a Commission page we fetched. If you cite the template in a policy document, cite the Communication number, because that is the version with legal standing today.

What does Article 53 actually require?

Article 53(1) sets four duties for every provider of a GPAI model. The Commission's GPAI questions and answers page and the explanatory notice summarise them as follows.

1. Technical documentation for authorities (Article 53(1)(a)). Document the model, including its training and testing process and evaluation results, so it can be given to the AI Office and national competent authorities on request. Annex XI of the Act lists the minimum content.
2. Information for downstream providers (Article 53(1)(b)). Give companies that integrate the model into their own AI systems enough information to understand its capabilities and limits and to meet their own AI Act duties. Annex XII lists the minimum content.
3. A copyright policy (Article 53(1)(c)). Put in place a policy to comply with EU copyright law, in particular to identify and respect reservations of rights under Article 4(3) of Directive (EU) 2019/790, the text and data mining opt-out.
4. A public training content summary (Article 53(1)(d)). Draw up and publish "a sufficiently detailed summary about the content used for training", following the AI Office template.

Two exceptions and one add-on shape who does what.

• Open source. Article 53(2) lifts duties (a) and (b) for models released under a free and open source licence with public weights, unless the model has systemic risk. It does not lift duty (d). The explanatory notice is explicit that open source providers must still publish the summary.
• Providers outside the EU must appoint an authorised representative in the Union (Article 54). The template has a field for it.
• Systemic risk models carry extra duties under Article 55. The Commission's Q&A lists performing model evaluations, assessing and mitigating systemic risks, keeping track of and reporting serious incidents, and ensuring adequate cybersecurity protection for the model and its physical infrastructure. A model is presumed to have systemic risk when its training compute exceeds 10^25 floating point operations (Article 51), and the Commission can also designate models on other criteria.

Who counts as a GPAI provider?

The Commission's guidelines on the scope of GPAI obligations give an indicative criterion: training compute above 10^23 FLOP and the ability to generate language (text or audio), text to image or text to video. A company that fine-tunes or modifies someone else's GPAI model can itself become a provider of a new model. In that case, the Commission's Q&A says, the Article 53 duties are limited to the modification: you document and summarise the data you added, and you name the model you modified.

That matters for buyers. If you fine-tune a vendor model on your own data at a scale that makes you a provider, you will write a training content summary yourself, and the template tells you to list the original model under "Model dependencies" with a link to its summary.

What happens if a provider does not comply?

The explanatory notice says the AI Office may check whether the template has been filled in correctly, can request corrective measures and can fine up to 3% of annual worldwide turnover or EUR 15 million, whichever is higher. It also says the AI Office will not perform a "work-by-work assessment" of whether specific content was used. The summary is checked for completeness and good faith, not audited against the actual training corpus.

Three disclosure layers compared

Most confusion about "what GPAI providers must disclose" comes from mixing up these three layers. Only the first one is public.

The Code of Practice Transparency chapter includes a Model Documentation Form that lists each item and marks which audience it is meant for. Signatories also commit to publish contact details so that the AI Office and downstream providers can request the documentation. If your company builds a product on a GPAI model and places that product on the EU market, you are a downstream provider, and Measure 1.2 is the route to more detail than the public summary gives.

The Code also "encourages" signatories to consider making documented information public in whole or in part. That is voluntary.

What the Commission template asks for, section by section

The template annexed to C(2025) 8311 is short: about seven pages. Here is every field, with what it gives a reader.

Section 1: General information

The size bands are wide. For text: under 1 billion tokens, 1 billion to 10 trillion tokens, or more than 10 trillion tokens. For images: under 1 million, 1 million to 1 billion, or more than 1 billion. For audio and video: under 10,000 hours, 10,000 to 1 million hours, or more than 1 million hours. The notice says this is intentional: the template "does not require disclosure of the exact mix and composition of data sources".

Section 2: List of data sources

The template sorts every dataset into one category (except synthetic data, which can appear twice) and asks for a different level of detail per category. This is where the trade secret balancing described in Recital 107 is most visible.

Two clarifications in the explanatory notice are worth knowing. First, retrieval augmented generation inputs are not "training" and are not required in the mandatory sections unless the model actively learns from them. Second, customer data used to fine-tune a model for a specific customer is excluded from the user data section.

