# Copyright Policy: [General-purpose AI model provider]

> Copyright policy for a provider of a general-purpose AI (GPAI) model,
> organised on Article 53(1)(c) of the EU Artificial Intelligence Act
> (Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744)
> and the five measures of the Copyright chapter of the General-Purpose
> AI Code of Practice (published 10 July 2025). It covers lawful access
> when crawling, identifying and honouring text and data mining (TDM)
> rights reservations under Article 4(3) of Directive (EU) 2019/790,
> crawler transparency, safeguards against infringing outputs, and a
> point of contact and complaints process for rightsholders. Replace
> every `[bracketed]` value and every row marked *Example*. GPAI
> obligations have applied since 2 August 2025 (2 August 2027 for models
> placed on the market before 2 August 2025); check the consolidated
> text. This is a documentation format, not legal advice: check the
> current official text and a qualified professional.

<!--
Guidance: How to use this template
- Article 53(1)(c) asks every GPAI model provider placing a model on the
  EU market to put in place a policy to comply with EU copyright law,
  and in particular to identify and respect TDM rights reservations,
  including with state-of-the-art technologies. It applies wherever the
  training took place.
- The Copyright chapter of the Code of Practice is a voluntary route to
  show compliance (Article 53(4)). If you signed it, keep sections 3 to
  7 aligned with Measures 1.1 to 1.5. If you did not, the same sections
  document your "adequate alternative means".
- The Code asks for one policy document with internal responsibilities,
  and encourages a public summary. Section 9 is that summary.
- Article 53(2) exempts some open-source models from points (a) and (b)
  only. The copyright policy in point (c) still applies to them.
- Copyright law is national. The Code itself says signatories remain
  responsible for checking compliance with Member State law. Ask
  copyright counsel in the main markets to review this policy.
-->

## Document control

<!-- Guidance: Identify the provider and every model family the policy covers. One policy can cover several models if the same measures apply. -->

| Field | Value |
|---|---|
| Document ID | [CPY-001] |
| Provider | [Legal name, address] |
| Models covered | [Model names and versions] |
| Code of Practice signatory | [Yes, Copyright chapter / No, alternative means] |
| Version | [1.0] |
| Status | [Draft / Approved / Superseded] |
| Policy owner | [@copyright-policy-owner] |
| Oversight | [@general-counsel], [@data-governance-lead], [@head-of-research] |
| Effective date | YYYY-MM-DD |
| Next review | YYYY-MM-DD |
| Public summary URL | [URL] |
| Classification | [Internal, summary public] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| General counsel | [@name] | [Approve] | YYYY-MM-DD |
| Chief technology officer | [@name] | [Approve] | YYYY-MM-DD |
| Executive sponsor | [@name] | [Approve] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change summary |
|---|---|---|---|
| 1.0 | YYYY-MM-DD | [@name] | *Example:* First policy for QML-3, aligned with Code of Practice Copyright chapter |
| 1.1 | YYYY-MM-DD | [@name] | *Example:* Added support for a new machine-readable opt-out protocol |

## Contents

<!-- Guidance: Keep aligned with the headings below. -->

1. [Scope and legal basis](#1-scope-and-legal-basis)
2. [Roles and responsibilities](#2-roles-and-responsibilities)
3. [Lawful access when crawling](#3-lawful-access-when-crawling)
4. [Identifying and honouring rights reservations](#4-identifying-and-honouring-rights-reservations)
5. [Crawler transparency](#5-crawler-transparency)
6. [Mitigating infringing outputs](#6-mitigating-infringing-outputs)
7. [Point of contact and complaints](#7-point-of-contact-and-complaints)
8. [Other data sources](#8-other-data-sources)
9. [Public summary](#9-public-summary)
10. [Monitoring and review](#10-monitoring-and-review)
11. [Glossary and references](#11-glossary-and-references)

