由 admin 
The business of supplying AI datasets is moving from file delivery toward rights verification. A new European consultation provides an immediate reason to examine that shift. The European Data Protection Board’s draft Guidelines 03/2026 invite feedback until 30 October 2026 on web scraping in generative AI. Buyers evaluating data suppliers should treat the deadline as a due-diligence trigger, not as proof that the draft is already binding law.
For Finndy Intelligence, the question is economic as well as legal: which provenance records, contract terms and remediation controls turn a data feed into a licensable asset?
What the consultation actually changes today
The European Data Protection Board published Guidelines 03/2026 on web scraping in the context of generative AI for public feedback from 8 July through 30 October 2026, with the stated deadline at 23:59 CET. As of 21 October, this is an open consultation, not a final ruling granting or removing anyone’s license to use data. That distinction matters for data suppliers writing contracts this week. An AI customer may ask for proof of where information came from, how it was collected and whether individuals received appropriate treatment; the supplier cannot answer by claiming that a draft guideline creates an automatic safe harbor. The operational response should be to prepare evidence and document unresolved legal questions. Existing law, including the GDPR when personal data are involved, continues to matter regardless of what changes in the consultation’s final text. Suppliers should monitor the final EDPB output rather than hard-code today’s draft wording into permanent guarantees.
Separate the dataset from the rights being sold
A dataset is not a single economic asset with one universal permission. A supplier might own a database structure, license certain photographs, collect publicly accessible business facts and hold user-generated text supplied under limited terms. Selling access to a combined package does not magically expand the rights behind each component. Use a rights ledger with columns for origin, controller or rights holder, permitted uses, geographic scope, duration, onward-transfer restrictions and deletion obligations. Tag personal data separately from non-personal facts; some mixed datasets need additional segmentation. The GDPR’s Article 5 principles include purpose limitation and data minimisation, while the EU Data Act addresses specified data-access and use relationships. Neither framework means all publicly available information is free for every AI training purpose. A buyer-facing catalogue should distinguish documentation you have verified from permission that still depends on contractual or regulatory interpretation.
Build provenance evidence that survives buyer due diligence
For each collection channel, maintain a small, reproducible evidence pack: source type, collection date, acquisition mechanism, published terms, any documented authorization, quality checks and a contact for complaints or corrections. Do not store more personal data in the audit trail than necessary to demonstrate the process. Document whether a third-party vendor supplied the records, what warranties it gave, and whether the contract allows your specific downstream use. Use sampling to validate the source metadata rather than claiming to inspect each record manually when that did not happen. Buyers should request a representative sample, conduct legal review on high-risk classes and run an independent test for duplicates and sensitive fields. A spreadsheet showing a million rows says little about whether those rows can lawfully be used. Strong provenance reduces the cost of buyer diligence; weak provenance transfers an unpriced risk to the model developer, often making an apparently cheap dataset expensive to deploy.
Model the EU Data Act separately from AI scraping questions
The European Commission states that the Data Act began applying on 12 September 2025. Its scope covers particular data-sharing scenarios, notably connected-product data and switching between data-processing services. The Commission’s explanation also describes a future prohibition of cloud-switching charges from 12 January 2027, subject to the applicable terms and implementation. This should not be confused with an across-the-board obligation to license any website’s content for model training. For a data infrastructure business, the Act may influence access arrangements, portable formats, customer contracts and the cost of moving between providers. The EDPB’s draft web-scraping guidelines instead focus on data-protection concerns in the context of generative AI. Keeping the regimes in separate rows of a compliance matrix prevents a procurement team from relying on the wrong legal basis. Where the relevant jurisdiction or asset type is unclear, record the assumption and obtain qualified legal advice.
Price uncertainty and remediation before signing
A useful commercial model starts with gross contract value and deducts specific risks and operating burdens: acquisition and verification, data cleansing, permitted-use constraints, incident response, deletion support, vendor royalties and renewal costs. Avoid inventing a universal percentage discount for a dataset lacking provenance. Instead, quote alternative packages tied to what can actually be proved: verified and restricted-use material, material pending further authorization, and excluded records. Offer a smaller licensed sample first when the buyer’s use case is uncertain. Contract schedules should spell out whether data may be used for model training, retrieval, evaluation or redistribution, because those activities are not interchangeable. They should also address corrections, source withdrawal, complaints, audit rights and whether derived artefacts remain usable. A low headline price with unresolved rights can undermine both the buyer’s deployment timetable and the supplier’s renewal revenue.
A nine-day buyer and supplier action plan
With the EDPB comment period approaching its 30 October deadline, teams can prepare without waiting for a final guideline. First, inventory collection methods and identify data that may relate to identifiable people. Second, match each source to an asserted legal or contractual permission, marking uncertain entries clearly. Third, test the ability to remove disputed records from delivery packages and later releases. Fourth, separate GDPR analysis, Data Act obligations and intellectual-property questions instead of applying one label to everything. Fifth, write a customer-facing evidence summary that explains intended purposes, restrictions and remediation contacts in plain language. Sixth, have a responsible reviewer decide whether to submit consultation comments where the organization’s experience can help inform policy. This is a readiness checklist rather than a legal conclusion. The core economic point is simple: in AI data markets, credible rights evidence and correction capability are part of the product, not paperwork added after a sale.
Sources
- EDPB: Guidelines 03/2026 consultation, 8 July–30 October 2026
- EUR-Lex: General Data Protection Regulation, including Article 5
- European Commission: Data Act explained
Analysis as of 21 October 2026. This article distinguishes an open regulatory consultation from applicable law and is not legal advice.