Short answer
EU copyright law provides two text and data mining (TDM) exceptions.
Article 3 of Directive (EU) 2019/790 permits research organisations and cultural heritage institutions to reproduce and extract lawfully accessible works for scientific research. Right holders cannot opt out of that exception by contract or reservation, although they may apply necessary security measures.
Article 4 permits anyone—including a commercial AI developer—to reproduce and extract lawfully accessible works for TDM. But it applies only where the right holder has not expressly reserved the use in an appropriate manner. For content publicly available online, the directive points to machine-readable reservations. A clear robots.txt instruction is now an important method for web crawling; asset- or location-based metadata and contractual notices may also be relevant.
Neither exception makes access lawful, permits circumvention of paywalls, settles personal-data compliance, or authorises infringing outputs. It covers the reproduction and database extraction needed for mining, subject to its conditions.
Since 2 August 2025, providers of new general-purpose AI models must have an EU-copyright compliance policy that identifies and respects Article 4(3) reservations and must publish a sufficiently detailed training-content summary. The AI Act does not create a new copyright licence or replace the Directive 2019/790 analysis.
What counts as text and data mining?
Directive 2019/790 defines TDM as an automated analytical technique aimed at analysing text and data in digital form to generate information including patterns, trends and correlations. The definition is technology-neutral. It can cover corpus analysis and stages of AI training where protected material is copied or extracted for automated analysis.
The exceptions matter because building, cleaning, tokenising or repeatedly reading a dataset can engage:
- copyright reproduction rights;
- the database maker's extraction right;
- software reproduction or adaptation rights; and
- the press publisher's online-use right.
They do not exempt communication to the public, distribution, adaptation outside their scope or a later output that reproduces protected expression. Facts, ideas and genuinely public-domain material may not be protected in the first place, but a database's selection, arrangement or investment can carry separate rights.
The scientific-research exception
Article 3 is the stronger, institution-specific route. Member States must permit reproductions and extractions made by a qualifying research organisation or cultural heritage institution to mine works to which it has lawful access for scientific research.
Copies may be retained for research, “including for the verification of research results”. —
A research organisation includes a university or research institute conducting scientific research on a not-for-profit basis, by reinvesting all profits in research, or under a recognised public-interest mission. A commercial undertaking with decisive influence, such as preferential access to results, prevents reliance on the definition for the affected arrangement. Public-private collaboration is not automatically excluded, but roles, control and access to results matter.
“Lawful access” includes material available under an open-access policy or a subscription held by the institution. It does not authorise bypassing access controls, using leaked repositories or exceeding the users and collections covered by the access right.
Copies must be stored securely. They may be retained for research and verification rather than deleted immediately. Right holders may use necessary and proportionate measures to protect the security and integrity of their networks and databases, but cannot turn those measures into an opt-out. Contract terms contrary to Article 3 are unenforceable under Article 7.
The general exception for commercial and other mining
Article 4 applies to any person or organisation and does not require a scientific purpose. A commercial model developer, media-monitoring service, pharmaceutical company or independent researcher can rely on it for reproductions and extractions of lawfully accessible material.
Three conditions are central:
- the user has lawful access;
- copies are retained only for as long as necessary for the mining; and
- the right holder has not expressly reserved the use in an appropriate manner.
The exception applies only where use “has not been expressly reserved”. —
Unlike Article 3, Article 4 is not included in Article 7's list of exceptions protected against contract override. Licence and subscription terms therefore need separate review. A reservation excludes reliance on the exception; it does not necessarily prove that every act is protected or infringed. The miner may seek a licence, use unprotected or public-domain material, or establish another legal basis.
What is an effective reservation?
Article 4(3) requires an express reservation made in an appropriate manner and gives “machine-readable means” as the example for content publicly available online. It does not prescribe one universal syntax.
For web content, a defensible reservation programme should:
- publish clear TDM and AI-training terms identifying the content and reserved uses;
- deploy robots.txt directives targeted at relevant crawlers and keep dated versions;
- add rights-reservation metadata at page, feed, repository or asset level where practical;
- carry reservations into licences, APIs, delivery feeds and download terms;
- distinguish search indexing or accessibility tools from model-training access where technically possible; and
- preserve logs and evidence showing what reservation was visible when access occurred.
