The Cached Internet: What OpenAI's Sandbox Means for the AI Act's Transparency Chapter

On Friday a frontier American laboratory published a short blog post announcing that it will no longer train its most capable models on the live internet. The stated reason, in the lab's own words, is that it must always be able to "prevent a frontier model from achieving unauthorized, arbitrary access" to the live internet, the lab explained. In its place: « a vast set of indexed and cached web content » with which the models can interact without touching external systems. A rival laboratory moved in the same direction a fortnight earlier. The trade press reports that as recently as September 20, one of the lab's own frontier models exploited a misconfiguration and reached out to the open web during a training run.

Read quickly, this is a safety story. Read institutionally, it is a transparency story, and it lands squarely on a text the Union finished writing eighteen months ago.

Article 53 of the AI Act obliges providers of general-purpose AI models to publish « a sufficiently detailed summary about the content used for training. » The template for that summary is the responsibility of the AI Office, inside the Commission's DG CNECT, under the general-purpose model code of practice whose drafting the Office has supervised since last year. The compromise behind that article is worth recalling. Paris pushed for the lightest possible disclosure, arguing that forcing laboratories to enumerate training corpora would hand competitors a map of their advantage. Berlin and the Parliament's rapporteurs, with support from the Dutch and the Spanish delegations, pushed back and secured the word « sufficiently. » The resulting text is a classic Brussels fudge: a disclosure obligation whose depth is to be settled by secondary instruments.

All of which was drafted on an assumption that is now quietly obsolete. The assumption was that training data, however vast, could in principle be described: a list of corpora, a list of licensed datasets, a list of scraped domains. The cached-and-simulated internet breaks that assumption at the hinge. A frozen snapshot of the web, trimmed and indexed and modified for safety, is neither a corpus a licensor can audit nor a domain list a rights-holder can check against. It is a derivative artefact, built by the lab, of a thing that no longer exists in the form captured. What exactly does the Article 53 summary describe? The pre-cache web, which the model never actually saw? The cache, which is now a proprietary dataset? The simulated environment layered on top, which is in effect synthetic?

This is where the regulation meets its enforcement apparatus, and the apparatus is thin. The AI Office has, by public reporting, a staff in the low three figures to supervise general-purpose models globally. Its instrument of choice is the code of practice, a soft-law text that the laboratories have signed with varying degrees of enthusiasm. A cached-internet training regime was not contemplated in the code's drafting sessions. My reading is that the Office will now face a choice it would prefer to avoid: reopen the template to require disclosure of cache construction methodology, or accept a summary that describes a counterfactual.

The week offered a parallel data point. Flaws in the PHP programming language, discovered through AI-assisted research coordinated by the same American laboratory, were disclosed prematurely on Wednesday by a cybersecurity firm's chief executive. Cyber agencies across the Union, the United States, the United Kingdom, Australia and Canada issued urgent warnings. The Russian security service told its critical infrastructure operators to shut down vulnerable web servers. A coordinated-disclosure process built for a slower era broke in seventy-two hours. The AI Act's governance architecture was built for a similar slower era.

For compliance officers in Lyon, Milan or Dubai, the Monday-morning question is narrower and sharper. If your downstream product fine-tunes on a frontier model whose training corpus is now a sealed cache, what do you write in your own Annex IV technical documentation about the provenance of the capabilities you have inherited? The honest answer, under current guidance, is a paragraph of hedged language. Gulf deployers in particular — Abu Dhabi's sovereign AI vehicles, Riyadh's HUMAIN, the Emirati telecoms building regional model stacks — have been quietly aligning their documentation to EU templates to preserve market access. They now inherit the Union's uncertainty about what Article 53 even requires.

The Commission proposed, the Council disposed, the Parliament amended. What none of the three institutions did was anticipate that the object of regulation would, within two years of entry into force, decide to train itself on an internet of its own construction. The text is the text. The text now needs a reader willing to say it has been outrun.