Where Training Text Comes From

1. A deadline, and what arrived before it

Article 53(1)(d) of Regulation (EU) 2024/1689 requires a provider of a general-purpose AI model to publish "a sufficiently detailed summary about the content used for training … according to a template provided by the AI Office". The European Commission published that template on 24 July 2025, and the obligation began to apply on 2 August 2025 to models placed on the market from that date; under Article 111(3), providers of models already on sale have until 2 August 2027.

The power to enforce it arrived a year later, and the statute is precise about the gap. Article 113 provides that Chapter V — the general-purpose-AI chapter, which contains the summary obligation — applies from 2 August 2025 "with the exception of Article 101". Article 101 is headed Fines for providers of general-purpose AI models, and permits the Commission to impose penalties, for intentional or negligent infringement, of up to 3% of worldwide annual turnover or €15 million, whichever is higher. It took effect on the Regulation's general date of application: 2 August 2026.

Publication clusters around the second date rather than the first; nothing in the public record shows that one caused the other.

Europe's is not the only such duty. California's AB 2013, approved on 28 September 2024 as Chapter 817 of that year's statutes and now section 3111 of the state's Civil Code, requires developers of generative AI systems or services released since January 2022 and made available to Californians to post, "on or before January 1, 2026" and before later covered releases, documentation that includes a high-level summary of their training datasets, beginning with "the sources or owners of the datasets". A federal district court refused xAI a preliminary injunction against it on 4 March 2026, and xAI's appeal is before the Ninth Circuit. OpenAI's page under the Californian statute, in an Internet Archive capture of 21 January 2026, is one company-wide document describing "datasets containing trillions of tokens" and naming none of them.

In January 2026 three researchers — Dick Blankvoort and Harshvardhan Pandit of the AI Accountability Lab at Trinity College Dublin, and Maximilian Gahntz — assessed what their paper calls the five public summaries "found through an exhaustive search process". Four came from Hugging Face (for SmolLM3), the Swiss AI Initiative (for Apertus), the Polish open-source collaboration SpeakLeash (for Bielik) and the Israeli image-model company Bria. For the fifth, Microsoft's Phi-4, the authors record that they "did not find an explicitly published summary", but found a document in the model's repository whose structure was similar to the template and which, in their words, "was not explicitly mentioned as a public summary".

The large providers published documents dated between late June and early August 2026: OpenAI's for GPT-5.5 on 26 June (revised on 29 July), Google's for Gemini on 2 July, xAI's for Grok 4.5 on 8 July, Inkling's on 15 July, Anthropic's for Claude Opus 5 and OpenAI's for GPT-5.6 Luna on 23 July, and Meta's for Muse Spark on 4 August. Each provider publishes its summary on its own website. By its own summary's account, GPT-5.5 had been on the Union market since 23 April 2026, two months before the first version of that summary. OpenAI's summary for GPT-6 Astra carries a last-update date of 2 September 2026 and gives 3 September as the model's date of placement — a summary dated before its model's launch rather than after it. The chronology is a matter of record; why each provider published when it did is not visible from outside.

The same team keeps a public tracker. On 1 September 2026 it listed 44 entries — 39 graded and five under evaluation, counting model variants separately and including the Phi-4 file — and 19 further models that the researchers, "based on our preliminary analysis", judge to need a summary and could not find one. Fetched again on 11 September, the page had not changed by a single byte; its server reports a last modification on 31 August, so the GPT-6 Astra summary is not on it. The count records the tracker's own pace, not the providers'.

2. Two misreadings, and what a compelled disclosure contains

Two readings of these summaries are common, and the evidence supports neither. The first is that the public now knows what the models were trained on. The second is its mirror image: that the exercise is theatre, the companies took the internet wholesale, and nobody chose anything. The first fails on the documents themselves. The second fails on six decades of practice: somebody has always chosen what goes into a corpus, and what has changed is how much of the choosing is done by rules.

The template is a form with tick-boxes. Its largest volume option for text is "More than 10 trillion tokens", which is open-ended: it is ticked by OpenAI, Anthropic, xAI and by a 70-billion-parameter academic model alike, so across that range the tick-box alone distinguishes nothing.

One field asks for a "Summary of the most relevant domain names crawled". Six summaries answer it as follows.

The first two answers are near-identical in content and in order. Two documents from competing companies converge on the same categories in the same sequence; how that came about is not visible from outside. OpenAI's GPT-6 Astra summary of 2 September repeats the same list.

Where the same form asks for a list of large publicly available datasets, OpenAI's entire answer for GPT-5.5 is one sentence:

The training data for GPT-5.5 includes text from Common Crawl.

