---
title: "Data for AI: data spaces and licensing data for training"
description: "Where AI developers can lawfully get training data in the EU, what the law says about common European data spaces, and how the Data Act, the AI Act's data…"
url: https://pitch.law/academy/data-for-ai-data-spaces-and-licensing-training-data
---

[pitch](https://pitch.law/) [Academy](https://pitch.law/academy) [AI](https://pitch.law/academy/topics/legal-aspects-of-artificial-intelligence)

# Data for AI: data spaces and licensing data for training

Where AI developers can lawfully get training data in the EU, what the law says about common European data spaces, and how the Data Act, the AI Act's data rules and the text and data mining exceptions shape a training-data licence.

- - By [Bart Lieben](https://pitch.law/team/bart-lieben), Attorney-at-Law
  - 13 November 2026

- Updated

  13-11-2026

## The legal framework

There is no single EU law on training data. Four texts do the work together:

- the Data Governance Act, [Regulation (EU) 2022/868](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R0868), applying since 24 September 2023;
- the Data Act, [Regulation (EU) 2023/2854](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854), applying since 12 September 2025;
- the AI Act, [Regulation (EU) 2024/1689](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689), as amended by [Regulation (EU) 2026/1744](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202601744) (consolidated text of 27 July 2026);
- the Copyright in the Digital Single Market Directive, [Directive (EU) 2019/790](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L0790), to be transposed by 7 June 2021.

The GDPR sits on top of all four whenever training data relates to people.

### Common European data spaces: what the texts actually say

"Data spaces" are often presented as a new legal regime. The binding texts are more modest. The DGA describes common European data spaces as "purpose- or sector-specific or cross-sectoral interoperable frameworks of common standards and practices to share or jointly process data", for example to develop new products and services or for scientific research. Its main operative provision on them is that the European Data Innovation Board proposes guidelines on standards, lock-in, safe transfers, stakeholder representation and cybersecurity ([Article 30(h)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_30)).

The Data Act goes further. Under [Article 33](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_33), participants in data spaces that offer data or data services to other participants must:

- describe the dataset content, use restrictions, licences, collection methodology, data quality and uncertainty, where applicable in machine-readable form;
- describe data structures, formats, vocabularies and code lists in a public and consistent way;
- describe the technical means of access, such as APIs, with their terms of use and quality of service;
- where applicable, provide the means for smart contracts and similar tools to interoperate.

Meeting harmonised standards or Commission common specifications gives a presumption of conformity (Article 33(3) and (8)), and the Commission may adopt guidelines based on the Board's proposal (Article 33(11)). Sector laws can create a specific data space: the [European Health Data Space](https://pitch.law/academy/european-health-data-space-secondary-use-and-data-permits) is one example.

For AI teams this matters in a practical way. The information Article 33 requires (licence, use restrictions, collection method, quality) is exactly what you need to know before you train on a dataset.

You may also come across "Data Labs" in policy discussions. None of the legal texts covered here (the DGA, the Data Act, the AI Act or the Copyright Directive) creates or regulates them, so we do not treat them as a legal instrument.

### Routes to training data

**Licensing.** Most training data comes in under a contract. The law adds limits to what that contract can do (below).

**Intermediaries and data altruism.** A data marketplace or pool open to all comers is a data intermediation service under the DGA. It must stay neutral: it may not use the data itself except to make it available, and it may not tie its prices to other services ([Article 12](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_12)). Recognised data altruism organisations collect data for general-interest objectives such as scientific research; they must tell people in advance for which objectives they let data users process it, and may not use it for anything else ([Article 21](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_21)). See [our article on the DGA](https://pitch.law/academy/data-governance-act-data-intermediaries-and-data-altruism).

**Public-sector data.** Open data, high-value datasets and protected public data each have their own rules, covered in [re-using public-sector data](https://pitch.law/academy/re-using-public-sector-data-open-data-and-high-value-datasets).

**Connected-product data.** The Data Act sets hard limits here. A data holder may use readily available non-personal product data only on the basis of a contract with the user ([Article 4(13)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_4)), and may not pass non-personal product data to third parties except to fulfil that contract (Article 4(14)). A third party that receives data at the user's request may process it only for the purposes agreed with the user, may not hand it to a gatekeeper, and may not use it to develop a product that competes with the connected product it came from ([Article 6](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_6)).

### Copyright: the text and data mining exceptions

Training on protected works usually involves reproduction. [Article 3](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019L0790#art_3) of the Copyright Directive allows research organisations and cultural heritage institutions to mine lawfully accessible works for scientific research; a contract cannot override that ([Article 7(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019L0790#art_7)). [Article 4](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019L0790#art_4) allows anyone, including for commercial purposes, to mine lawfully accessible works, unless the rightholder has expressly reserved that use in an appropriate manner, such as machine-readable means for online content (Article 4(3)). Both exceptions also cover the database maker's right. Whether and how they cover model training is still being argued; we discuss that in [AI and intellectual property](https://pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure).

