EU's AI Regulation Leaves Key Data Gaps

Brussels Left the Know-How Boundary Blank. AI Licensors Will Pay.

The revised EU Technology Transfer Block Exemption Regulation, in force since May 1, 2026, refuses to say where proprietary AI training data ends and "know-how" begins — and that silence is the story.

Regulation (EU) 2026/877 — the first full rewrite of the Technology Transfer Block Exemption Regulation (TTBER) in more than a decade — entered into force on May 1, 2026, and for the first time contains a dedicated section on data licensing. The section carves out three categories of licensed data — know-how, sui generis databases, and "other forms of data" — and declines to draw the boundary between them. That omission, at the exact moment the commercial value of AI has migrated from algorithms to curated training corpora, converts every foundation-model licensing deal in the EU into a self-assessment gamble. The winners are large incumbents with in-house competition teams; the losers are the mid-cap licensors and open-source challengers who will now negotiate under legal fog until the Court of Justice, or the Commission, fills in the map.

What actually changed on May 1

The Commission published the new regulation and its accompanying Guidelines in the Official Journal on April 21, 2026, and the safe harbour switched over on May 1. The European Commission's TTBER page confirms the regime runs to April 30, 2038, with a one-year transition — expiring April 30, 2027 — for legacy agreements that met the old thresholds but not the new ones.

The block exemption operates as a safe harbour. Under Regulation (EU) 2026/877, technology transfer agreements between two undertakings are presumed compatible with Article 101(3) TFEU if the parties stay under combined market-share thresholds of 20% among competitors or 30% among non-competitors and avoid a defined list of hardcore restraints. Fall outside those lines and the licence needs individual assessment — with the burden on the parties.

The novelty is scope. The Commission's explanatory note is unusually candid about why: the 2014 rules were drafted before data licensing became a commercial category, and the evaluation phase found that "businesses do not know whether the TTBER can apply to data licensing agreements." The Commission's impact assessment is blunter still: "data is a complex asset that does not always fit easily into existing categories of technology or intellectual property rights."

The three buckets — and the gap between them

Paragraph 63 of the new Technology Transfer Guidelines frames the taxonomy in a single sentence:

"The TTBER does not cover the licensing of data, except where the data that is being licensed constitutes know-how within the meaning of Article 1(1), point (i), of the TTBER … or one of the technology rights listed in Article 1(1), point (b), of the TTBER, or where the data licensing takes place in a technology transfer agreement and meets the conditions of Article 2(3) of the TTBER."

Read that carefully. Data enters the safe harbour only if it is know-how, is a listed technology right, or is bundled into an agreement whose primary purpose is licensing something else. The Guidelines then extend TTBER principles "by analogy" to databases protected by copyright or the sui generis right under Directive 96/9/EC, and treat everything else as "other forms of data" requiring case-by-case Article 101 assessment.

Konstantin Voropaev, writing for the Kluwer Competition Law Blog on July 9, 2026, identifies the doctrinal soft spot: the Guidelines acknowledge that some datasets already qualify as know-how, but never explain how a licensor should reach that conclusion. That is the missing boundary of the headline.

Why the boundary matters more for AI than anywhere else

Article 1(1)(i) TTBER defines know-how as "a package of practical information resulting from experience and testing" that is secret, substantial, and identified. Voropaev's core insight, which most law-firm client alerts skated past, is that the definition is deliberately functional — it says nothing about factories, chemistry, or code. If a curated dataset is secret, useful for producing the contract product, and documented with sufficient precision, it should qualify. Whether the "product" is a stainless-steel alloy or a fine-tuned foundation model is legally irrelevant.

That is the theory. The commercial reality is that AI training data is the asset class most likely to fail one or more of those tests in practice. Consider the three prongs:

Secrecy. Most large training corpora are assembled from a mix of licensed publisher content, web-scraped material, synthetic data, and human-reinforcement annotations. The European Parliament Research Service notes that general-purpose AI providers "need large datasets, which may include copyrighted materials." Ingredients that are public — Common Crawl, arXiv, Wikipedia dumps — cannot be secret in the TTBER sense, even if the combination is proprietary. Where does mixing end and secrecy begin?

Substantiality. The Commission's own expert report by Peter G. Picht, commissioned during the review and published in 2025, records the shift explicitly: as the patentability of AI systems has narrowed, developers have migrated to trade-secret protection, and the same is happening to machine-generated databases. Substantiality — the requirement that the information be "significant and useful" — is precisely where dataset licensors will contest treatment.

Identification. This is the killer. Article 1(1)(i) demands that the licensed know-how be "described … in a manner that makes it possible to verify that it fulfils the criteria of secrecy and substantiality." A 15-trillion-token training corpus, evolving weekly, resists that description. The recent California AI Training Data Transparency Act (AB 2013) — effective January 1, 2026 — forces developers to publish a "high-level summary" of datasets, but such summaries are unlikely to satisfy the granular identification the TTBER expects.

Who this quietly favours

The doctrinal ambiguity is not neutral. It is a distributive event.

Large incumbents — OpenAI, Google DeepMind, Anthropic, Meta, Mistral — can afford compliance architecture that fits their datasets into whichever category maximises safe-harbour coverage. They have already inked flagship data deals: Reuters, via the BBC, reported Google paid Reddit roughly $60 million for training-data access; Reddit disclosed licensing deals worth over $200 million; and OpenAI has signed partnerships with Condé Nast, the Associated Press, News Corp, the Financial Times and Axel Springer. Those contracts are drafted by lawyers who will find a way to describe the dataset as know-how — or bundle it into a model-weights licence that qualifies as a technology transfer.

