Training Data Transparency Standards in Commercial AI Vendor Disclosures

Training data transparency used to be a courtesy. A vendor might publish a model card if it felt like being a good citizen, or stay quiet if it didn't. That era is over. Copyright litigation, state regulation, and international law are now pressing on commercial AI vendors at the same time, and the result is a hard compliance posture that applies whether or not a vendor wants to compete on secrecy.

Why did this happen now? Because what a vendor discloses about its training data bears directly on claims already sitting in court: that developers used copyrighted work and personal data without consent. Three forces now operate on any vendor selling into California or the EU at once: state categorical-disclosure mandates, EU model-card obligations, and a proposed federal copyright-access mechanism. No vendor gets to pick one and ignore the rest.

The gap between what regulators now expect and what vendors can actually produce is large. Kiteworks' 2026 Data Security and Compliance Risk Forecast found that most organizations can't validate data before it enters AI training pipelines, and they can't trace training data provenance either. That means most vendors are being asked to document systems they were never built to document.

For enterprise buyers, the shift matters less as policy trivia and more as a procurement tool. What used to be an internal engineering habit is now a document a procurement team can read before money changes hands.

What California AB 2013 Requires Vendors to Disclose

California's AB 2013 is the broadest state training-data law now in effect, and it reaches further than most vendors expect. It doesn't just bind the handful of frontier labs that build foundation models from scratch. Any entity that fine-tunes a model, substantially modifies one, or in some cases wraps a licensed model for public use in California falls inside its scope.

The law took effect January 1, 2026, but its reach runs backward as well as forward: it applies to generative AI systems released or substantially modified after January 1, 2022. A vendor can't treat compliance as a forward-looking checkbox. It has to account for systems that have been on the market for years. Buying a base model and fine-tuning it doesn't get a company out from under the statute. It can put a company squarely inside it.

The law demands a 12-category summary, and each category is its own disclosure obligation. A procurement team evaluating a vendor's AB 2013 filing should be checking for all twelve. It has to say whether the datasets include material protected by copyright, trademark, or patent, or whether the data sits entirely in the public domain. It needs to disclose whether the datasets were purchased or licensed. It has to state whether the datasets include personal information as CCPA § 1798.140(v) defines it, and separately whether they include aggregate consumer information as CCPA § 1798.140(b) defines it. And it needs to say whether synthetic data generation played a role, with an optional description of what that synthetic data was for.

The law tells vendors to post this summary on their public website, but it doesn't say much else. Enforcement runs through California's Unfair Competition Law, so the Attorney General, district attorneys, and other government prosecutors can bring public enforcement actions. Private plaintiffs can only bring UCL claims if they've actually lost money or property because of a violation, which narrows the private litigation risk considerably. A few narrow carve-outs exist: systems used solely for security and integrity, aircraft operation in national airspace, and national security or defense systems made available only to a U.S. federal agency.

California's categorical summary isn't the ceiling for what vendors face globally. The EU AI Act layers on two separate training-data disclosure tracks, and neither one maps cleanly onto AB 2013's twelve categories. That obligation started applying August 2, 2025, with a transitional deadline of August 2, 2027 for models that were already on the market when the obligation kicked in. The second track covers high-risk AI systems under Article 10, and it works nothing like the first. Instead of a one-time public summary, it mandates data governance and management practices across the entire data lifecycle: design, collection, preparation, labeling, cleaning, enrichment, aggregation, bias examination, gap identification, and documentation. Those obligations were originally set to apply sooner, but the Digital Omnibus pushed the date to December 2, 2027, so vendors planning around this timeline should treat that date as the current target. Article 53 also asks providers to describe how they honored text-and-data-mining opt-outs, a requirement AB 2013 lacks.

The additional state-level disclosure landscape vendors and buyers must track

California and the EU aren't the only jurisdictions writing rules here. A cluster of other state laws is building overlapping, non-identical disclosure duties, and vendors operating across state lines have to satisfy all of them at once. So you need to evaluate each one separately instead of assuming AB 2013 compliance covers the rest.

