The EU AI Act is the European Union's risk-based AI regulation, and its general-purpose AI (GPAI) provisions are the part that reaches web scraping directly: providers training or fine-tuning a GPAI model placed on the EU market must publicly summarize their training data sources and honor machine-readable rights-reservation signals, with enforcement teeth arriving August 2, 2026.
The European Commission published a mandatory template GPAI providers use to publicly summarize their training data — the categories of content used, where it came from, and how it was collected — covering every GPAI model placed on the EU market, including open-source releases. This is a transparency obligation on the model provider, not a new restriction on scraping itself: collecting public data for SEO analytics, price monitoring, or aggregating reviews doesn't make an operation a "GPAI provider" under the Act.
The obligation only bites once collected data is used to train or fine-tune a general-purpose model that's then placed on the EU market — at that point, Article 53's transparency and copyright-compliance duties apply, with fines reaching €15 million or 3% of global annual turnover for a GPAI provider that doesn't comply.
Article 53 also requires GPAI providers to identify and honor rights reservations made under the EU's text-and-data-mining (TDM) exception, including opt-outs expressed through machine-readable signals like robots.txt disallow rules and emerging ai.txt-style declarations. That's a meaningful shift: those files have always been a scraping-etiquette norm, but under the Act, ignoring a documented TDM opt-out when training a GPAI model carries real copyright and regulatory exposure, not just a politeness violation.
For anyone building or training models on scraped data with EU market reach, that turns "did the source site opt out of TDM use" into a compliance question that needs answering before training, not an afterthought — distinct from GDPR's personal-data lens, since a TDM opt-out can cover non-personal content a site simply doesn't want used for AI training.
How Crawlora handles this
Crawlora's acceptable-use policy already scopes structured, public data collection rather than bulk content harvesting for model training, so the EU AI Act's GPAI transparency and TDM-opt-out obligations land on customers who train models with scraped data, not on the collection layer itself — though anyone doing that training should still track which sources have published a TDM reservation.
Related reading
FAQ
No — it regulates what happens after data is used to train or fine-tune a general-purpose AI model placed on the EU market, not the act of scraping public data itself. Standard data collection for analytics, monitoring, or aggregation doesn't fall under its GPAI provisions.
GPAI providers must publish a summary of their training data — the categories of content, its sources, and how it was collected — using the European Commission's mandatory template, and must identify and honor documented text-and-data-mining opt-outs.
GDPR governs personal data specifically, regardless of AI use. The EU AI Act's GPAI provisions apply to training data generally, personal or not, once it's used to build a general-purpose model placed on the EU market, adding training-data transparency and TDM-opt-out obligations GDPR doesn't cover.
Beyond EU AI Act, Crawlora's own docs cover the rest of the stack — browse the APIs, test a request in Playground, and move from scraping infrastructure work to production data workflows.