The session can be in English or Italian, depending on who is in the room.
Providers of general-purpose AI models in Europe now have concrete obligations to document and disclose information about their training content. The problem is that everyone downstream inherits the same questions without really being able to answer them. If you integrate a model into a product, how much can you actually say about where its knowledge comes from?
Compliance is moving faster than the tooling. We can verify a licence. We can document a software dependency. We can measure whether a model is open and test it against benchmarks. But when we move from software to knowledge, the situation becomes much less clear. We still have no accepted way to describe source-level provenance, to connect model behaviour back to upstream sources, or even to understand whether those sources are still maintained and healthy.
And this is not only a compliance problem. Open content, open data and Free Software are upstream dependencies of today’s AI systems. The software community already knows very well what happens when everybody depends on an upstream and nobody really takes care of it. With the CRA, this discussion has moved quite far for software. For knowledge sources, we are much more at the beginning. We do not have a commonly accepted knowledge bill of materials. Attribution at application level is limited. And there is almost no return path when a system detects that an upstream source may be wrong, incomplete or outdated.
This BOF is a working session, not a presentation. I will use the first ten minutes to frame the problem and then put a set of candidate measures on the table. The real work of the session starts there. The people in the room will decide which of these measures could realistically become candidates, which are too difficult or too expensive to implement, and which simply do not make sense in a real system.