Providers of general-purpose AI models must, since 2 August 2025, have a policy to identify and respect those reservations and publish a summary of their training content ([Article 53(1)(c) and (d)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727#art_53)). Our article on general-purpose AI codes of practice, guidelines and standards in this series covers how those duties are worked out.

### AI Act Article 10: data governance for high-risk systems

[Article 10](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727#art_10) ("Data and data governance") applies to high-risk AI systems. Systems that train models must be developed on training, validation and testing data sets that meet its quality criteria (Article 10(1)). The data governance practices must cover in particular (Article 10(2)):

- design choices, data collection processes and the origin of data, and for personal data the original purpose of collection;
- preparation steps such as annotation, labelling, cleaning, enrichment and aggregation;
- the assumptions about what the data measures, and whether enough suitable data is available;
- examination of likely biases and measures to detect, prevent and mitigate them;
- data gaps or shortcomings that prevent compliance, and how to address them.

Data sets must be relevant, sufficiently representative and, to the best extent possible, free of errors and complete for the intended purpose (Article 10(3)), and reflect the setting in which the system will be used (Article 10(4)). Systems that do not train models need meet these rules only for testing data (Article 10(6)).

Regulation 2026/1744 deleted the former Article 10(5) and moved the rule on special categories of personal data into a new [Article 4a](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727#art_4a). Providers of high-risk systems may process such data, where strictly necessary for bias detection and correction, only if other data (including synthetic or anonymised data) will not do, with strict access controls, no transfer to other parties, deletion once the bias is corrected, and a record of why it was necessary.

Under [Article 113](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727#art_113), Article 10 applies from 2 December 2027 for high-risk systems under Annex III and from 2 August 2028 for those under Annex I.

## In practice

A Belgian start-up is building a CV-screening tool. Recruitment systems are listed in Annex III, so Article 10 will apply. It plans to license a dataset of anonymised applications from a staffing group. Its licence asks for the information Article 10(2) needs: where the data came from, the original purpose of collection, how it was labelled and by whom, and known gaps in representativeness. It also asks for a warranty that the licensor had the right to share, and for cooperation if a regulator asks questions later.

A manufacturer of industrial compressors wants to train a predictive-maintenance model on operating data from customers' machines. Under Article 4(13) of the Data Act it needs a contract with each user that allows it to use the non-personal data, so it updates its customer terms. A maintenance firm that receives the same data at a customer's request may use it only as agreed with that customer and may not build a rival compressor with it.

A Flemish publisher is approached by an AI developer that wants its archive. Because the publisher has a machine-readable reservation on its website, the Article 4 exception is not available for its online content, and the developer needs a licence. The licence defines training, fine-tuning and retrieval separately, sets output restrictions and asks for deletion on termination.

A data provider joining an industry data space prepares the dataset descriptions Article 33 requires. The same descriptions double as the schedule to its licence.

**Training-data licence checklist:**

1. Scope: training, fine-tuning, evaluation, retrieval; which models; whether derived models survive termination.
2. Provenance and rights warranties, including copyright reservations and database rights.
3. Article 10 documentation: origin, collection purpose, preparation, known biases and gaps.
4. Personal data: role of each party, legal basis, and whether anything falls under Article 4a.
5. Data Act limits where connected-product data is involved.
6. Confidentiality, audit, deletion and cooperation with regulators.

## Frequently asked questions

### Is a data space a legal entity we sign up to?

Not under the general texts. They describe a framework of common standards and practices. Your rights and duties come from the participation terms, the licences and the laws discussed above. Sector laws can add more.

### Can we train on data bought through a data marketplace?

Yes, if your licence allows it. The marketplace itself may not use the data for its own purposes (DGA Article 12(a)), but that limit does not apply to you as the data user.

### Does Article 10 apply to our AI system now?

Only to high-risk systems, and only from 2 December 2027 (Annex III) or 2 August 2028 (Annex I). Data you collect now will be used then, so document its origin today.

### Can our licence override the text and data mining exceptions?

Contract terms cannot override the research exception in Article 3 (Article 7(1)). The general exception in Article 4 depends on whether the rightholder reserved its rights, which a licence can address.

## How this connects

A training-data deal is a licence with an AI Act file attached. Our [data licensing and sharing](https://pitch.law/solutions/data-licensing-sharing) work covers the licence, and [AI Act compliance](https://pitch.law/solutions/ai-act-compliance) covers classification and the Article 10 duties. We draft licences in our [Document Studio](https://pitch.law/technologies/contract-studio), and our [AI Act register](https://pitch.law/technologies/ai-act-governance-toolkit) records each AI system with its classification and the duties that follow for your role.