## 1. Scope and legal basis

<!-- Guidance: State what the policy covers: all content used to train the models listed, from every source, and the outputs of those models. -->

| Item | Value |
|---|---|
| Legal basis | AI Act Article 53(1)(c); Directive (EU) 2019/790 Articles 3 and 4 |
| Content covered | [Web crawl, licensed datasets, public datasets, user data, synthetic data] |
| Activities covered | [Collection, filtering, training, fine-tuning, evaluation, output generation] |
| Models covered | *Example:* QML-3 base and QML-3 Instruct by Quillmere Labs |
| Related documents | ai-data/gpai-model-documentation, ai-data/gpai-training-content-summary, ai-data/datasheet-for-datasets |

Key EU rules in short (original summary, check the official texts):

- Directive (EU) 2019/790 Article 3 allows TDM by research organisations
  and cultural heritage institutions for scientific research.
- Article 4 allows TDM by anyone on lawfully accessible content, unless
  the rightsholder has reserved its rights in an appropriate manner, for
  content online in particular by machine-readable means (Article 4(3)).
- AI Act Article 53(1)(c) requires the provider to have a policy to
  comply with EU copyright law and to identify and respect those
  reservations.

Other jurisdictions, as dated examples: in the United Kingdom, section
29A of the Copyright, Designs and Patents Act 1988 allows copies for
computational analysis for non-commercial research only; secondary
sources reported in March 2026 that the government did not plan a
broader commercial text and data mining exception for now (check
https://www.legislation.gov.uk/ukpga/1988/48/section/29A and current
gov.uk policy before relying on this). In the United States, training is assessed
under fair use (17 U.S.C. section 107); the US Copyright Office released
a pre-publication version of its report Part 3 on generative AI
training on 9 May 2025 (https://www.copyright.gov/ai/).

## 2. Roles and responsibilities

<!-- Guidance: Measure 1.1 of the Code asks for responsibilities assigned for implementing and overseeing the policy. Name roles, not only teams. -->

| Role | Responsibility | Person |
|---|---|---|
| Policy owner | Maintains this policy and the public summary | [@name] |
| Crawler engineering lead | Implements sections 3 to 5 in the crawler | [@name] |
| Data governance lead | Approves every dataset before training (section 8) | [@name] |
| Safety lead | Implements output safeguards (section 6) | [@name] |
| Rightsholder relations | Runs the complaints process (section 7) | [@name] |
| General counsel | Oversight, legal review, escalation | [@name] |

## 3. Lawful access when crawling

<!-- Guidance: Measure 1.2: reproduce and extract only lawfully accessible content. Two concrete commitments: no circumvention of effective technological measures such as paywalls and subscription models, and exclusion of websites recognised by courts or public authorities in the EU or EEA as persistently and repeatedly infringing on a commercial scale. -->

| ID | Rule | Implementation | Evidence |
|---|---|---|---|
| LA-01 | Do not circumvent paywalls, logins, subscription models or other effective technological measures | *Example:* Crawler fetches only pages served without authentication; pages behind login walls are skipped | Crawler config CR-12 |
| LA-02 | Exclude websites recognised in the EU or EEA as persistently and repeatedly infringing on a commercial scale | *Example:* Blocklist loaded from the EU list once published, plus court orders tracked by legal | Blocklist BL-03, updated [frequency] |
| LA-03 | Do not use content obtained from known pirate sources from any channel | *Example:* Dataset intake checks source against BL-03 | Intake checklist |

## 4. Identifying and honouring rights reservations

<!-- Guidance: Measure 1.3. Crawlers must read and follow robots.txt under IETF RFC 9309 (and later versions where feasible), and other appropriate machine-readable protocols that are state of the art and widely adopted, such as asset-based or location-based metadata. Record which protocols you support and since when. -->

| ID | Signal | Supported since | Behaviour |
|---|---|---|---|
| RR-01 | robots.txt per RFC 9309, user agent token for our crawler | YYYY-MM-DD | *Example:* Disallow for our token or for all agents means no fetch and no use for training |
| RR-02 | robots.txt read at crawl time and re-read at least [every 24 hours] | YYYY-MM-DD | *Example:* A later disallow removes the domain from the next training data snapshot |
| RR-03 | [Other machine-readable protocol, for example a TDM reservation protocol or metadata standard] | YYYY-MM-DD | [Behaviour] |
| RR-04 | Asset-level metadata in files (for example embedded rights metadata) | YYYY-MM-DD | [Behaviour] |
| RR-05 | Reservations communicated by rightsholders through section 7 | YYYY-MM-DD | Added to the exclusion list within [period] |

