What the EU AI Act asks of a music model owner, and what it does not

What the EU AI Act asks of a music model owner, and what it does not

By Priya Gupta, Head of Legal Affairs, RadioPro LLC

On 2 August 2025 the European Union's rules for general-purpose AI models began to apply. In the five weeks before that date the European Commission published the three documents that give the rules their practical shape: a voluntary Code of Practice on 10 July, guidelines on which models are covered on 18 July, and a template for the public summary of training content on 24 July. This article reads those documents from the position of a company that builds a generative audio model, deploys it inside its own group, and does not publish how it works. The short version is that the Act asks for less than the headlines suggest, and that what it asks for is compatible with keeping the model closed. The longer version follows.

Four duties, one date

Article 53 of the Act imposes four obligations on the provider of a general-purpose model. The provider must draw up and keep technical documentation "for the purpose of providing it, upon request, to the AI Office and the national competent authorities." It must make information available to companies that build systems on top of the model, "without prejudice to the need to observe and protect intellectual property rights and confidential business information or trade secrets." It must "put in place a policy to comply with Union law on copyright and related rights," including identifying and respecting rights reservations under the 2019 copyright directive. And it must "draw up and make publicly available a sufficiently detailed summary about the content used for training of the general-purpose AI model, according to a template provided by the AI Office." (Regulation (EU) 2024/1689, Article 53)

Two timing points matter. The obligations apply now, but the Commission's power to enforce them, including fines of up to 3 percent of global turnover or 15 million euros, starts on 2 August 2026. The Commission's guidelines are explicit that "this lack of enforcement does not put into question the applicability of the obligations." (Commission guidelines, C(2025) 5045, paragraph 115) Models placed on the market before 2 August 2025 have until 2 August 2027 to comply, and the guidelines add that their providers "are not required to conduct retraining or unlearning of models" where that is impossible or disproportionate, provided the gaps are disclosed.

A third point is often missed. A company that serves its model only through its own product is still placing it on the market. The guidelines quote the Act's recital: when a provider "integrates an own model into its own AI system that is made available on the market or put into service, that model should be considered to be placed on the market." Keeping a model inside your own application does not take you outside the Act. Keeping it off the European market does.

Is a music model a general-purpose model at all

The Act defines a general-purpose model as one "that displays significant generality and is capable of competently performing a wide range of distinct tasks." The guidelines turn that into an indicative test: a model is presumed general-purpose if "its training compute is greater than 10^23 FLOP and it can generate language (whether in the form of text or audio), text-to-image or text-to-video." The Commission adds that it understands audio to include speech, so a model that sings lyrics generates language for this purpose.

The test is rebuttable, and the Commission chose a music model to show how. Its worked example reads: "A model is trained specifically for generating music, based on text prompts including lyrics, using 10^24 FLOP." The criterion would indicate a general-purpose model, the guidelines say, "However, if the model can only competently perform a narrow set of tasks (generating music, based on text prompts including lyrics) it is not actually a general-purpose AI model." (Commission guidelines, section 2.1) Models trained only for sound effects or for text-to-speech get the same treatment.

That example describes a text-prompted generative audio performance model almost word for word. Whether a given model falls inside or outside Chapter V is therefore a question of fact about what it can competently do, and it is a question the company itself has to answer and document. The guidelines warn that the Commission "may change in the future as technology and the market evolve" and may adopt benchmarks. A prudent owner prepares as if the duties apply, and records the analysis of why they may not.

The training summary does not describe the model

Of the four duties, the public summary of training content is the one that attracts the most attention, and the one most often misdescribed. The Act's recital says the summary "should be generally comprehensive in its scope instead of technically detailed," and should be written "while taking into due account the need to protect trade secrets and confidential business information." (Recital 107)

The Commission's template follows that instruction. It has three sections: general information about the provider, the model and the modalities and size of the training data in broad bands; a list of the main data sources, with a narrative description of scraped data and other sources; and a short section on data processing aspects relevant to rightsholders. For scraped web data it asks for the top 10 percent of domains by volume, or for small and medium-sized companies the top 5 percent or 1,000 domains, whichever is lower. For audio it asks the provider to tick a size band: under 10,000 hours, 10,000 hours to a million, or more than a million, with "musical compositions and recordings" given as an example content type. (Explanatory Notice and Template, 24 July 2025)

Then the Commission says what the template does not do: it "does not require disclosure of the details for the specific data and works used to train the model as this would go beyond the requirement in Article 53(1)(d) to provide just a 'summary'." A whole section of the notice is headed "Balance with trade secrets and confidential business information." Nowhere does the template ask for the model's architecture, its parameter count, its weights, or its training method. A summary that complies with the template tells a rightsholder what kinds of material went in, at what scale, from what classes of source. It tells a competitor nothing they could build from.

