Trains models, in the European Union

Directive 96/9/EC, Arts. 7-10 · Read the law's page

• Do not extract or re-utilize the whole or a substantial part, evaluated qualitatively or quantitatively, of a database's contents without the maker's authorization, where the maker shows a substantial investment in obtaining, verifying, or presenting that content and is a national or habitual resident of a Member State, or a company or firm formed under a Member State's law with its registered office, central administration or principal place of business in the Community (Art. 11(1) and (2)). Under Art. 43 of Regulation (EU) 2023/2854 the right does not apply to data obtained from or generated by a connected product or related service within that Regulation's scope.
• Do not repeatedly and systematically extract or re-utilize insubstantial parts of a database's contents where doing so conflicts with the database's normal exploitation or unreasonably prejudices the maker's legitimate interests, even where no single extraction takes a substantial part.
• Where lawfully accessing a database the maker has made available to the public, extracting or re-utilizing insubstantial parts for any purpose does not need the maker's authorization, but stop short of conflicting with the database's normal exploitation or unreasonably prejudicing the maker's interests; where you are authorized to extract or re-utilize only part of the database, this applies only to that part (Art. 8(1)).
• Treat the sui generis right as expiring fifteen years from 1 January of the year following the database's completion or, where the database was made available to the public before that period expired, fifteen years from 1 January of the year following the date it was first made available to the public (Art. 10(1) and (2)), and expect a substantial new investment in its contents to start a new term for the resulting database (Art. 10(3)).

Directive 2001/29/EC, Arts. 6-7 · Read the law's page

• Do not circumvent an effective technological measure, as Article 6(3) defines the term, where you know, or have reasonable grounds to know, that circumventing it is what you are doing (Art. 6(1)).
• Do not manufacture, import, distribute, sell, rent, advertise for sale or rental, or possess for commercial purposes a device, product or component, or provide a service, that is promoted for circumvention, has only a limited commercially significant purpose or use other than circumvention, or is primarily designed to enable or facilitate it (Art. 6(2)).
• Do not knowingly and without authority remove or alter electronic rights-management information, as Article 7(2) defines the term (Art. 7(1)(a)).
• Do not knowingly and without authority distribute, import for distribution, broadcast, communicate or make available to the public a work from which electronic rights-management information has been removed or altered without authority, if you know or have reasonable grounds to know that doing so induces, enables, facilitates or conceals an infringement (Art. 7(1)(b)).

Directive 2009/24/EC, OJ L 111, 5.5.2009, p. 16 · Read the law's page

• This Directive is addressed to the Member States, which implement it in national law, so an app meets these rules through that law (Art. 12).
• Treat a computer program as protected by copyright as a literary work, in the expression of the program in any form but not in the ideas and principles that underlie any element of it, including those that underlie its interfaces (Art. 1(1) and (2)).
• Get the rightholder's authorisation before permanently or temporarily reproducing a computer program, in part or in whole, including where loading, displaying, running, transmission or storage of it necessitates the reproduction (Art. 4(1)(a)).
• Get the rightholder's authorisation before translating, adapting, arranging or otherwise altering a computer program or reproducing the result, or before distributing the program or copies of it to the public, including by rental (Art. 4(1)(b) and (c)).
• After a first sale of a copy in the Community by the rightholder or with his consent, you need no further authorisation to distribute that copy within the Community, except to rent it (Art. 4(2)).
• A lawful acquirer may, in the absence of specific contractual provisions, do the acts in Art. 4(1)(a) and (b) without authorisation where they are necessary to use the program in accordance with its intended purpose, including for error correction (Art. 5(1)).
• A person with a right to use the program may make a back-up copy as far as necessary for that use, and a contract may not prevent it (Art. 5(2)).
• A person with a right to use a copy may observe, study or test the functioning of the program, to determine the ideas and principles underlying any element of it, while performing the acts of loading, displaying, running, transmitting or storing the program that he is entitled to do (Art. 5(3)).
• Decompile only as Art. 6 allows: reproduction of the code and translation of its form need no authorisation only where indispensable to obtain the information necessary for the interoperability of an independently created program, are done by a licensee or another person with a right to use a copy (or on their behalf), the information was not previously readily available to them, and the acts are confined to the parts of the original program necessary for interoperability (Art. 6(1)).
• Do not use information obtained under Art. 6(1) for goals other than the interoperability of the independently created program, give it to others except when necessary for that interoperability, or use it to develop, produce or market a program substantially similar in expression or for any other act that infringes copyright: Art. 6(1) does not permit those uses (Art. 6(2)).
• A contractual term contrary to Art. 6 or to Art. 5(2) or (3) is null and void (Art. 8).

