Short answer
No. A licence from a dataset supplier is a contract between you and that supplier. It transfers risk; it does not transfer rights the supplier never held.
Four structural reasons:
- A supplier can only license what it owns or is authorised to sublicense. Aggregated web-scraped datasets routinely contain material whose rightholders never dealt with the supplier.
- Several distinct rights can attach to the same data. Copyright in individual works, copyright in the database structure, the sui generis database right, the press publishers' right, and performers' and producers' rights are separate and separately licensable.
- The DSM text-and-data-mining exception is conditional, and one of its conditions — the rightholder's reservation — can be exercised by parties with whom your supplier has no relationship.
- The AI Act imposes a duty on you, not on your supplier. Article 53(1)(c) requires a general-purpose AI model provider to have its own copyright-compliance policy.
Supplier warranties and indemnities remain valuable. They are simply not a substitute for diligence.
The TDM exception and its conditions
Most commercial training in the EU relies on the general text-and-data-mining exception:
"Member States shall provide for an exception or limitation to the rights provided for in Article 5(a) and Article 7(1) of Directive 96/9/EC, Article 2 of Directive 2001/29/EC, Article 4(1)(a) and (b) of Directive 2009/24/EC and Article 15(1) of this Directive for reproductions and extractions of lawfully accessible works and other subject matter for the purposes of text and data mining." —
Note how many rights that single sentence touches: database copyright and the sui generis right, reproduction under InfoSoc, the software reproduction and adaptation rights, and the press publishers' right. That breadth is itself the answer to the question — a supplier licensing "the dataset" is unlikely to control all of them.
Two conditions constrain the exception.
Lawful access. Article 4(1) covers "lawfully accessible" works. Material obtained by circumventing a paywall, breaching access terms or scraping in violation of enforceable restrictions is not lawfully accessible — and the supplier's licence cannot make it so.
No reservation. Article 4(3) is the decisive limb:
"The exception or limitation provided for in paragraph 1 shall apply on condition that the use of works and other subject matter referred to in that paragraph has not been expressly reserved by their rightholders in an appropriate manner, such as machine-readable means in the case of content made publicly available online." —
The reservation belongs to the rightholder, who may have expressed it long after your supplier assembled the dataset, and who has no contract with either of you. A supplier's representation that "no opt-outs apply" is a statement about its own knowledge at a point in time.
The research exception does not travel
Article 3 provides a separate, stronger TDM exception for research organisations and cultural heritage institutions carrying out TDM for scientific research on works to which they have lawful access. Article 7(1) makes contractual provisions contrary to it unenforceable, and Article 3(3) limits rightholders to security measures that go no further than necessary.
Crucially, Article 3 has no opt-out. That is why it is attractive — and why it is misused.
The exception attaches to the entity and the purpose, not to the dataset. A dataset lawfully compiled by a university under Article 3 does not carry that privilege to a commercial developer. Article 2(1) defines research organisations by reference to not-for-profit operation, reinvestment of profits, or a public-interest mission, and expressly excludes bodies over which an undertaking exercising decisive influence enjoys preferential access to results.
Commercial developers acquiring academic datasets should assume Article 4, not Article 3, governs their own use.
The layers a supplier is unlikely to control
Copyright in the underlying works. Held by individual authors and publishers. Aggregation does not consolidate it.
The sui generis database right. Directive 96/9/EC Article 7(1) gives the maker of a database showing substantial investment in obtaining, verifying or presenting the contents the right to prevent extraction or re-utilisation of the whole or a substantial part. Article 7(4) is explicit that it applies irrespective of whether the database or its contents qualify for copyright. Article 7(5) prohibits repeated and systematic extraction of insubstantial parts conflicting with normal exploitation.
So a dataset can be free of copyright in its contents and still be protected against extraction.
The press publishers' right. DSM Article 15 gives press publishers rights over online use of press publications — a separate layer over news content.
Performers' and producers' rights. For audio and audiovisual training data, related rights sit alongside copyright.
Moral rights and personality rights. Not harmonised, and varying by Member State.
The AI Act puts the duty on you
The AI Act does not let a provider delegate the compliance question up the supply chain:
"put in place a policy to comply with Union law on copyright and related rights, and in particular to identify and comply with, including through state-of-the-art technologies, a reservation of rights expressed pursuant to Article 4(3) of Directive (EU) 2019/790" —
Three features deserve attention.
It is an active duty. "Identify and comply with" requires a process for detecting reservations — not a contractual assurance that none exist.
"State-of-the-art technologies" implies keeping pace with machine-readable reservation standards as they develop.
It is a policy obligation. The provider must have a policy, be able to show it, and operate it.
Article 53(1)(d) adds the public training-content summary, according to a template provided by the AI Office. A provider that cannot describe its data sources cannot produce that summary — and supplier opacity becomes the provider's compliance failure.
Recital 106 closes the jurisdictional escape route: any provider placing a general-purpose AI model on the Union market must comply with the copyright-policy obligation "regardless of the jurisdiction in which the copyright-relevant acts underpinning the training of those general-purpose AI models take place".
Note that Article 53(2) exempts certain open-source models from points (a) and (b) only — the copyright policy in (c) and the training-content summary in (d) are not within that exemption.
What supplier licences are actually good for
None of this makes supplier agreements pointless. They do real work:
- Risk allocation. A warranty as to provenance plus an uncapped IP indemnity shifts financial exposure.
- Evidence of good faith. Diligence and contractual protections support a defensible compliance narrative.
- Provenance information. A supplier that documents sources, licences and opt-out checks materially reduces your own diligence burden.
- Remedies. Audit rights, update obligations and termination rights give you tools when problems surface.
What they cannot do is bind a rightholder who never dealt with the supplier. An injunction does not stop because you have an indemnity.
Diligence that stands up
- Require documented provenance, not a bare assurance. Ask how the dataset was assembled and from where.
- Ask when opt-out checks were performed, against which standards, and whether they are refreshed.
- Test whether "lawful access" is genuinely established, including whether access terms permitted mining.
- Map the layers: works, database copyright, sui generis right, press publishers' right, related rights.
- Verify the supplier's own chain of title, including whether it can sublicense.
- Do not treat Article 3 datasets as usable commercially without a fresh Article 4 analysis.
- Operate your own reservation-detection process to meet Article 53(1)(c).
- Capture what the training-content summary will need at ingestion, not afterwards.
- Negotiate audit rights and an uncapped IP indemnity, and check the supplier can actually stand behind it.
- Re-run checks periodically; reservations can be added after training.
Conclusion
A dataset supplier's licence answers the question "what happens if this goes wrong". It does not answer "am I permitted to do this". Those are different questions, and only the second determines whether a rightholder can stop you.
The EU framework puts the obligation on the model provider directly. Article 4(3) makes the exception conditional on a reservation you must detect; Article 53(1)(c) requires you to have your own policy and to use state-of-the-art means to identify reservations; and recital 106 applies that duty regardless of where training occurred. Buy the indemnity, and do the diligence anyway.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.