The technical documentation goes to the regulator, under confidentiality

The documentation duty is different in kind. It is detailed, and it does describe the model. But it is not public. The technical documentation is drawn up "for the purpose of providing it, upon request, to the AI Office and the national competent authorities," and the Act provides that "any information or documentation obtained pursuant to this Article, including trade secrets, shall be treated in accordance with the confidentiality obligations set out in Article 78." The Code's model documentation form marks each item according to whether it goes to downstream providers or to authorities, and notes that the authorities' items "are only to be made available following a request." (Code of Practice, Transparency Chapter)

Closed models get no exemption here. The Act waives the documentation duties only for models "released under a free and open-source licence" whose "parameters, including the weights, the information on the model architecture, and the information on model usage, are made publicly available." A company that keeps its weights private has to keep the documentation ready. It does not have to show it to anyone but a regulator who asks, and the regulator is bound to keep it confidential.

The copyright policy

The third duty is a written copyright policy that identifies and respects rights reservations, the machine-readable opt-outs that European rightsholders may attach to their works under Article 4(3) of the 2019 directive. The Code's copyright chapter turns this into five measures: a single policy document; lawful access only, with no circumvention of paywalls and no crawling of sites that courts have found to be persistently infringing; crawlers that honour robots.txt and other recognised reservation protocols; "appropriate and proportionate technical safeguards to prevent their models from generating outputs that reproduce training content" in an infringing manner; and a contact point and complaint mechanism for rightsholders. The output safeguard "applies irrespective of whether a Signatory vertically integrates the model into its own AI system." (Code of Practice, Copyright Chapter)

The chapter is careful to say that "adherence to the Code does not constitute compliance with Union law on copyright and related rights." The policy is a process. Whether what the company did with any particular work was lawful remains a matter for copyright law and, where it comes to that, the courts.

For a model that performs lyrics and compositions brought to it by their owners, the input side of this policy is short. The material the model renders arrives with permission attached. The output side, the safeguard against reproducing protected material the model was not asked to perform, is the part that requires engineering, and it is the part a serious owner should already have.

The Code: who signed and who did not

The Code of Practice was written by thirteen independent experts with input from over a thousand stakeholders and published on 10 July. It has three chapters. Transparency and copyright apply to all providers; safety and security applies only to the handful of models presumed to carry systemic risk, those trained with more than 10^25 FLOP. The Commission's stated bargain is that signatories "will benefit from a reduced administrative burden and increased legal certainty compared to providers that prove compliance in other ways," though signing gives no presumption of conformity. (Commission press release, 10 July 2025) The Commission and the AI Board found the Code adequate on 1 August.

By that date roughly two dozen companies had signed, among them Amazon, Anthropic, Google, IBM, Microsoft, Mistral and OpenAI. xAI signed the safety chapter only and must show compliance with the transparency and copyright duties by other means. Meta refused outright. Its head of global affairs wrote that the Code "introduces a number of legal uncertainties for model developers, as well as measures which go far beyond the scope of the AI Act." (TechCrunch, 18 July 2025) Refusing to sign changes the route, not the destination. Under Article 53(4), a provider that does not adhere to a code "shall demonstrate alternative adequate means of compliance for assessment by the Commission."

On the other side, a coalition of European creative-sector organisations including IFPI and CISAC rejected the template as too weak, calling the Commission's claim of sufficient transparency "a betrayal of the EU AI Act's objectives." (Joint statement, 30 July 2025) The template they object to is the one the law now contains. It may be tightened in future. It has not been.

What comes next: marking the output

One further obligation belongs in any music company's calendar. From 2 August 2026, Article 50 requires providers of systems "generating synthetic audio, image, video or text content" to ensure "that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated." Where the content "forms part of an evidently artistic, creative, satirical, fictional or analogous work," the disclosure duty on the deployer is limited to one "that does not hamper the display or enjoyment of the work." (Article 50) The recital lists watermarks, metadata, cryptographic provenance and fingerprints as acceptable techniques and says they "can be implemented at the level of the AI system or at the level of the AI model."

This is a duty about the recording, not about the model. A watermark says that a performance was machine-made. It does not say how the machine was made.

RadioPro's position

RadioPro LLC builds AuralVerse, a text-prompted generative audio performance model that renders lyrics and compositions written by people. It is deployed inside our group of companies and affiliated networks. We have documented our assessment of the model against the Commission's guidelines, including the worked example quoted above. Where the Act's duties apply to a model we place on the European market, we will meet them at the level the law and the template set: a public summary in the Commission's form, a copyright policy with a contact point, technical documentation held for the AI Office under Article 78, and machine-readable marking of output from August 2026.

What we will not do is treat the Act as a reason to publish the model. It does not ask us to. The documents the Commission issued in July are consistent on this point from the first page to the last: transparency about the content that went in and the output that comes out, confidentiality for the system in between. That is the balance the law struck, and it is the one we operate under.