The losers are twofold. First, mid-cap European licensors — think publisher consortia, medical-imaging providers, and Copernicus-derived Earth-observation dataset holders — who now face expensive individual Article 101 assessment for standalone data licences that fall into the "other forms of data" bucket. Second, open-weight challengers whose competitive proposition depends on licensing curated slices of proprietary data at pace, without long compliance loops.

The Max Planck Institute for Innovation and Competition warned about precisely this outcome. In its April 25, 2025 position statement, the Institute argued that if the Commission chose not to extend TTBER scope to data rights, it should at minimum "provide clear guidance." The Commission chose neither: it extended the Guidelines' principles "by analogy" without clarifying who qualifies for the analogy.

The primary document says the quiet part out loud

The Picht expert report — a primary Commission document — anticipates the very problem the final Guidelines fail to resolve. It maps data licensing "hotspots," identifies AI training corpora as a distinctive transaction category, and concludes that trade-secret protection is now the dominant legal regime for machine-generated datasets. Picht flags the tension between the traditional TTBER framework and multi-party, dynamic data portfolios that AI training generates.

The Commission's Data Union Strategy communication of December 2025 doubled down on the same point from the policy side: "inconsistent national implementation and uncertainties around trade secrets are some of the remaining challenges." Brussels knew the boundary problem was real. It chose to defer.

That is a defensible choice for a block exemption regulation, which is meant to be a rules-based safe harbour, not a full doctrinal codex. But it exports the interpretive burden to national competition authorities, arbitral tribunals and — eventually — the Court of Justice.

The second-order effect: forum-shopping through drafting

Sophisticated licensors will react by drafting around the ambiguity. Expect three moves.

First, bundling. Data licences will increasingly ride alongside a nominal technology-rights licence — model weights, a fine-tuning API, or a proprietary embedding — to qualify under Article 2(3) as ancillary provisions "directly related to the production or sale of the contract products." That converts a pure data deal into a technology transfer, dragging the dataset inside the safe harbour without a category fight.

Second, know-how framing. Sellers will insist on contractual language identifying datasets as trade secrets, complete with the "manner of identification" documentation that Article 1(1)(i) requires. The CIGI paper by Burcu Kilic on trade-secret protection in the AI era documents that this framing is already the default in large LLM development. The TTBER now gives it competition-law upside.

Third, transatlantic arbitrage. US courts are producing a parallel case law — the Third Circuit's ROSS opinion distinguishes pretraining and fine-tuning; the Northern District of California discovery order in the Meta Llama litigation treats fine-tuning datasets as discrete production units. Those distinctions do not translate cleanly into TTBER categories, and cross-border AI deals will end up litigated in the jurisdiction most likely to bless the licensor's classification choice.

What to watch next

Three catalysts will decide whether the missing boundary hardens or blurs further.

• The GPAI Code of Practice. The European Parliament Research Service flagged May 2025 as the target for the AI Act's general-purpose AI Code of Practice, which sets out training-data disclosure standards. Its final wording will determine what a workable "identification" of training data looks like — the exact test that Article 1(1)(i) demands.
• Copyright Directive review. Article 30 of Directive 2019/790 requires a review by June 2026. Any revision to the text-and-data-mining exceptions will change the underlying legality of the corpora that TTBER licensors are trying to characterise.
• First DG COMP decision under Article 2(3). The Commission's Data Union Strategy commits to informal-guidance letters on data pooling. The first published response addressing whether an AI training deal qualifies as a technology transfer will do more to draw the boundary than any Guideline paragraph.
• The transition cliff on April 30, 2027. Every legacy licence that used the old TTBER as its shelter must be conformed by then. Expect a wave of renegotiations in Q1 2027 — and the first serious test of how counterparties actually apply the new taxonomy.

Diplomat View

The Commission's decision to draft a data-licensing section without defining the know-how/data boundary is not a drafting oversight. It is a deliberate delegation of interpretive risk to the market — and, ultimately, to litigation. Read against the Draghi report and the Data Union Strategy, both of which prioritise competitiveness over legal certainty, the choice looks calculated: give Europe's AI ecosystem enough safe-harbour flexibility to keep pace with US and Chinese incumbents, and absorb the doctrinal cost later.

That bet works only if two conditions hold. If national competition authorities converge on a permissive reading of "know-how" that admits curated training datasets, and if the Commission issues at least one informal guidance letter before the April 30, 2027 transition cliff, the missing boundary becomes a manageable ambiguity. If either fails — if Bundeskartellamt and the Autorité de la Concurrence diverge, or if DG COMP stays silent — expect the first serious enforcement case in 2028 to concern a mid-cap European licensor caught between the buckets. The forecast revises if the Court of Justice takes an early preliminary reference on Article 1(1)(i) in an AI context; that would compress the timeline sharply. Either way, the story of this reform is not what it regulated, but what it left unwritten.

The bottom line

The revised TTBER's silence on where AI training data sits inside its know-how framework is the reform's most consequential feature. It hands the largest incumbents a drafting-based safe harbour while forcing mid-cap licensors into individual Article 101 assessment, and it defers to litigation what a clearer definition could have decided in April 2026. Watch April 30, 2027 — the day the transition period expires — as the moment the missing boundary stops being academic.