Directive 2013/40/EU, Arts. 2(d), 3-12 · Read the law's page

• This Directive is addressed to the Member States (Article 19), which had to bring into force the measures necessary to comply with it by 4 September 2015 (Article 16(1)), so a service meets these rules through each Member State's criminal law; Denmark is not bound by it (recital 32).
• Do not intentionally access, without right, the whole or any part of an information system by infringing a security measure; Member States must make this a criminal offense, at least for cases which are not minor (Article 3). Without right means not authorized by the owner or another right holder of the system or of part of it, or not permitted under national law (Article 2, point (d)).
• Do not intentionally and without right seriously hinder or interrupt the functioning of an information system by inputting computer data, or by transmitting, damaging, deleting, deteriorating, altering or suppressing such data, or by rendering such data inaccessible; Member States must make this a criminal offense, at least for cases which are not minor (Article 4).
• Do not intentionally and without right delete, damage, deteriorate, alter or suppress computer data on an information system, or render such data inaccessible; Member States must make this a criminal offense, at least for cases which are not minor (Article 5).
• Do not intentionally and without right intercept, by technical means, non-public transmissions of computer data to, from or within an information system, including electromagnetic emissions from an information system carrying such data; Member States must make this a criminal offense, at least for cases which are not minor (Article 6).
• Do not, without right and with the intention that it be used to commit an offense under Articles 3 to 6, produce, sell, procure for use, import, distribute or otherwise make available a computer program designed or adapted primarily for committing one of those offenses, or a computer password, access code or similar data by which the whole or any part of an information system can be accessed; Member States must make this a criminal offense, at least for cases which are not minor (Article 7).
• Do not incite, aid or abet an offense under Articles 3 to 7, or attempt one under Articles 4 and 5; Member States must make each of these punishable as a criminal offense (Article 8).
• The offenses reach a legal person as well as an individual: Member States must ensure that a legal person can be held liable where an offense was committed for its benefit by a person with a leading position in it (Article 10(1)), or by a person under its authority because a leading person failed to supervise or control (Article 10(2)).
• Member States must establish jurisdiction over these offenses where one is committed in whole or in part within their territory (Article 12(1), point (a)), and in doing so must ensure that they have jurisdiction where the offender commits it while physically present on their territory, whether or not the offense is against an information system there, and where the offense is against an information system on their territory, whether or not the offender is physically present there (Article 12(2)).

Directive (EU) 2016/943, Arts. 2-5 · Read the law's page

• This Directive is addressed to the Member States (Article 21), which had to bring into force the measures necessary to comply with it by 9 June 2018 (Article 19(1)), so a service meets these rules through national law.
• Do not acquire a trade secret without its holder's consent by unauthorized access to, appropriation of, or copying of documents, objects, materials, substances or electronic files lawfully under the holder's control that contain the trade secret or from which it can be deduced, or by any other conduct which, under the circumstances, is considered contrary to fair dealing in commercial practice (Article 4(2)).
• Do not use or disclose a trade secret without its holder's consent where you acquired it unlawfully, are in breach of a confidentiality agreement or any other duty not to disclose it, or are in breach of a contractual or any other duty to limit its use (Article 4(3)); the same applies where you knew or ought, under the circumstances, to have known that it had come directly or indirectly from a person using or disclosing it unlawfully (Article 4(4)).
• Acquisition of a trade secret by observation, study, disassembly or testing of a product or object that has been made available to the public, or that is lawfully in your possession as acquirer and free from any legally valid duty to limit the acquisition, is lawful (Article 3(1), point (b)), as is acquisition by any other practice which, under the circumstances, is in conformity with fair dealing in commercial practice (Article 3(1), point (d)).
• Information is a trade secret only if it is secret in the sense that it is not, as a body or in the precise configuration and assembly of its components, generally known among or readily accessible to persons within the circles that normally deal with the kind of information in question, has commercial value because it is secret, and has been subject to reasonable steps under the circumstances, by the person lawfully in control of it, to keep it secret (Article 2, point (1)).
• An application for the Directive's remedies must be dismissed where the acquisition, use or disclosure was for exercising freedom of expression and information, for revealing misconduct, wrongdoing or illegal activity where the respondent acted for the purpose of protecting the general public interest, for disclosure by workers to their representatives as part of the legitimate exercise by those representatives of their functions where the disclosure was necessary for that exercise, or for the purpose of protecting a legitimate interest recognized by Union or national law (Article 5).