Decision record for a new protocol:

| Protocol | Adoption evidence | Decision | Date |
|---|---|---|---|
| [Name] | [Standardisation status, adoption by rightsholders] | [Support / Monitor] | YYYY-MM-DD |

Pitfall to avoid: honouring robots.txt only at first crawl. A
reservation added later should stop further use of newly crawled
copies; record how older snapshots are treated and why.

## 5. Crawler transparency

<!-- Guidance: Measure 1.3 also asks providers to publish information about their crawlers, the robots.txt features they use and other reservation measures, and to let rightsholders be notified of updates, for example through a web feed. -->

| Item | Value |
|---|---|
| Crawler names and user agent tokens | *Example:* QMCrawl/1.0, token "QMCrawl" |
| IP ranges or verification method | [Published list URL] |
| Purpose of each crawler | *Example:* Training data collection only; separate from search or retrieval agents |
| robots.txt features honoured | [Disallow, Allow, user agent groups, crawl delay if supported] |
| Other protocols honoured | [List from section 4] |
| Update notifications | *Example:* RSS feed and changelog page |
| Published at | [URL] |

## 6. Mitigating infringing outputs

<!-- Guidance: Measure 1.4. Two parts: proportionate technical safeguards so the model does not reproduce training content in an infringing way, and a prohibition of infringing uses in the acceptable use policy or terms. For open-source releases, alert users in the documentation. -->

| ID | Safeguard | Description | Test evidence |
|---|---|---|---|
| OUT-01 *(Example)* | Training data deduplication | Near-duplicate removal reduces memorisation of repeated texts | Dedup report DR-04 |
| OUT-02 *(Example)* | Regurgitation evaluation | Prompts built from held-out copyrighted samples; long verbatim matches flagged | Eval EV-21 |
| OUT-03 *(Example)* | Output filter | Blocks long verbatim reproduction of known protected texts such as song lyrics | Filter spec FS-02 |
| OUT-04 | Acceptable use policy clause | Users may not use the model to infringe copyright | [AUP URL, clause] |
| OUT-05 | Downstream documentation | Integrators told about the prohibition and the safeguards | ai-data/gpai-model-documentation |

## 7. Point of contact and complaints

<!-- Guidance: Measure 1.5. Designate an electronic point of contact for affected rightsholders, make it easy to find, and run an electronic complaints mechanism for rightsholders, their representatives and collective management organisations. Handle complaints diligently, without arbitrariness and in reasonable time; manifestly unfounded or repeated identical complaints may be declined. -->

| Item | Value |
|---|---|
| Point of contact | [Web form URL, email address] |
| Who may complain | Rightsholders, their representatives, collective management organisations |
| Information requested | Identity, work concerned, evidence of rights, the concern (training use, ignored reservation, output) |
| Acknowledgement target | [For example 5 working days] |
| Decision target | [For example 30 days] |
| Possible outcomes | Reservation added; content removed from future training data; output filter updated; complaint declined with reasons |
| Escalation | [@general-counsel] |

```mermaid
flowchart TD
  A["Complaint received"] --> B["Acknowledge and log CMP-NNN"]
  B --> C{"Manifestly unfounded or repeat of an answered complaint?"}
  C -->|Yes| D["Decline with reasons"]
  C -->|No| E["Investigate source, reservation and outputs"]
  E --> F["Decide remedy"]
  F --> G["Inform complainant"]
  D --> G
  G --> H["Record in complaints log"]
```

| ID | Received | Complainant type | Issue | Outcome | Closed |
|---|---|---|---|---|---|
| CMP-001 *(Example)* | YYYY-MM-DD | Publisher | robots.txt disallow added before crawl date was not honoured | Domain removed from future data snapshots; crawler bug fixed | YYYY-MM-DD |
| CMP-002 *(Example)* | YYYY-MM-DD | Collective management organisation | Model output reproduced lyrics | Output filter OUT-03 extended | YYYY-MM-DD |

