The EU Database Right and Licensed Training Data

This page is general information, not legal advice. Confirm requirements with counsel for your jurisdiction and use case.

What the sui generis right protects, and why it differs from copyright

The database right protects investment, not creativity, so a table of facts with no copyrightable expression can still be protected. Directive 96/9/EC defines a database as a collection of independent works, data or other materials arranged in a systematic or methodical way and individually accessible by electronic or other means. That definition easily covers a CRM export, a ticketing system's issue table, a parts catalog, a pricing history or a relational schema with foreign keys between orders, line_items and customers.

Two separate layers can sit on the same asset. Copyright under Article 3 protects only the selection or arrangement of contents where it is the author's own intellectual creation; the sui generis right under Article 7 protects the maker against extraction and re-utilization of a substantial part where there was qualitatively or quantitatively substantial investment in obtaining, verifying or presenting the contents. Individual records can additionally carry their own rights, for example free-text support notes, engineering documents or contract clauses that are themselves literary works.

The Court of Justice has long read "obtaining" narrowly: investment in creating data (as with fixture lists in British Horseracing Board, C-203/02) is distinct from investment in seeking out and collecting existing data. For AI buyers this cuts both ways. A company that generates its own operational records as a by-product of its business may hold a weaker database right in them than a data aggregator that spends heavily collecting and verifying third-party records, yet the first company usually holds stronger contractual and factual control over the data.

When extraction for model training engages the right

Copying a substantial part of a protected database into a training pipeline is the act the right is built to control. Article 7(2) defines extraction as the permanent or temporary transfer of all or a substantial part of the contents to another medium by any means or in any form, and re-utilization as making them available to the public. A bulk export to Parquet, an ingest into a feature store, or a scrape of a listings site into object storage are all transfers to another medium.

The CJEU's 2021 judgment in CV-Online Latvia v Melons (C-762/19) is the most relevant recent authority. The Court held that a specialized search engine copying and indexing the substantial contents of a job-ad database onto its own server was extraction and re-utilization, but that these acts are prohibited only where they adversely affect the maker's investment, that is, where they risk depriving the maker of income intended to redeem the cost of that investment. Commentators read this as adding a risk-to-investment element to the infringement test and as a shift from Innoweb (C-202/12).

Four practical points follow for training use:

• Substantiality is assessed on the protected database, not your corpus. Taking 40% of one vendor's catalog is a large extraction even if it is 0.01% of your pre-training mix.
• Repeated small pulls can add up. Article 7(5) prohibits repeated and systematic extraction of insubstantial parts that conflicts with normal exploitation, which is how incremental crawls and nightly API syncs are typically framed.
• Transformation does not cure extraction. Normalizing fields, deduplicating or converting to JSONL is still a transfer of contents to another medium.
• Model weights are an open question. Whether a trained model "re-utilizes" database contents has not been settled by the CJEU; treat claims either way as unresolved and avoid relying on them.

How the DSM text and data mining exceptions interact with database extraction

The DSM Directive's TDM exceptions expressly cover the database right, so the analysis for structured data mirrors the copyright analysis. Article 4 of Directive (EU) 2019/790 requires Member States to provide an exception for reproductions and extractions of lawfully accessible works and other subject matter for text and data mining, including extractions under Article 7(1) of Directive 96/9/EC [1]. The DSM Directive also amended the Database Directive to align its exceptions [9].

Article 3 is a narrower exception for research organizations and cultural heritage institutions doing scientific research; Article 4 is the general exception available to commercial developers [2][10]. Under Article 4 the exception applies only where use has not been expressly reserved by rightholders "in an appropriate manner," such as machine-readable means for content made publicly available online, and copies may be kept only as long as necessary for the mining [1]. Commentary flags real uncertainty about where TDM ends and model training begins, and about what counts as an effective reservation [5].

The decisive buyer point: the Article 4 exception does not survive a contract. Article 7(1) of the DSM Directive makes contractual provisions contrary to the Article 3 research exception unenforceable, but there is no equivalent protection for Article 4, so website terms, API terms and data license clauses that prohibit mining or AI training generally govern a commercial user. For a fuller treatment of reservations, see our guide to EU text and data mining opt-outs under DSM Article 4.