Directive (EU) 2019/790, Article 4 · Read the law's page

• Before relying on the Article 4 exception, check whether the rightholder has expressly reserved the use in an appropriate manner (Art. 4(3)); for content made publicly available online, recital 18 treats machine-readable means, including metadata and the terms and conditions of a website or service, as the appropriate way to reserve it.
• Skip or license content whose rightholder has expressly reserved the use in an appropriate manner, unless the mining involves no protected reproduction or extraction (recital 9) or another exception covers it, such as Article 3 for research organisations and cultural heritage institutions or Article 5(1) of Directive 2001/29/EC for temporary acts of reproduction.
• Mine only content you access lawfully in the first place

Regulation (EU) 2024/1689, Article 4 · Read the law's page

• Take measures to support the development of AI literacy among your staff and other people who operate or use AI systems on your behalf, if you are a provider or deployer of an AI system, taking into account their technical knowledge, experience, education and training, the context the AI systems are to be used in, and the persons or groups of persons the AI systems are to be used on.Makes itRuns itproviderdeployer
• This duty does not require you to guarantee any specific level of AI literacy for any individual.Makes itRuns itproviderdeployer

Regulation (EU) 2023/2854, Art. 43 · Read the law's page

• This Regulation is binding in its entirety and directly applicable in all Member States, and applies from 12 September 2025 (Article 50).
• Treat data obtained from or generated by a connected product or related service within the scope of the Regulation, in particular in relation to Articles 4 and 5, as outside the sui generis right of Article 7 of Directive 96/9/EC, which does not apply to such data (Article 43).

Regulation (EU) 2024/1689, Article 4a · Read the law's page

• If you are a provider of a high-risk AI system, you may exceptionally process special categories of personal data to the extent strictly necessary to detect and correct bias under Article 10(2), points (f) and (g), provided all six conditions of Article 4a(1) are met: the bias cannot be effectively addressed with other data, including synthetic or anonymised data; the data is subject to technical re-use limits and state-of-the-art security, including pseudonymisation; the data is secured with strict access controls and documented access; the data is not transmitted, transferred, or otherwise accessed by other parties; the data is deleted once the bias is corrected or its own retention period ends, whichever comes first; and your records of processing activities under the GDPR, the EU institutions data protection regulation, or the law enforcement directive state why the processing was strictly necessary and why other data could not achieve the same result.Makes itprovider
• If you are a provider or deployer of any other AI system or model, or a deployer of a high-risk AI system, you may exceptionally process special categories of personal data under the same conditions, but only to the extent strictly necessary to detect and correct bias likely to affect health and safety, have a negative impact on fundamental rights, or lead to discrimination prohibited under Union law. This paragraph creates no obligation to conduct such bias detection and correction.Makes itRuns itproviderdeployer