Section 3: Data processing aspects

Updates, versions and where it must be published

The summary must be on the provider's official website "in a clearly visible and accessible manner" and with the model across its public distribution channels. One summary can cover several model versions if the content is identical. If a model is further trained on new data, the summary should be updated at six month intervals, or sooner when the change is materially significant. A model derived from an earlier one only needs to summarise the extra training data and link back to the original summary.

What the summary gives you, and what it does not

Read with a buyer's eye, the summary is useful for some questions and silent on others. The Commission says so itself: it is aimed mainly at rightsholders and others with "legitimate interests", and also at downstream providers assessing data diversity (point 10 of the notice).

Questions the summary helps you answer

• Was web data collected by the provider's own crawler, and does that crawler honour robots.txt?
• What is the latest data collection date, so you can expect a knowledge cut-off?
• Were user prompts from the provider's consumer products used for training this model?
• Was synthetic data from other models used, and which on-market models generated it?
• Did the provider sign the Code of Practice and its copyright commitments?
• Which public datasets above the 3% threshold were used?
• Which languages are covered?

Questions the summary does not answer

• The full list of datasets, with versions and snapshots.
• The licence of each dataset, and whether a given licence permits training.
• Hashes or other integrity data that would let you verify a dataset.
• Which licensed or private datasets were used, unless already public.
• The proportion of each source in the training mix.
• Whether a specific work, domain or person's data was used. The AI Office explicitly does not check this.
• Post-training datasets, evaluation sets and their contamination controls in any detail.
• Data poisoning controls, beyond general descriptions of filtering.

That second list is roughly what an AIBOM is designed to hold.

Summary vs AIBOM: what a full AIBOM would contain

An AIBOM is a bill of materials for AI components: models, datasets, their versions, licences, suppliers and the relationships between them, in a machine readable format. Three efforts define what one looks like.

• CycloneDX ML-BOM. CycloneDX, published as Ecma standard ECMA-424, added machine learning support in version 1.5 and carries it in 1.6. A model is a component of type machine-learning-model with a modelCard (model parameters, approach, task, architecture family, datasets, inputs, outputs, quantitative analysis, and considerations such as technical limitations, ethical and environmental considerations). A dataset is a component of type data with fields such as contents, classification, sensitiveData and governance (custodians, stewards, owners).
• SPDX 3.0.1 AI and Dataset profiles. An AIPackage has properties including typeOfModel, informationAboutTraining, modelDataPreprocessing, useSensitivePersonalInformation, safetyRiskAssessment, standardCompliance, limitation and energyConsumption. A DatasetPackage has datasetType, datasetSize, dataCollectionProcess, dataPreprocessing, knownBias, hasSensitivePersonalInformation, anonymizationMethodUsed, confidentialityLevel, datasetAvailability and datasetUpdateMechanism. Relationships such as trainedOn and testedOn link the model to its datasets.
• OWASP AIBOM work. The OWASP AIBOM Initiative, led under the OWASP GenAI Security Project, works on open, standardised approaches to AI supply chain transparency and publishes an AIBOM generator.

Field by field: template vs CycloneDX vs SPDX

The comparison cuts both ways. The template asks for things that the AIBOM formats have no dedicated field for: crawler behaviour, the top domains scraped, and copyright opt-out measures. Those exist because the summary's main audience is rightsholders. The AIBOM formats, in turn, can hold things the template never asks for: per-dataset licences, hashes, versions and relationships. Neither is a superset of the other. A companion CSV with this mapping is listed in the Downloads section below.

What have Anthropic and OpenAI published?

Everything in this section comes from the companies' own pages and the Commission's pages, fetched on 23 October 2026. We make no comparison between the two and no comment on the merits of either approach.

Code of Practice signatures

The Commission's Code of Practice page lists both Anthropic and OpenAI among the signatories of the GPAI Code of Practice, in a list of 20 providers. Anthropic's post of 21 July 2025 said that "after review, Anthropic intends to sign" the Code. OpenAI's own page on the Code (openai.com/global-affairs/eu-code-of-practice) blocked our scripted request, so we rely on the Commission's list for OpenAI's status.

OpenAI: per-model summaries in the template format

OpenAI publishes training content summaries as PDFs in the Commission template format. We fetched the one for GPT-5.5 and confirmed that files for GPT-5.2, GPT-5.4 nano and GPT-6 Astra exist at the same address pattern. A search result for OpenAI's help center article "EU AI Act: OpenAI Resources and Customer Guidance" says the company publishes summaries "in accordance with our obligations under Article 53(1)(d)". The help center itself blocked our scripted request, so we could not read the full article.