The voluntary General-Purpose AI Code of Practice, published in July 2025, commits signatory model providers to use crawlers that follow the Robot Exclusion Protocol in RFC 9309 and to identify other appropriate, technically implementable and widely adopted machine-readable protocols. That is useful operational guidance, not a judgment that robots.txt is the only legally valid reservation. The Directive preserves the right to reserve in any appropriate manner.
A natural-language notice alone may be stronger for controlled subscriptions and weaker for automated public-web crawling if it is not machine-readable. Conversely, robots.txt controls crawler behaviour but does not define ownership, protected subject matter, territorial law or licence terms. Layering machine-readable and human-readable notices reduces avoidable disputes.
The AI Act adds provider duties, not a mining exception
Article 53(1)(c) of Regulation (EU) 2024/1689 requires providers of general-purpose AI models to maintain a policy for compliance with EU copyright and related-rights law, particularly to identify and comply with Article 4(3) reservations using state-of-the-art technologies. Article 53(1)(d) also requires a public summary of training content using the AI Office template.
Those Chapter V obligations have applied since 2 August 2025. Providers of general-purpose models placed on the market before that date have until 2 August 2027 to comply. Open-source providers are not exempt from the copyright-policy or training-summary duties; the limited open-source exemption concerns specified technical documentation duties and does not cover systemic-risk models.
Regulation (EU) 2026/1744, the Digital Omnibus on AI, did not remove those copyright-policy or training-summary duties. It changed the Code of Practice route: the Commission now assesses and publishes whether a code adequately covers Articles 53 and 55, without approving it by implementing act. Providers may rely on an adequate code under Article 53(4), but the code does not itself create a presumption of conformity.
Code compliance does not decide whether the provider had lawful access, whether a particular work is protected, or whether Article 3 or 4 applies. Nor does a training summary require publication of every work or trade secret.
Databases, contracts and technical access
Mining can implicate both copyright in database structure and the sui generis right against extraction or reutilisation of a substantial part. Articles 3 and 4 expressly cover specified Database Directive rights, but only on their conditions.
In CV-Online Latvia, C-762/19, the Court explained that database extraction and reutilisation protection must be assessed against whether the acts deprive the maker of income intended to recoup substantial investment, while respecting the legitimate interests of users and competitors. The case did not interpret the later DSM TDM exceptions, but shows why database-right analysis cannot stop at ownership of individual records.
In Ryanair v PR Aviation, C-30/14, the Court held that the Database Directive's mandatory user safeguards did not govern a database outside copyright and sui generis protection, leaving contractual restrictions subject to national law. For modern TDM, the result reinforces the need to analyse protected rights, Article 4 and contract separately rather than assuming one answer controls all three.
Technical accessibility is not lawful access. Ignoring authentication, circumventing effective technological measures, scraping beyond a subscription, breaching computer-access law or collecting personal data without a GDPR basis can create liability even if the intended analysis qualifies as TDM.
Territorial and practical questions
Directive 2019/790 is implemented through Member State law, so remedies and some procedural details remain national. Cross-border training requires analysis of where relevant reproductions and extractions occur, which law applies, who controls the crawler and dataset, and whether the resulting model is offered in the EU.
The AI Act requires covered general-purpose model providers to operate a Union-copyright compliance policy. It does not resolve every private-international-law question or retroactively convert foreign training into authorised EU TDM.
Before mining, record the dataset sources, acquisition route, access terms, reservation checks, applicable exception, retention period and deletion controls. Before reserving, map domains, assets, APIs, licences and crawler identities, then test whether the reservation is actually machine-readable.
Conclusion
EU law protects scientific mining by qualifying research and heritage institutions against right-holder opt-outs, while allowing commercial and other TDM only where access is lawful and rights have not been appropriately reserved. AI training can fall within TDM, but it is not categorically licensed.
Right holders should combine clear legal notices with machine-readable controls and evidence. Model providers must treat those signals as part of their AI Act copyright policy, while continuing to assess copyright, database rights, contracts, privacy and access law separately.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.