### At a glance

**Provisions cited**

- Regulation (EU) 2022/868: Articles 12, 21 and 30
- Regulation (EU) 2023/2854: Articles 4, 6 and 33
- Regulation (EU) 2024/1689 as amended: Articles 4a, 10, 53 and 113, Annexes I and III
- Directive (EU) 2019/790: Articles 3, 4 and 7

**Key dates**

- 07-06-2021: transposition deadline, Copyright DSM Directive
- 24-09-2023: DGA applies
- 02-08-2025: general-purpose AI model duties apply
- 12-09-2025: Data Act applies
- 02-12-2027: Article 10 for Annex III high-risk systems
- 02-08-2028: Article 10 for Annex I high-risk systems

**In this series**

- [The Data Governance Act: data intermediaries and data altruism](https://pitch.law/academy/data-governance-act-data-intermediaries-and-data-altruism)
- [Re-using public-sector data: open data and high-value datasets](https://pitch.law/academy/re-using-public-sector-data-open-data-and-high-value-datasets)
- [General-purpose AI: codes of practice, guidelines and standards](https://pitch.law/academy/general-purpose-ai-codes-guidelines-standards)

**Related reading**

- [AI and intellectual property: training data and copyright](https://pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure)
- [The EU Data Act](https://pitch.law/academy/eu-data-act)

## In short

- What the legal texts say about common European data spaces
- Data Act limits on training with connected-product data
- Article 10 AI Act data governance, as amended in 2026
- Text and data mining exceptions and the opt-out
- A checklist for training-data licences

## Related solutions

- [Solutions](https://pitch.law/solutions/data-licensing-sharing)
  ### [Data Licensing and Data Sharing](https://pitch.law/solutions/data-licensing-sharing)
  [Share or license data without giving away more than you meant to. Clear scope, settled ownership of what is derived from it, and the GDPR layer built in.](https://pitch.law/solutions/data-licensing-sharing)
- [Solutions](https://pitch.law/solutions/ai-act-compliance)
  ### [AI Act Compliance](https://pitch.law/solutions/ai-act-compliance)
  [We help you find out which of your AI systems fall under the EU AI Act, in what role, and what you must have in place and by when.](https://pitch.law/solutions/ai-act-compliance)

## Our proprietary Legal Tech

- [Technology](https://pitch.law/technologies/contract-studio)
  ### [Document Studio](https://pitch.law/technologies/contract-studio)
  [Our Document Studio drafts and analyses legal documents in a secure, on-premise environment, and keeps the documents behind your matters up to date as new data comes in and procedural steps fall due.](https://pitch.law/technologies/contract-studio)
- [Technology](https://pitch.law/technologies/ai-act-governance-toolkit)
  ### [AI Act Register and Assessments](https://pitch.law/technologies/ai-act-governance-toolkit)
  [One register where your AI systems are listed, classified and followed per role, with assessments, incident records and an AI Act timeline, all checked by an attorney.](https://pitch.law/technologies/ai-act-governance-toolkit)

## More in AI

- ### [EU AI Act Timeline: Every Date from 2024 to 2030](https://pitch.law/academy/ai-act-compliance-timeline)
  [The AI Act applies in stages from 2 February 2025 to 31 December 2030. Every date, what applies and who it affects, with the 2026 high-risk postponement.](https://pitch.law/academy/ai-act-compliance-timeline)
- ### [AI Act Meets GDPR: Where the Two Frameworks Overlap](https://pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap)
  [How the AI Act and the GDPR apply side by side to the same AI system: roles, impact assessments, automated decisions, transparency, data quality and special categories.](https://pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap)
- ### [AI Act Risk Classification: the Four Risk Levels](https://pitch.law/academy/ai-act-risk-classification-explained)
  [The AI Act sorts AI into unacceptable (prohibited), high, limited (transparency) and minimal risk. How to tell which level your AI system falls in.](https://pitch.law/academy/ai-act-risk-classification-explained)
- ### [AI Clauses in Vendor Contracts: 9 Terms to Negotiate](https://pitch.law/academy/ai-clauses-in-vendor-contracts)
  [The AI clauses to negotiate when you buy or supply AI: AI Act roles, training on your data, output ownership, IP indemnity, audit and logs, liability.](https://pitch.law/academy/ai-clauses-in-vendor-contracts)
- ### [AI Act in HR and Recruitment: the High-Risk Rules](https://pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act)
  [Recruitment and HR AI is usually high-risk under the AI Act (from 2 December 2027), and emotion recognition at work is banned. What employers must do.](https://pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act)
- ### [AI and Intellectual Property: Training Data and Copyright](https://pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure)
  [How EU copyright law and the AI Act treat training data, rights holders' opt-outs, training summaries, and the protection of AI-generated output and inventions.](https://pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure)

## Let’s talk

Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free.

[Schedule a meeting](https://pitch.law/schedule)