What the GPT-5.5 summary (version 1, last updated 29 July 2026) states, in OpenAI's own words where quoted:

This is a complete, filled-in template. Measured against an AIBOM, the same gaps described above remain: one named public dataset, no dataset versions, licences or hashes, domains described by category rather than listed, and no machine readable form. That is what the template asks for, not a shortfall against it.

Anthropic: training data sections in system cards and the Transparency Hub

Anthropic's Transparency Hub (model report updated 2 October 2026) gives each Claude model a "Training Data" entry. For Claude Sonnet 5.5 it says the model "was trained on a proprietary mix of publicly available information from the internet, public and private datasets, and other sources, such as synthetic data generated by other models", that the mix may include user data from feedback or bug reports or data users explicitly permitted for training, and that cleaning included deduplication and classification. Entries for some models give a knowledge cut-off date, for example May 2026 for Claude Opus 5.

The Claude Opus 5.5 system card (22 September 2026) adds more in section 1.1:

• A general purpose web crawler called ClaudeBot collects public web data and follows robots.txt instructions.
• Anthropic does "not access password-protected pages or those that require sign-in or CAPTCHA verification".
• "We conduct due diligence on the training data we use."
• The knowledge cut-off for Claude Opus 5.5 is June 2026.

Section 1.3 of the same card says Anthropic Ireland, Limited "is the provider of Anthropic's general-purpose AI models in the European Economic Area", and that its Frontier Compliance Framework covers California's Transparency in Frontier AI Act (SB 53) and "the EU AI Act's General-Purpose AI Code of Practice".

Anthropic's privacy center also has an article on privacy rights requests about training data. It explains that personal data collected incidentally is not linked to individuals and that "models do not store text like a database", which limits what a rights request can locate.

We searched Anthropic's website, sitemap, Transparency Hub and system cards for a document titled as a public summary of training content in the Commission template format and did not find one on 23 October 2026. That may reflect where such a document is hosted rather than whether it exists. If you need it for a procurement file, ask Anthropic directly for the link, and record the answer.

Side by side, as published

The last row is the gap the rest of this series discusses. No rule we found requires either company to publish one.

Why the gap exists, as general industry considerations

Neither company has stated, in the pages we read, why it does not publish a dataset-level AIBOM, so we attribute no reason to either. The Commission's notice does explain why the template itself stops short: it was a "careful balancing exercise" between transparency and "confidential commercially sensitive information about the data sources and the precise manner in which providers curate the data and train their models".

Beyond that, these considerations are commonly discussed across the industry and apply to any large model provider:

• Trade secrets in data selection and mixing.
• Security of training pipelines, since a detailed source list can show attackers where to place poisoned content.
• The scale of web data, which makes a per-document inventory impractical.
• Legal uncertainty around copyright and licensing of training data in several jurisdictions.
• Contractual confidentiality in licensing deals with content owners.

Worked example: recording a published summary in your own AIBOM

You cannot produce an AIBOM of a vendor's training data. You can record what is knowable about the model you use, and point to the vendor's summary as evidence. Below is a minimal CycloneDX 1.6 component for GPT-5.5 built only from facts in OpenAI's summary. The dataset entry is a description, not a claim about contents.