Connecticut amended its Data Privacy Act through Public Act No. 25-113, effective July 1, 2026. Connecticut's approach is narrower than California's in scope: it's a disclosure duty aimed at consumer privacy notices, not a dataset inventory.

Colorado took a business-to-business route with its Artificial Intelligence Act. The law's implementation timeline has already shifted once: it was originally deferred to June 30, 2026, then the original statute was repealed and replaced by SB 26-189, signed May 14, 2026, which now takes effect January 1, 2027.

Colorado's law also sits in a cloud of federal uncertainty. A December 2025 executive order told federal agencies to challenge state AI laws if they considered them overly burdensome or inconsistent with a national AI framework. On the federal side, a bill called the AI Foundation Model Transparency Act of 2026 was introduced as H.R. 8094 on March 26, 2026, would direct the FTC to set public disclosure requirements covering training data sources, data composition (including size, demographic information, language information, and other attributes), and computational power. It remains proposed legislation, not law, but it signals where federal appetite is heading.

The TRAIN Act's Copyright-Access Mechanism

Everything described so far involves a vendor publishing a summary and hoping it satisfies a statute. The TRAIN Act works differently. Introduced January 22, 2026, it creates a subpoena mechanism that lets individual copyright holders compel production of specific training records, and no categorical summary can stand in for that.

The bill, filed as H.R. 7209 by Representatives Madeleine Dean (D-PA) and Nathaniel Moran (R-TX), carries bipartisan sponsorship and a long list of endorsers: the RIAA, SAG-AFTRA, the Recording Academy, BMI, the Copyright Clearance Center, the Human Artistry Campaign, the Actors' Equity Association, the American Federation of Musicians, IATSE, the Nashville Songwriters Association International, Global Music Rights, and others. That roster reflects where the pressure is coming from: creative industries whose members believe their work shows up in training sets without permission.

The mechanism itself is narrow and procedural. Rights holders can only ask about their own copyrighted works, not a vendor's broader training dataset, so the TRAIN Act doesn't function as a backdoor into categorical disclosure. It's targeted, not comprehensive.

The consequence for non-compliance is where the mechanism gets teeth. Courts retain a safeguard against abuse: Rule 11 sanctions remain available against rights holders who request subpoenas in bad faith. Still, the bill hasn't become law, and even if it gets enough congressional support, it could face a veto given the current administration's deregulatory posture. More than 70 active copyright lawsuits against AI companies are already pending, and the financial stakes are visible in the Bartz v. For vendors, the lesson sits apart from whether the TRAIN Act ever passes: a public disclosure page is not the same thing as a records system that can survive a work-specific subpoena.

What OpenAI, Anthropic, Google, and xAI Disclosed

Statutes describe what should be disclosed. Filings show what vendors actually chose to say once the deadline arrived, and the early AB 2013 filings from major vendors share a pattern: high-level categorical description that satisfies the statute's language without approaching the dataset-specific detail the law was apparently written to produce.

Anthropic's filing illustrates the gap well. AB 2013 asks for the number of data points, allowing general ranges. Anthropic's response described Claude models as trained on "large-scale datasets comprising billions of tokens of text data, images, and multimedia content." Analysis of that language found it falls short of publicly known figures for comparable models by an estimated four to six orders of magnitude, and the filing makes no specific mention of pirated training data that has surfaced in litigation elsewhere. Google's Gemini disclosure takes a somewhat fuller approach, covering web text, code, image, audio, and video data with source categorization and a description of its data-cleansing process. Google's disclosure includes source categorization; dataset-level specificity still doesn't.

xAI chose confrontation over compliance. On March 5, 2026, Judge Jesus G. The court added that xAI's "resort to generalizations and hypotheticals about the AI model development industry" made it hard to conclude the company had "carried the heavy burden of showing a likelihood of success in proving that trade secrets are at play here."