Regulation (EU) 2024/1689, Article 59 · Read the law's page

• If you take part in an AI regulatory sandbox, you may process personal data lawfully collected for other purposes solely for the purpose of developing, training and testing certain AI systems in the sandbox, when all of the following conditions are met (Article 59(1)).Makes itprovider
• The AI systems are developed for safeguarding substantial public interest, by a public authority or another natural or legal person, in one or more of these areas: public safety and public health, a high level of protection and improvement of the quality of the environment, energy sustainability, safety and resilience of transport systems and mobility, critical infrastructure and networks, and efficiency and quality of public administration and public services (Article 59(1), point (a)).Makes itprovider
• The data processed are necessary for complying with one or more of the requirements referred to in Chapter III, Section 2, where those requirements cannot effectively be fulfilled by processing anonymised, synthetic or other non-personal data (Article 59(1), point (b)).Makes itprovider
• There are effective monitoring mechanisms to identify whether any high risks to the rights and freedoms of the data subjects, as referred to in Article 35 of Regulation (EU) 2016/679 and Article 39 of Regulation (EU) 2018/1725, may arise during the sandbox experimentation, as well as response mechanisms to promptly mitigate those risks and, where necessary, stop the processing (Article 59(1), point (c)).Makes itprovider
• Any personal data to be processed are in a functionally separate, isolated and protected data processing environment under the control of the prospective provider, and only authorised persons have access to them; the provider can further share the originally collected data only in accordance with Union data protection law, and personal data created in the sandbox cannot be shared outside the sandbox (Article 59(1), points (d) and (e)).Makes itprovider
• The processing of personal data in the sandbox neither leads to measures or decisions affecting the data subjects nor affects the application of their rights laid down in Union law on the protection of personal data (Article 59(1), point (f)).Makes itprovider
• The personal data processed in the sandbox are protected by appropriate technical and organisational measures and deleted once participation in the sandbox has terminated or the personal data has reached the end of its retention period, and the logs of the processing are kept for the duration of the participation in the sandbox, unless provided otherwise by Union or national law (Article 59(1), points (g) and (h)).Makes itprovider
• A complete and detailed description of the process and rationale behind the training, testing and validation of the AI system is kept together with the testing results as part of the technical documentation referred to in Annex IV (Article 59(1), point (i)).Makes itprovider
• A short summary of the AI project developed in the sandbox, its objectives and expected results is published on the website of the competent authorities; this obligation does not cover sensitive operational data in relation to the activities of law enforcement, border control, immigration or asylum authorities (Article 59(1), point (j)).Makes itprovider
• For the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against and preventing threats to public security, under the control and responsibility of law enforcement authorities, the processing of personal data in an AI regulatory sandbox is based on a specific Union or national law and subject to the same cumulative conditions (Article 59(2)).for a public body
• This permission applies from 2 August 2026, the Regulation's general application date: Article 113, as amended by Regulation (EU) 2026/1744, gives Chapter VI, which holds Article 59, no date of its own. For a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation (Article 2(2), as replaced by Regulation (EU) 2026/1744).
• This permission is without prejudice to Union or national law which excludes processing of personal data for other purposes than those explicitly mentioned in that law, and to Union or national law laying down the basis for the processing of personal data necessary for developing, testing or training innovative AI systems or any other legal basis, in compliance with Union law on the protection of personal data (Article 59(3)).

Regulation (EU) 2024/1689, Article 75 and Articles 75a to 75d · Read the law's page

• If you are a provider of a high-risk AI system that is subject to the competence of the AI Office under Article 75(1), report any serious incident to the AI Office, not to a national market surveillance authority, applying Article 73(2) to (9) mutatis mutandis.Makes itprovider
• If the AI Office has competence over your AI system under Article 75(1) and asks for information by decision, comply with the request within the period it sets. A simple request carries no obligation to answer, but a voluntary reply must be correct and not misleading.Makes itRuns itproviderdeployer
• Submit to an investigation and to a remote or on-site inspection ordered by the AI Office. In an on-site inspection, allow its officials to enter your business premises, land or property in the Union, to examine and copy your books, data and other material relevant to their tasks, to ask you or your staff for oral or written explanations and to seal premises and books or records for the duration of the inspection, and provide correct and complete answers.Makes itRuns itproviderdeployer
• If the AI Office orders it, provide access to, and explanations relating to, your AI systems, and retain all data and documents the AI Office deems necessary to assess the implementation of and compliance with the obligations under the Regulation.Makes itRuns itproviderdeployer
• You may offer commitments to ensure compliance during proceedings under Article 75a(2). If the AI Office makes them binding by decision, comply with them.Makes itRuns itproviderdeployer
• If the AI Office adopts a decision establishing non-compliance, take the necessary measures to ensure compliance within the reasonable period specified in the decision, provide information on the measures you intend to take, and describe the measures you have taken to the AI Office upon their implementation.Makes itRuns itproviderdeployer
• If you applied to the Commission for a third-party conformity assessment of a high-risk AI system within the AI Office's competence, pay the costs of the services the Commission entrusts to notified bodies directly to the notified body.Makes itprovider