Since 2 August 2025, Article 53(1)(c) of the AI Act has required general-purpose AI model providers to maintain a policy to comply with Union copyright law and to identify and respect Article 4(3) reservations, with AI Office enforcement powers applying from 2 August 2026 for new models [3]. The GPAI Code of Practice, published 10 July 2025, includes a Copyright chapter describing how signatories handle reservations, though adherence is voluntary and not by itself proof of compliance [4].

Territorial scope: EU makers, UK retained law and the US gap

The sui generis right protects only qualifying makers, so the same table can be protected in Paris and unprotected in Ohio. Article 11 limits protection to makers who are nationals or habitual residents of a Member State, or companies formed under Member State law with their registered office, central administration or principal place of business in the Union. A US company's database is not protected by the EU right unless the maker otherwise qualifies, for example through an EU subsidiary that made the investment.

The UK keeps its own database right under the Copyright and Rights in Databases Regulations 1997, but since 1 January 2021 new UK protection depends on UK qualification, and UK makers no longer qualify for the EU right. The UK did not implement the DSM Directive (the legislation.gov.uk copy cited here is the EU text as it stood at Brexit), and its own copyright exception for computational analysis, CDPA section 29A, remains limited to non-commercial research by a person with lawful access [7], so it does not clear commercial training on UK-protected databases.

The United States has no sui generis database right; since Feist (1991), facts are not copyrightable and only original selection or arrangement is protected. US data deals therefore rest on contract, trade secret, computer-access law and copyright in individual records. The Copyright Office's Part 3 report on generative AI training addresses copyright and fair use, not database rights, and remains a pre-publication version as of October 2026 [6]. The CJEU's Ryanair judgment (C-30/14) points the same way inside the EU: where a database is unprotected by either right, its maker may restrict use contractually.

Database right diligence checklist for structured training data

The fastest way to manage database-right risk is to establish who made the database, where, and under what terms you are taking it, then record the answer next to the dataset. Use this table during intake and keep it in your dataset documentation, alongside fields such as upstream sources and intended use [8].

Illustrative example: invented to show structure; it does not describe an available dataset.

What to put in the license for a structured dataset

A license is the instrument that turns an unclear database-right position into a defined permission. Whether or not the EU right exists, write the grant so it covers each act your pipeline performs: extraction and copying to your environment, transformation, use for pre-training, supervised fine-tuning and evaluation, retention of derived artifacts, and treatment of model weights after the term ends.

Practical drafting points counsel at AI labs commonly raise:

• Grant both rights expressly. License "copyright, database rights and any similar rights" rather than "copyright" alone, so the sui generis right is not left out by drafting.
• Name the database and the extracts. Identify tables, fields, date ranges and record counts per delivery so the substantial-part question is answered by the license itself.
• Address recurring deliveries. If you will receive monthly snapshots, the license should cover each one.
• Get a chain-of-title representation. Ask the licensor to confirm it made the database or holds rights from the maker; see chain of title for AI training data and the data rights attestation template.
• Separate the data question from the personal data question. Database rights say nothing about GDPR; de-identification and lawful basis are covered in our privacy guide.

Ownership of enterprise records is often less obvious than it looks; our answer on who owns enterprise data explains the distinction between holding data and having the right to license it. For relational sources specifically, see multi-table relational data for relational deep learning.

How SourceX handles structured operational data

SourceX sources operational datasets from US companies on request and manages the commercial process, including licensing agreements and ongoing purchases. Every dataset is rights-reviewed for ownership and consents and delivered under a license that defines the records, uses, term and delivery, and every release is approved by the supplying company. Personal details such as names, emails, phones and account numbers are removed or replaced before delivery, with the method recorded and a sample checked, although no method is perfect. Because datasets are sourced on request rather than held in stock, a request does not guarantee a match; you can describe the structured data you need and the process starts with finding suppliers that hold it.

For the wider framework on source, rights and permitted use, start from the provenance hub or the AI data hub.

Sourcing structured training data under a clear license

SourceX finds US businesses that hold the operational data you describe, assesses data and licensing permissions, and agrees pricing and allowed uses in a license before anything is delivered. Diligence materials on source, rights, preparation and allowed use are prepared per dataset, and nothing is contracted until a supplier agrees. Start a buyer request at SourceX.