The EU AI Act asked AI labs for a 'sufficiently detailed' training data summary. Nobody defined sufficient.
Seven AI providers filed the EU's training data template box by box. Researchers still failed one of the first five summaries they scored. A form tells you a box is filled. Only a rubric tells you it was answered.
Article 53(1)(d) of the EU AI Act says providers of general-purpose AI models have to publish a "sufficiently detailed summary" of their training data. On July 24, 2025 the European Commission published the mandatory template for it. The obligation started nine days later. A year on, the summaries are public, and the interesting split isn't who filed. It's what the filings actually say.
Kieran Maynard compared 11 filed summaries from 7 providers in July. Google, Meta, Microsoft, OpenAI, Hugging Face, Swiss AI and SpeakLeash used the template. Anthropic, Mistral and xAI still describe their training data the old way, as prose in a model card. That isn't a breach, yet. Models already on the market before August 2, 2025 have until August 2027 to file.
Filling in the template didn't guarantee a good answer, and that's the finding that matters more. Researchers Dick Blankvoort, Harshvardhan Pandit and Maximilian Gahntz scored the first 5 public summaries on transparency and usefulness. Microsoft's Phi summary, filed on the official template, failed. Hugging Face's SmolLM and Swiss AI's Apertus, from much smaller teams, clearly passed. Apertus got straight A's. Same template. Different effort. The same researchers also flagged "significant shortcomings" in the template itself.
The Code of Practice tells the same story from the other side. When it opened for signatures in July 2025, xAI signed only the safety and security chapter and called the copyright provisions "clearly an over-reach." Meta didn't sign at all. The chapters that would have turned disclosure into a commitment, instead of a minimum filing, were the first ones a major lab opted out of.
I've worked this exact problem before, just without the EU letterhead. Running QA on LLM training data pipelines, "acceptable" meant nothing until someone wrote down what it had to contain. Which fields needed a real answer. What counted as evidence and what counted as a placeholder. Skip that step and you get exactly this spread. Some people write the honest answer. Some write the minimum that clears the form. And the form can't tell you which is which.
It's the same failure I wrote about when acceptance criteria became evals. "Good enough" and "sufficiently detailed" break for the same reason. A requirement without a scoring rubric isn't a requirement. It's a mood, and every vendor reads the mood the way that costs them least.
So if you're writing "sufficiently detailed" into a spec, a vendor contract, or a filing your company has to answer, define it before someone downstream has to. Name the fields that count as answered, not just present. Dataset names, not categories. License status, not "various sources." Synthetic data share, not silence. Then score every submission against that list before anyone calls the box checked.
The AI Office's enforcement powers started on August 2, 2026, and the rest of the Act leans on the same soft words: reasonable, adequate, appropriate. Each one will get answered the way this one was. On time, technically correct, and by whichever definition was cheapest to write.
A template hands everyone the same boxes. Only a rubric tells you which ones got answered.