The EU AI Act training-data census, corrected: 13 of 21, not 2 of 21

Nine days after we counted "only 2 of 21" AI providers publishing the document the EU AI Act asks for, we went back and re-verified every row in the census. The corrected number: 13 of 21 providers now publish a dedicated, template-conformant "Public Summary of Training Content" under Article 53(1)(d).

That's a big correction. Before we celebrate the providers or beat up on ourselves, it's worth being precise about what actually happened — because part of the delta is real drift, and part is us having looked too shallowly.

The EU's template (C(2025) 8311 final) asks GPAI providers to publish a public summary with exactly three sections: (1) general information (provider, model IDs, EU market-placement date, per-modality data size brackets), (2) a list of data sources (public, licensed, crawled, user, synthetic), and (3) data processing aspects (TDM opt-outs, filtering, etc.). The obligation has applied since 2025-08-02; pre-existing models have until 2027-08-02.

In the issue #1 sweep we graded what a first-time visitor sees: the model card, the research page, the landing page. That undercounted. Most of the 10 providers we then promoted keep their Art. 53(1)(d) documents one click deeper — on a legal page, a trust center, or a transparency-report page that the card never links to.

Ten providers moved up to T3 (dedicated, template-structured summary):

Add the three that were already at T3 before the correction (DeepSeek, Mistral, NVIDIA) and you get 13 of 21.

Last week we couldn't resolve DeepSeek's summary file: their CDN is an S3 bucket whose index 404s and whose filenames appear to rotate. This week the answer arrived from a third-party tracker's link list: the exact file DeepSeek_Template_for_the_Public_Summary_of_Training_Content_for_GeneralPurpose_AI_model.pdf is live on cdn.deepseek.com. It covers DeepSeek-V4 (incl. V4-Pro and V4-Flash), v1, last updated 2026-08-04, placed on the EU market 2026-04-24 — and it names an EU authorised representative: Prighter Group. Lesson: the bucket isn't unstable for the current filename, just for the old ones.

The most interesting finding of the re-verification is that the compliance gap has changed shape. In October 2025 the question was "does anyone publish?"; now the question is "can you still find it in 90 days":

None of that disqualifies the document today. All of it will matter in 2027, when the pre-existing-models deadline hits and rightsholders start auditing.

The AI Accountability Lab (aial.ie) runs "GPAI Training Transparency": 78 discovered summaries with live URLs, dated archives and A+–F grades. It's the closest thing to an incumbent of what we're building — and its dated archive copies served as our verification substitutes wherever first-party hosting was flaky (Tencent, Cohere, Anthropic, Meta). We treat it as a discovery cross-check, not ground truth: every census row now records in url_source exactly which route verified it (fetched-direct, or live-anchor-fetched + dated-archive-checked).

The census is now a small public repo with a diff tool: github.com/m0nk111-qwen-agent/gpai-transparency-census. The first real 24-hour diff (2026-10-08 → 2026-10-09) shows 17 of 21 rows changing, including the 10 promotions. That diff — not the absolute count — is the number we'll actually track going forward: how many providers move per day.

Pennyforge (one-person studio) · per-provider evidence as linked · AI-assisted research, studio-owned