That is the whole of that field. Elsewhere on the same page the summary adds an exclusion rule:

OpenAI also uses the U.S. Trade Representative (USTR) Notorious Markets for Counterfeiting and Piracy list as a signal when deciding to exclude data from certain websites that have been recognized as persistently and repeatedly infringing copyright.

A list compiled for trade policy — naming marketplaces for counterfeit goods and pirated content — now serves as one input to what a language model is trained on. The summary does not say which edition of the list is used; what it records is the use, not the list.

3. The idea: a corpus is a built object

Much of what a deployed model appears to know at the moment it answers is text that ordinary software has placed in front of it: search results, files, earlier turns of a conversation. Beneath that run-time selection sits an older and far larger one — the text the model was trained on. Even the vocabulary through which a model reads is learned by counting over a large body of text, so whose text was in that body helps decide which languages are cheap to write in. A training corpus is not a natural object that happened to be lying around. It is built, and its builders' choices are recorded, when they are recorded at all, in documents like those above.

A corpus is a body of text collected on purpose. A classic early example is the Brown Corpus: 1,014,312 words of edited American prose, all of it printed in the calendar year 1961, divided into 500 samples of roughly two thousand words each.

Somebody had to decide what a million words of English is. The manual that accompanies the corpus, by W. Nelson Francis and Henry Kučera — first issued in 1964; the text available online is its 1979 revision — records who and how: the list of categories "was drawn up at a conference held at Brown University in February 1963", attended by John B. Carroll, W. Nelson Francis, Philip B. Gove, Henry Kučera, Patricia O'Connor and Randolph Quirk. The manual then says what those six people did:

These figures were averaged to obtain the preliminary set of figures used.

Six opinions, averaged, set the preliminary shares of newspaper reportage, fiction, religious writing and the rest; the manual adds that a few changes were later made on the basis of experience, and that finer subdivision followed the proportions actually published in 1961. Verse was excluded as a sampling category on the ground that it "presents special linguistic problems"; drama was excluded as "the imaginative recreation of spoken discourse"; fiction was admitted, but no sample could be more than half dialogue. Some of the hobby and popular-lore material was chosen from "one of the largest second-hand magazine stores in New York City". Only after all of that did randomness enter: within each category, samples were drawn chiefly using a table of random numbers, and the starting page was drawn the same way.

The manual's account of permission is a single sentence:

For all copyrighted material used, the permission of the copyright holder has been obtained.

It continues that the details of copyright permission appear in the listing of the samples, on pages 33 to 176. Each sample's entry in the manual includes a "Copyright statement" field. The permissions carried conditions: the manual tells commercial publishers and other non-academic organisations that public use of the corpus requires permission from Brown's linguistics department, which may ask them to obtain written permission from the individual copyright holders. Sample A07 of the corpus is the New York Times.

4. What replaces asking

A million words can be cleared by hand. Ten trillion tokens cannot be cleared that way: at that size permission is not sought item by item, and no one could read the result. At this scale, rules select much of the text, though builders still choose datasets and, in some cases, buy or license material.

Permission at scale is expensive rather than impossible. The Common Pile v0.1, released on 5 June 2025, is an eight-terabyte collection of public-domain and openly licensed text drawn from 30 sources; its authors trained two 7-billion-parameter models on one and two trillion tokens of it and report performance competitive with models of similar computational budget trained on unlicensed text. Whether a collection of that kind can support a frontier model has not been shown.

The published descriptions specify the rules. In February 2019 OpenAI described the selection rule for GPT-2's corpus:

we scraped all outbound links from Reddit, a social media platform, which received at least 3 karma

The rule selects the page a link points to, not the discussion around it; karma is, roughly, upvotes minus downvotes. Its authors immediately qualify what the signal measures:

This can be thought of as a heuristic indicator for whether other users found the link interesting, educational, or just funny

That corpus comprised 45 million links, reduced after deduplication and cleaning to "slightly over 8 million documents for a total of 40 GB of text". It excluded links created after December 2017, and the authors say they removed all Wikipedia articles to avoid overlap with their own evaluations.

Eight months later a Google team published the Colossal Clean Crawled Corpus, known as C4, built from the April 2019 Common Crawl snapshot under six cleaning rules and a language filter: retain only lines ending in a period, exclamation mark, question mark or end quotation mark; discard any page containing a term from the published "List of Dirty, Naughty, Obscene or Otherwise Bad Words"; drop any line containing the word Javascript; drop any page containing the phrase "lorem ipsum"; keep one copy of any three-sentence span that occurs more than once; and

Since the curly bracket “{” appears in many programming languages (such as Javascript, widely used on the web) but not in natural text, we removed any pages that contained a curly bracket.

