Data Rights and Compliance Economics

Data is an economic input only if it can be used. A document may be technically available, easy to scrape, and valuable for training, while still being unusable because its license is missing, its provenance is unclear, its terms forbid AI training, or the customer cannot accept the compliance risk. The economics of data therefore has two ledgers: the volume ledger of tokens and the rights ledger of permission, provenance, documentation, and market access.

A corpus is a supply chain

The older way to think about training data was as a pile: more web pages, more books, more code, more tokens. The production way is to treat data as a supply chain. Every dataset has a source, a collection method, a license or terms of service, a transformation history, a filter policy, an attribution record, and a set of downstream uses it can or cannot support.

The Data Provenance Initiative makes the operational problem visible. Its audit of more than 1,800 text datasets found widespread license omissions and errors, and a sharp divide between commercially open and closed data categories (Longpre et al. 2023). That means "we trained on public data" is not an economic answer. The useful answer names the public data in question, the rights it came under, its provenance and jurisdiction, and the evidence a customer can review.

Consent became dynamic

Rights are not stable once model training becomes economically salient. Longpre and coauthors' longitudinal audit of 14,000 web domains found rapid growth in AI-specific restrictions from 2023 to 2024, inconsistencies between robots.txt and terms of service, and a large share of important sources in C4, a widely-used web-scraped training corpus, becoming restricted by robots or ToS signals (Longpre et al. 2024). The data commons is therefore not a fixed stock. It is a contested supply source whose access rules are changing in response to AI itself.

This creates a price signal. As easy web data becomes less usable, the marginal value of licensed, first-party, customer-approved, or synthetic data rises. A provider that cannot document its data risks being discounted by some customers or excluded from procurement altogether. And the domain holder who can license high-quality data with clear rights now owns an asset that did not look like one back when scraping was assumed to be free. That market is no longer a forecast: disclosed deals include Reddit licensing its corpus to Google for roughly 60 million dollars a year and News Corp licensing its archives to OpenAI for a reported 250 million dollars over five years (CBS News 2024; Variety 2024).

The courts have started to price one side of this ledger. In June 2025, Bartz v. Anthropic held that training on lawfully acquired books is transformative fair use, while downloading and retaining pirated shadow-library copies is not (Alsup 2025); Kadrey v. Meta reached a similar fair-use posture the same week (Chhabria 2025). Bartz then settled for 1.5 billion dollars, about 3,000 dollars per work across roughly 500,000 books, the largest copyright settlement in US history (The Authors Guild 2025). Read as a price signal, the liability landed on acquisition provenance, not on training itself, and the settlement pays for past conduct without creating any license for future training. The rights ledger, not the courtroom, remains the binding input.

Open weights do not settle data rights

The OSI Open Source AI Definition is useful because it separates the artifact from the materials needed to modify it. It requires the freedoms to use, study, modify, and share, and says the preferred form for modifying a machine-learning system includes data information, code, and parameters (Open Source Initiative 2024). That distinction matters economically. A downloadable weight file can reduce serving lock-in while still leaving the buyer unable to reproduce training, audit data rights, or satisfy a customer's documentation requirement.

This is why "open" can be economically incomplete. Open weights can be enough for local inference, fine-tuning, and experimentation. They may not be enough for a regulated buyer. That buyer has to confirm which sources the training data drew on, whether copyrighted material was filtered and opt-outs respected, and that the provider publishes the training-content summary the AI Act requires.

Compliance as market access

Regulation turns documentation into access. The EU AI Act's obligations for general-purpose AI providers, technical documentation, a copyright policy, and a public summary of training content in the Commission's template, are binding since August 2, 2025, with the Commission's enforcement powers following from August 2026 (European Commission 2025). The European Commission's General-Purpose AI Code of Practice, published on July 10, 2025, is the voluntary path for demonstrating compliance with those obligations (European Commission 2025): its transparency and copyright chapters apply broadly to GPAI providers, while the safety and security chapter is aimed at the most advanced systemic-risk models. The 2026 Digital Omnibus deferred the Act's high-risk deadlines, but it left the GPAI obligations in force (Council of the European Union 2026).

From an engineering perspective, this looks like paperwork. From an economic perspective, it is market infrastructure. A provider that can produce model documentation, copyright policy evidence, data summaries, evaluation records, and incident processes can sell into buyers who require them. One that cannot may still be capable, yet it is not equally accessible.

Design for the ledger

A serious data program should keep the rights ledger beside the token ledger:

• source identity and collection date;
• license, terms, consent signal, and jurisdiction;
• transformation history, filtering, deduplication, and PII handling;
• allowed uses for pretraining, fine-tuning, retrieval-augmented generation (RAG, the pattern of fetching documents at query time and feeding them to the model, see Chapter 44), evaluation, and display;
• documentation that can be shown to customers, auditors, and regulators.

The technical stack already has places for this ledger. Quality and filtering live in Chapter 6, while Chapter 59 covers provenance, privacy, and deletion, and the legal obligations belong to Chapter 61. This chapter adds the economic claim: the ledger is valuable because it converts data from a risky input into a sellable one.

Further reading