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "version": 1,
  "metadata": {
    "timestamp": "2026-10-23T09:00:00Z",
    "component": { "type": "application", "name": "support-assistant", "version": "3.2.0", "bom-ref": "app" }
  },
  "components": [
    {
      "type": "machine-learning-model",
      "bom-ref": "model-gpt-5.5",
      "name": "GPT-5.5",
      "supplier": { "name": "OpenAI Ireland Ltd" },
      "modelCard": {
        "modelParameters": {
          "inputs": [ { "format": "text" }, { "format": "image" } ],
          "outputs": [ { "format": "text" } ],
          "datasets": [ { "ref": "data-gpt-5.5-training-summary" } ]
        }
      },
      "externalReferences": [
        {
          "type": "documentation",
          "url": "https://cdn.openai.com/pdf/gpt-5-5-eu-ai-act-public-summary-of-training-content.pdf",
          "comment": "EU AI Act Art. 53(1)(d) public summary, v1, last update 29 July 2026",
          "hashes": [ { "alg": "SHA-256", "content": "<sha256 of the PDF you saved>" } ]
        }
      ],
      "properties": [
        { "name": "eu-ai-act:placed-on-market", "value": "2026-04-23" },
        { "name": "eu-ai-act:latest-data-collection", "value": "2026-02" },
        { "name": "eu-ai-act:code-of-practice-signatory", "value": "true" },
        { "name": "procurement:downstream-docs-requested", "value": "2026-10-23" }
      ]
    },
    {
      "type": "data",
      "bom-ref": "data-gpt-5.5-training-summary",
      "name": "GPT-5.5 training content (as summarised by provider)",
      "data": [
        {
          "type": "dataset",
          "name": "Provider-described training mix",
          "description": "Public web data incl. Common Crawl; partner data; synthetic data from provider models incl. GPT-5.4; crawl period approx. 2018 to 2025-12. Text >10T tokens. Dataset list, licences and hashes not published.",
          "classification": "unknown"
        }
      ]
    }
  ],
  "dependencies": [ { "ref": "app", "dependsOn": [ "model-gpt-5.5" ] } ]
}

Replace the model, URL and hash with your own. The properties names are your own namespace, not an official CycloneDX taxonomy. For a model where you only have a system card, use the system card URL as the external reference and record the knowledge cut-off it states.

The same facts in SPDX 3 look like this in outline: an AIPackage for the model with suppliedBy set to the provider, an externalRef to the summary, and a DatasetPackage with datasetAvailability left empty and a comment that the dataset list is not public, linked with a trainedOn relationship. The point in both formats is to make the unknowns explicit rather than leave fields blank, so that a reviewer can see what you could not verify.

Step by step: what a deployer should do with a training content summary

This checklist assumes you use a hosted GPAI model in a product or internal system. Commands are for macOS or Linux.

1. List the exact model identifiers you call. Pull them from code and configuration, not from memory. For example:

   grep -rEoh "(gpt|claude)-[a-z0-9.\-]+" --include=*.py --include=*.ts --include=*.json . | sort | uniq -c
   

2. Find the provider's training content summary for each model. Look on the provider's website and model documentation. Note the summary version and "last update" date. If you cannot find one, record that and ask the provider (step 7).

3. Save a copy and hash it. Summaries are versioned and can change. Keep the version you relied on.

   mkdir -p evidence/ai-summaries && cd evidence/ai-summaries
   curl -sSLO "https://cdn.openai.com/pdf/gpt-5-5-eu-ai-act-public-summary-of-training-content.pdf"
   shasum -a 256 gpt-5-5-eu-ai-act-public-summary-of-training-content.pdf | tee -a SHA256SUMS
   

4. Extract the fields you care about. Turn the PDF into text and pull the key lines into your risk register.

   pdftotext -layout gpt-5-5-eu-ai-act-public-summary-of-training-content.pdf summary.txt
   grep -nE "Last update|placement|Latest date|crawler|Signatory|user interactions" summary.txt
   

5. Record the model in your AIBOM with the summary as an external reference, as in the example above, then validate it.

   cyclonedx validate --input-file aibom.cdx.json --input-format json --input-version v1_6
   

6. Map summary facts to your own obligations. If you deploy the model in a high-risk AI system, the data governance duties in Article 10 apply to your system, and the summary is one input among several. See our post on Article 10 data governance and AIBOMs.

7. Request downstream documentation. If you are a downstream provider, ask through the contact point the provider publishes under Code of Practice Measure 1.2. Log the date of the request and the reply. Signatories commit to respond within 14 days save exceptional circumstances.

8. Set a review trigger. Re-check the summary when the provider releases a new model version, when its "last update" date changes, and at least every six months, matching the update interval in the Commission notice.

   curl -sSL "https://cdn.openai.com/pdf/gpt-5-5-eu-ai-act-public-summary-of-training-content.pdf" | shasum -a 256
   # compare with the line in SHA256SUMS; a different hash means a new version to review
   

9. Write down what you accept. For each unknown (dataset licences, personal data, poisoning controls), record whether you accept it, mitigate it (for example with output filtering, evaluation or human review) or refuse the model for that use.

10. If you fine-tune, check whether you become a provider. Use the Commission's GPAI guidelines. If you do, your own summary covers only your added data and names the base model under "Model dependencies".