Pages not classified as English with a probability of at least 0.99 were dropped as well. Later revisions of the same paper, in July 2020 and September 2023, list seven and then nine rules, and swap two thresholds between them — pages of fewer than five sentences and lines of fewer than three words in one, fewer than three sentences and five words in the other. The written description of the rules is itself a versioned document.

5. What the rules did

Independent audits can measure effects that a builder's own description leaves unquantified. In April 2021 a team at the Allen Institute for AI and the University of Washington — Jesse Dodge, Maarten Sap, Ana Marasović, William Agnew, Gabriel Ilharco, Dirk Groeneveld and Matt Gardner — documented C4, eighteen months after its publication, and released three versions of it: language-identified but otherwise unfiltered, filtered without the bad-words list, and fully filtered.

One published list of words removed about a fifth of the tokens that reached it — about 7.6% of the documents, which fell from 395 million to 365 million. It did not remove them evenly.

By the same audit's count, 97.8% of documents in the fully filtered corpus were assigned the white-aligned category, against 0.07% African American English.

The audit turned up a second surprise: the single most represented website in the cleaned corpus is patents.google.com, a substantial fraction of it machine-translated or produced by optical character recognition. The second is English Wikipedia.

Three months later a team led by Katherine Lee and Daphne Ippolito, with Nicholas Carlini among the co-authors, went looking for repetition. Lee was also one of C4's own authors, so this check came partly from inside. They found a single 61-word English passage occurring in the corpus 61,036 times verbatim in the training data and 61 times in the validation set. Their footnote prints it. It ends:

believe me, brilliant ideas would be perfect if it can be applied in real and make the people around you amazed!

It reads like filler from a wedding website. C4's published recipe included a rule keeping a single copy of any three-sentence span that recurs; the passage is in the released corpus 61,036 times regardless. By the authors' count those copies are 0.02% of the samples in each split, and because some sit in the validation set they create the overlap between training and evaluation data that, the authors warn, leads researchers to over-estimate accuracy.

6. Deduplication, and what it does not do

The remedy that paper proposed was far stricter deduplication — exact matching of long repeated substrings and approximate matching of near-identical documents — and its measured benefits are real: in the authors' experiments, models trained on deduplicated data "emit memorized text ten times less frequently" during unprompted generation, need fewer training steps for the same accuracy, and show no worse perplexity. The authors add that it can "reduce train-test overlap, which affects over 4% of the validation set of standard datasets".

It does not eliminate memorisation. An overlapping group of authors wrote seven months later:

However, we find that memorization does still happen, even with just a few duplicates—thus, deduplication will not perfectly prevent leakage.

In the model families that 2022 work tested, larger models and more heavily duplicated examples yielded more extractable training text, and longer prompts exposed more of what a fixed model had memorised; the authors describe existing extraction measurements as lower bounds.

A further result points the opposite way from the intuition that more deduplication is always better. When Hugging Face built FineWeb in 2024, applying deduplication globally across 96 Common Crawl snapshots removed as much as 90% of the base data from the oldest snapshots — and the models trained on what remained showed little improvement over models trained on data that had not been deduplicated at all. The team then compared the 10% retained from an old snapshot with a separately deduplicated slice of the 90% it had discarded: models trained on the discarded material did better, and inspection found more advertisements, keyword lists and badly formatted text in what had been kept. In their words, the result "challenged our initial assumption that global deduplication would inevitably result in higher benchmark scores."

"Deduplication" bundles three separate choices: what counts as a match (an exact passage or a near-identical document), where the search runs (within one crawl or across many), and which copy is kept. C4's three-sentence rule, the 2021 paper's exact-substring and near-duplicate matching and FineWeb's cross-snapshot procedure make different choices on each, and a result about one is not a result about the others.

7. Two fights, running in parallel

Through 2026 the question of training data has been contested in two venues that ask different things.

A courtroom asks whether the material could lawfully be used. In Bartz v. Anthropic PBC (N.D. Cal., 3:24-cv-05417), Judge Araceli Martínez-Olguín granted final approval on 20 July 2026 to a non-reversionary settlement fund of $1.5 billion, covering 482,460 works, with an estimated per-work payment of approximately $3,000 before costs and fees — which the order describes as "four times the minimum statutory damages amount for willful infringement". Three documents in that case are routinely conflated, and they establish different things:

The certified class covers owners of reproduction rights in books on the Works List — books "in the versions of LibGen or PiLiMi downloaded by Anthropic" that meet the order's ISBN, ASIN and copyright-registration criteria. The order records, without adopting it as a finding, the company's statement that neither of the named shadow-library datasets, nor any portion of them, was in the training corpus of any of its commercially released models.