Directive (EU) 2024/2853 · Read the law's page

• The Directive does not apply to free and open-source software that you develop or supply outside the course of a commercial activity (Art. 2(2)).
• If you develop or produce software, or have it developed under your name or trademark, and make it available in the course of a commercial activity, you answer as its manufacturer for damage it causes by a defect (Arts. 4(1), 4(10) and 8(1)(a)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control; a defect caused by their absence, or by software, updates or upgrades within your control, is not excused because it arose after you placed the product on the market (Art. 11(2)(b) and (c)).
• Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in deciding whether it is defective (Art. 7(2)(f)), and failing a mandatory product safety requirement that protects against the damage suffered presumes it defective (Art. 10(2)(b)).
• Account for what your product learns or acquires after release: the effect of any ability to continue to learn or acquire new features after it is placed on the market is weighed in deciding whether it is defective (Art. 7(2)(c)).
• Keep technical documentation you could produce if a court orders disclosure; failing to disclose presumes the product defective (Arts. 9(1), 10(2)(a)).
• If you are outside the EU, the importer or your authorized representative answers for the product in your place (Art. 8(1)(c)).
• If you substantially modify a product outside its manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 8(2)).
• Do not count on a contract term to limit or exclude your liability to an injured person; Article 15 bars it.
• Be able to show when you placed the product on the market or put it into service: you are not liable if you prove you did not, or that the defect probably did not exist at that time (Art. 11(1)(a) and (c)).

Regulation (EU) 2024/1689, Article 10 · Read the law's page

• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
• If you are the provider of a high-risk AI system that uses techniques involving the training of AI models, develop it on training, validation and testing data sets that meet the criteria below, whenever you use such data sets.Makes itprovider
• Apply data governance and management practices appropriate to the system's intended purpose, covering your design choices; how you collected the data and, for personal data, why you originally collected it; your data-preparation operations, such as annotation, labelling, cleaning, updating, enrichment and aggregation; the assumptions you made about what the data measures and represents; an assessment of whether the data sets you need are available, sufficient in quantity, and suitable; examination of the data for biases likely to affect health and safety, harm fundamental rights, or lead to discrimination prohibited under Union law, especially where one operation's data outputs become a later operation's inputs; and measures to detect, prevent and mitigate any bias you find.Makes itprovider
• Identify any data gaps or shortcomings that would prevent the system from complying with the Regulation, and say how you will address them.Makes itprovider
• Make your training, validation and testing data sets relevant, sufficiently representative, and as free of errors and as complete as possible for the intended purpose, with statistical properties appropriate to the persons or groups the system is intended to be used on, and take into account the specific geographic, contextual, behavioural or functional setting the system is intended to be used in, to the extent your intended purpose requires it.Makes itprovider
• If your high-risk AI system does not use training techniques, these criteria apply only to its testing data set.Makes itprovider

Regulation (EU) 2024/1689, Article 25 · Read the law's page

• If you are a distributor, importer, deployer, or other third party who puts your name or trademark on a high-risk AI system already on the market, makes a substantial modification to one that keeps it high-risk, or changes an AI system's intended purpose so it becomes high-risk, you are treated as its provider and take on the Article 16 provider obligations.
• If you are the initial provider and one of those events happens, closely cooperate with the new provider: make available technical documentation sufficient to assess compliance with Article 16, inform them of known limitations and failure modes, and give them targeted technical access, including for testing and validation, unless you clearly specified that your system was not to be changed into a high-risk one.Makes itprovider
• If you are a product manufacturer and a high-risk AI system is a safety component placed on the market or put into service under your name or trademark, you are treated as its provider.Makes itproduct manufacturer
• If you are the provider of a high-risk AI system, or a third party supplying an AI system, AI model, tool, service, component, or process it integrates, specify by written agreement the necessary information, capabilities, technical access, and other assistance needed for the provider to comply with this Regulation, unless the third party makes the tool, service, process or component available to the public under a free and open-source licence; that exception never covers a general-purpose AI model.
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.