Procurement questions and contract clauses

The public summary is the floor. Procurement is where you can ask for more. Keep questions specific and answerable.

Questions to ask a GPAI provider

Clauses to consider (have counsel adapt them):

• The provider will maintain a current Article 53(1)(d) summary for each model version supplied and notify the customer of each update within a set number of days.
• The provider will give the customer the downstream information required by Article 53(1)(b) and Annex XII on request.
• Model version pinning: the provider will not change the model behind a pinned identifier without notice.
• Customer data will not be used for training unless the customer opts in in writing.
• The provider will notify the customer of serious incidents relevant to the customer's use, where the model is subject to Article 55.

Where Safeguard fits, honestly

Safeguard does not and cannot see inside a vendor's training data. No tool can produce the dataset list of a closed model from the outside, and we make no such claim.

What Safeguard's AI-BOM discovery does, in early access, is inventory the AI assets your own organisation uses, across code (SDK imports), cloud AI services, SaaS use and vector databases, with CycloneDX ML-BOM or SPDX AI output. That is the half of the AIBOM you control. You can attach the vendor's summary and system card to each model entry as evidence, so that when a provider updates a summary or retires a version you know which projects are affected. The software around the model, the SDKs, agent frameworks and services that call it, is ordinary open source supply chain, and Safeguard's GA dependency scanning, vulnerability matching and reachability analysis apply to it as they would to any other project.

Common mistakes

• Treating the public summary as a dataset list. It names "large" public datasets and publicly known private ones. Everything else is narrative by design.
• Assuming no summary means non-compliance. Models placed on the market before 2 August 2025 have until 2 August 2027. A summary may also live on a page you did not search. Ask before you conclude anything.
• Reading the user data section as a statement about your contract. It describes the provider's general practice across its services. Your enterprise or API terms decide what happens to your data.
• Not saving the version you relied on. Summaries are updated at least every six months when models are further trained. Keep a hashed copy.
• Confusing the three layers. The public summary, the downstream documentation and the AI Office documentation differ in audience and depth. Asking a vendor "for your AI Act documentation" without saying which layer gets a vague reply.
• Leaving unknown fields blank in your AIBOM. Blank reads as "not checked". Write "not published by provider" with the date you checked.
• Mixing model aliases and versions. An alias can point to a new version with a different summary. Record the exact version string.
• Expecting the AI Office to have verified the contents. It checks that the template is filled in correctly, not that specific works were or were not used.
• Forgetting your own provider status after fine-tuning. A large enough modification makes you a provider with your own Article 53 duties.

FAQ

What is the EU AI Act training data summary?

It is a public document every provider of a general-purpose AI model must publish under Article 53(1)(d) of the AI Act, using the Commission's template. It describes the content used to train the model: modalities, size bands, main public datasets, crawled data, user data, synthetic data and copyright opt-out measures.

Is the training content summary the same as an AIBOM?

No. The summary is a narrative document aimed mainly at rightsholders and the public. An AIBOM is a machine readable inventory, in a format such as CycloneDX or SPDX 3, that can list every dataset with versions, licences, hashes and relationships to the model. The summary does not require that level of detail.

When did GPAI providers have to start publishing training summaries?

From 2 August 2025 for models placed on the EU market from that date. Models placed on the market before 2 August 2025 have until 2 August 2027. The AI Office's enforcement powers for GPAI providers started on 2 August 2026.

Do open source model providers have to publish a training data summary?

Yes. The open source exemption in Article 53(2) covers the technical documentation duties in points (a) and (b), not the public summary in point (d). The Commission's explanatory notice says so directly.

Do Anthropic and OpenAI publish EU AI Act training summaries?

OpenAI publishes per-model summaries in the Commission template format; we read the GPT-5.5 summary dated 29 July 2026. Anthropic publishes training data sections in its system cards and Transparency Hub and names Anthropic Ireland, Limited as its EU provider; we did not locate a template-format summary on its public pages on 23 October 2026. The Commission lists both as Code of Practice signatories.

What is the difference between the GPAI Code of Practice and the AI Act?

The AI Act is the law. The Code of Practice, published on 10 July 2025, is a voluntary tool with Transparency, Copyright and Safety and Security chapters. The Commission and the AI Board have confirmed it is an adequate way for providers to show compliance with Articles 53 and 55.

Can a company using a GPAI model get more than the public summary?