The argument continues in other cases. On 1 September 2026 the United States government filed a statement of interest in the consolidated copyright cases against OpenAI in New York, arguing that training AI models on copyrighted material, "in and of itself", does not violate copyright law. It states the government's legal position, not a court's ruling.

A regulator asks whether the public will be told what the material was. The answers to its disclosure form diverge sharply.

The retroactive removal has no counterpart in the other summaries: data from sites that, as of January 2025, had opted out of at least one common AI crawler was removed from crawls reaching back to 2013.

The comparison flatters neither side. The Swiss summary answers No to crawlers of its own, No to commercial licensing agreements, No to both user-data questions, No to synthetic data created by or for it and No to other sources. The likelier reading is that the corpus can be enumerated because it is built from things that were already public lists. No frontier provider has published an inventory of comparable detail.

That the frontier does not disclose is itself long documented and dated. OpenAI's GPT-4 technical report of 15 March 2023 states that "this report contains no further details about the architecture (including model size), hardware, training compute, dataset construction, training method, or similar", citing competitive and safety considerations. Google's Gemini 3 Pro model card names six classes of source and several processing techniques, including honouring robots.txt, without an inventory or a proportion. And an independent index of developer transparency, published in late 2025 by researchers at Stanford, Berkeley, Princeton and MIT, reported an average score of 40.69 out of 100 in its 2025 edition against 58 in 2024 — across company sets that differ between editions — with training data and training compute the areas of greatest opacity.

8. What is checkable, and when

The public tracker, crawler instructions and disclosure revisions are dated records against which later changes can be checked.

The tracker. Forty-four entries on 1 September 2026, against five summaries found by 12 January; nineteen models the same researchers judge to need a summary and for which they could not find one. On 11 September the page was byte-for-byte unchanged and did not list OpenAI's GPT-6 Astra summary of 2 September. Its next revision will show whether it has been added.

Two robots files. The text file a site uses to tell crawlers where not to go is the nearest thing to a dated public record of what a site asks of them, though what it says can depend on who asks. The version Reddit served on 11 September to ordinary requests from one machine is 538 bytes and ends with a wildcard and Disallow: /, above which its comments point to a content policy. Requests from the same machine presenting the user-agent strings of Google's and OpenAI's crawlers were refused outright, so these tests do not establish what a genuine crawler receives. The New York Times' file has grown differently.

Of those sixty-nine entries, sixty are told to stay away entirely, and a sixty-first is excluded from everything but two sections. One of them is CCBot, which means the newspaper that supplied sample A07 of the Brown Corpus — with permission recorded in the manual — now asks the crawler whose archive underpins C4, FineWeb and, by OpenAI's own summary, GPT-5.5 to stay away. The file is a request about future crawling, not a lock: it binds only crawlers that choose to obey it and removes nothing already collected.

Two copies of the same disclosure. OpenAI's public summary for GPT-5.5 is reachable at two addresses on the company's own content-delivery network, with different text and the same version label:

Both files were byte-identical on 11 September to the copies fetched on 1 September. Compared sentence by sentence, the July text adds a statement that its disclosures on the types and quantities of training data apply to GPT-5.5 "and all subsequent releases in the model lifecycle", and drops a sentence about reducing the amount of personal data in training data that is largely duplicated elsewhere in the document. A copy of the June text, byte-identical to the one still online, sits in the university research group's archive under the date 14 July 2026, fifteen days before the revision's own date — independent evidence of the order in which the two appeared. Why the text changed, and whether the timing relative to the enforcement date signifies anything, is not visible from outside. What is visible is a legally mandated public record of what a model read, revised without a version increment.

9. Four questions of provenance

Provenance concerns where material came from, when it was collected, what was done to it and what permission was recorded — and who was responsible at each step.

For the Brown Corpus's million words, the manual records permission sample by sample. In 2026, for more than ten trillion tokens, the nearest thing to a list of websites in any of six compelled summaries is: dot com, dot org, dot net.

The change is not that nobody chooses. Six people averaging opinions in a room in 1963, a karma score of three on a message board in 2019, a punctuation mark, a curly bracket, a trade-policy list in 2026 — each is a decision, made by somebody, about what a machine would read. What changed is how much of the choosing is done by rules that operate on more text than anyone will ever read.

Choosing a rule is not the same as knowing its result. The fifth of the tokens that one word list removed, and the rates — 42% of documents classified as African American English against 6.2% of those classified white-aligned — at which it removed them, were measured eighteen months after C4 was published, by a team that had not built it. The wedding passage present 61,036 times was found later still, by a team that included one of the corpus's own authors. People chose the sources and the rules; the resulting collection still had to be checked.

10. Common readings the record does not support

Disclosure: the system that produced this text was built by one of the companies whose summary is examined above.

Next lesson — Day 8: Why Scale Worked

11. Sources