## 8. Other data sources

<!-- Guidance: The policy covers all training content, not only the web crawl. Record the copyright basis for each source class. -->

| Source class | Copyright basis | Check before use |
|---|---|---|
| Licensed datasets | Licence agreement | Licence permits AI training in the territories concerned |
| Public datasets | Dataset licence and how it was collected | Collection respected reservations; no pirate sources |
| User data | Terms of service and consent | Training use disclosed and permitted |
| Synthetic data | Generated by our or third-party models | Upstream model terms allow it |
| Public domain | Term of protection expired or no protection | Jurisdiction checked |

## 9. Public summary

<!-- Guidance: The Code encourages publishing a summary of the policy. Keep it short, plain and consistent with sections 3 to 7. -->

[*Example:* Quillmere Labs trains its QML models only on content it can
access lawfully. Our crawler QMCrawl follows robots.txt and [other
protocols], never bypasses paywalls, and skips sites recognised as
infringing on a commercial scale. We use safeguards to limit
reproduction of protected content in outputs, and our terms prohibit
infringing use. Rightsholders can contact us at [URL]. Crawler details
and updates are published at [URL].]

## 10. Monitoring and review

<!-- Guidance: Measure 1.1 asks you to keep the policy up to date. Set triggers and metrics. -->

| Item | Value |
|---|---|
| Scheduled review | [Every 12 months] |
| Triggers | New model release, new protocol adoption, EU list of infringing sites published or updated, court ruling, complaint trend |
| Metrics | Complaints received and closed, median days to decision, share of domains with reservations, regurgitation eval results |
| Report to | [Executive sponsor, board committee] |

## 11. Glossary and references

<!-- Guidance: Define terms and list official sources with the date checked. -->

| Term | Meaning |
|---|---|
| TDM | Text and data mining: automated analysis of text and data to generate information |
| Rights reservation | A rightsholder's statement that TDM of its content is not permitted, under Article 4(3) of Directive (EU) 2019/790 |
| robots.txt | A file that tells crawlers which paths they may fetch, standardised in RFC 9309 |
| GPAI model | General-purpose AI model as defined in AI Act Article 3(63) |
| Code of Practice | The General-Purpose AI Code of Practice, a voluntary tool under AI Act Article 56 |

References (check the current versions):

- Regulation (EU) 2024/1689 (AI Act), Articles 53, 56, 111(3), 113: https://eur-lex.europa.eu/eli/reg/2024/1689/oj ; amended by Regulation (EU) 2026/1744: http://data.europa.eu/eli/reg/2026/1744/oj
- Directive (EU) 2019/790 on copyright in the Digital Single Market, Articles 3 and 4: https://eur-lex.europa.eu/eli/dir/2019/790/oj
- General-Purpose AI Code of Practice, Copyright chapter, published 10 July 2025: https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai
- IETF RFC 9309, Robots Exclusion Protocol: https://www.rfc-editor.org/rfc/rfc9309
- Related templates: ai-data/gpai-model-documentation, ai-data/gpai-training-content-summary, ai-data/datasheet-for-datasets, ai-data/ai-system-inventory, ai-data/frontier-safety-framework

## Standard and licence note

Based on Regulation (EU) 2024/1689 (the Artificial Intelligence Act) as
amended by Regulation (EU) 2026/1744, Article 53(1)(c), Directive (EU)
2019/790 Article 4, and the Copyright chapter of the General-Purpose AI
Code of Practice published by the European Commission on 10 July 2025.
EU legislative texts are free to reuse; the Code's measures are
summarised in original wording and no text is reproduced. Check the
consolidated text on EUR-Lex, the current Code and Commission guidance
before relying on this policy. All organisations, crawlers and figures
in examples are fictional. This is a documentation format, not legal
advice. Template licence: MIT.