Yes, if it is a downstream provider integrating the model into its own AI system. Article 53(1)(b) and Annex XII require providers to give such companies information on the model's capabilities and limits. Code signatories commit to publish a contact point and answer requests within 14 days save exceptional circumstances.

What is the fine for not publishing a training content summary?

The Commission's explanatory notice says non-compliance can be fined up to 3% of annual worldwide turnover in the preceding financial year or EUR 15 million, whichever is higher.

Does the summary tell me whether my website was used to train a model?

Not directly. Crawled data is summarised by the top 10% of domains by content size, in narrative form. The Commission recommends that providers voluntarily answer rightsholders' requests about specific domains, and the Code's Copyright chapter asks signatories to provide a complaints mechanism.

How often must a training content summary be updated?

When a provider further trains a model on new data, the summary should be updated every six months, or sooner if the change is materially significant, with the update date shown.

Downloads

Two companion files accompany this post.

• template-to-aibom-field-map.csv: every field of the Commission's training content summary template mapped to the closest CycloneDX 1.6 ML-BOM and SPDX 3.0.1 AI or Dataset field, with a column for fields that have no equivalent.
• gpai-provider-obligations-checklist.md: a checklist of GPAI provider obligations under Articles 53 to 55 and the Code of Practice, with dates, each line tied to a primary source, plus a short deployer checklist.

Direct downloads:

• Download gpai-provider-obligations-checklist.md
• Download template-to-aibom-field-map.csv

A GPAI model reaches your product through SDKs, agent frameworks, vector databases and services, and every one of those is open source software with its own dependencies and vulnerabilities. The training data inside a closed model is outside your reach, but the code around it is not, so keeping that layer patched is still the part of AI supply chain risk you can act on today.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude can use. Once connected, you can ask about the findings and components in your Safeguard inventory, including the SDKs and frameworks your AI features depend on. It does not reveal anything about how Claude or any other model was trained.

Click through it at your own pace, or open it full screen.

The second demo is a real terminal session with the Safeguard CLI. It reads a vulnerability finding and its advisory, asks before each command, upgrades a dependency, runs the tests with your approval and pushes nothing. The same flow applies to an AI client library or agent framework in a service that calls a GPAI model.

Click through it at your own pace, or open it full screen.

The third demo sets up the local runner on your own machine, approves it with a device code and runs scans from the terminal. That suits repositories holding AI integration code you would rather scan on hardware you control.

Click through it at your own pace, or open it full screen.

To try it on your own projects, download Safeguard at safeguard.sh/download and read the CLI documentation.

Quick check

Sources

• European Commission, Explanatory Notice and Template for the Public Summary of Training Content for general-purpose AI models (library page)
• European Commission, Communication C(2025) 8311 final, Explanatory Notice and Template (PDF)
• European Commission, The General-Purpose AI Code of Practice (including signatory list)
• European Commission, GPAI Code of Practice, Transparency Chapter (PDF)
• European Commission, GPAI Code of Practice, Copyright Chapter (PDF)
• European Commission, GPAI Code of Practice, Safety and Security Chapter (PDF)
• European Commission, General-Purpose AI Models in the AI Act: Questions and Answers
• European Commission, Questions and Answers on the Code of Practice for General-Purpose AI
• European Commission, Guidelines for providers of general-purpose AI models
• European Commission, European AI Office
• Regulation (EU) 2024/1689, the AI Act, on EUR-Lex
• OpenAI, Public Summary of Training Content for GPT-5.5, v1 (PDF)
• OpenAI, Public Summary of Training Content for GPT-6 Astra (PDF)
• OpenAI Help Center, EU AI Act: OpenAI Resources and Customer Guidance
• Anthropic, Anthropic to sign the EU Code of Practice
• Anthropic, Transparency Hub
• Anthropic, System Card: Claude Opus 5.5 (PDF)
• Anthropic Privacy Center, Privacy rights requests relating to Anthropic's training data
• CycloneDX, Machine Learning Bill of Materials (AI/ML-BOM)
• CycloneDX 1.6 JSON reference
• SPDX 3.0.1, AI profile
• SPDX 3.0.1, AIPackage class
• SPDX 3.0.1, Dataset profile
• SPDX 3.0.1, DatasetPackage class
• OWASP GenAI Security Project, AI SBOM initiative

Last reviewed: 23 October 2026.