EU’s AI Act Gap: 21 Of 24 AI Giants Hide Scraped Websites In Data Filings

The European Union‘s AI Act now requires general-purpose AI providers to publish training-data summaries, but 21 of 24 published summaries name no specific scraped websites.

Key Takeaways

• The AI Act requires general-purpose AI providers to publish training-data summaries, and the requirement took effect Aug. 2
• Twenty-one of 24 published summaries name no specific scraped websites
• Most reviewed summaries used categories such as “publicly available web data” instead of individual domains
• Henna Virkkunen cited AI agent incidents as a trigger for the bloc’s first enforcement actions under the act

The requirement took effect Aug. 2. The AI Act, described by the European Commission as the first comprehensive legal framework on artificial intelligence according to the European Union, sorts AI systems into risk tiers and bans systems it classifies as unacceptable risk, such as social scoring.

Also Read: VAST Data Lands $1.17B CoreWeave Deal As AI Storage Market Eyes $82B

The training-data summary requirement sits inside the newer general-purpose AI obligations, which apply to companies building large foundation models rather than narrow applications. The gap between the rule’s intent and what companies actually filed turns the EU into the de facto enforcer of disclosure on AI companies that have otherwise resisted naming their data sources in public.

What The Summary Rule Requires

Most of the 24 summaries reviewed used broad categories like “publicly available web data” instead of naming individual domains, leaving the field meant to list scraped sites largely blank across 21 of them.

Enforcement Is Already Moving

Speaking at the International AI Summit in Dublin on Oct. 14, 2026, European Commission Executive Vice-President Henna Virkkunen pointed to AI agent incidents as a trigger for the bloc’s first enforcement actions under the act, a sign regulators are willing to act on gaps the summaries expose rather than treat the template as a paperwork exercise.

The AI Act’s phased rollout means heavier obligations for general-purpose models with systemic risk, and additional compliance deadlines, are still coming.

Whether the Commission treats thin training-data summaries as a violation worth penalizing, or simply as a starting point for tougher future templates, will shape how much AI companies ultimately disclose about what they scraped to build their models.

Read Next: Pika Labs Bets On ChatGPT Plugin To Beat Rivals Without Building Its Own App