That dispute is headed for appellate review. On July 16, 2026, the Ninth Circuit heard oral argument in X.AI LLC v. Bonta, No. 26-1591, with a ruling expected later in 2026. Whatever the court decides will determine whether categorical-summary disclosure mandates like AB 2013 can survive constitutional challenge at the circuit level, and that question reaches well beyond xAI's own compliance posture.

The disclosure-without-verification problem enterprises cannot ignore

Setting these filings side by side reveals a structural weakness: every current disclosure regime relies on a vendor's own account of its own practices, and nothing in AB 2013, EU Article 53, or the proposed TRAIN Act requires independent verification of that account.

AB 2013 never defines "high-level." It provides no compliance mechanism and no trade secret protection. The distance between a filing that technically satisfies the statute and one that actually informs a buyer is unbounded, and nothing in the law closes it. The EU's Article 53 template asks providers to describe how they honored text-and-data-mining opt-outs, but neither the EU nor California requires anyone to check whether those opt-out representations are true. A vendor can describe its process in good faith or in marketing language, and the statute reads the same either way.

That leaves vendors navigating two failure modes, both of them rational responses to an indeterminate standard. Consumers evaluating an AI product tend to care about how well it performs, not the technical composition of its training corpus.

For enterprise buyers, a published disclosure functions as a starting point for due diligence. A compliant disclosure page says a vendor filled in twelve boxes. It says nothing about whether the underlying practices are accurate, whether they're complete, or whether the vendor carries AI-specific risks, like prompt injection, data exfiltration paths, or compliance gaps, that a generic governance checklist was never built to catch. Continuous monitoring of vendor AI assets is the control that fills that gap. Disclosure regimes assume someone is checking the vendor's claims against reality. None of the statutes actually build that checking function in, so the task falls to the enterprise doing the buying.

What Enterprise Procurement and Compliance Teams Should Extract

Given that verification is left entirely to the buyer, the useful move for procurement and compliance teams is to treat each disclosure as a structured artifact to interrogate rather than a document to file away once it's received.

Start with AB 2013, where you can translate the twelve required categories almost directly into procurement questions. On data sources and intellectual property, ask whether the vendor discloses copyrighted or trademarked material in its training data and what licensing arrangements, if any, the filing describes. On personal information, check whether the disclosure acknowledges CCPA-defined personal information in the training datasets and what opt-out mechanisms it lays out. On data volume, look closely at whether the figure given is specific enough to mean anything or whether it resolves to something as broad as "billions of tokens," the way Anthropic's filing did. On synthetic data, confirm whether its use is disclosed at all and whether a functional description accompanies it. And on collection timing, check whether the filing flags that data collection is ongoing, since that signals a dynamic risk profile.

Beyond AB 2013, ask vendors directly whether they maintain training records detailed enough to respond to a copyright subpoena under a framework like the TRAIN Act, even though the bill hasn't passed yet. A vendor that can't answer that question affirmatively is carrying litigation exposure that has never been quantified, and that exposure often transfers to the enterprise customer through indemnification clauses buried in the contract. For deployments touching Connecticut or Colorado, confirm that vendor privacy notices address Connecticut's July 1, 2026 requirement around LLM-related personal data, and for any Colorado high-risk AI system deployment, request the business-to-business documentation that Colorado's AI Act requires developers to hand over to deployers.

Keep in mind throughout that a disclosure checking all twelve AB 2013 boxes is not proof that the underlying practices are accurate or that the training data is free of the attack surfaces, like prompt injection vectors, data exfiltration paths, or compliance gaps, that disclosure mandates were never designed to catch. Continuous AI risk monitoring of vendor assets is the complementary control these frameworks assume exists somewhere but never actually require. And because AB 2013's retrospective scope reaches back to systems released or modified after January 1, 2022, procurement and compliance teams should be auditing a vendor's historical training data practices, not just the disclosure sitting on the vendor's website today. The law looks backward. Due diligence has to as well.