IT EN
Start a trial

Operational notes Observatory

MiniCPM5-2B: Naming Eight Datasets Is Not Enough for the AI Act

7 min read

A dense wall of paper rolls seen head-on, dozens upon dozens, stacked in irregular rows, photographed in black and white; no roll is identifiable, and there are no people, logos, or legible markings
What can be counted is how many rolls there are, not what is written on each one.

A company that brings an artificial intelligence model inside its own perimeter — because the data it handles cannot leave — sooner or later gets asked what is inside that model, and on what right. This is not a textbook hypothesis: we read an Equity Purchase Agreement filed with the SEC on 2 September in which the buyer of a company makes the seller swear to hold “a valid and enforceable right to use each Training Dataset” — and the contract’s own definition explicitly includes “scraped or harvested datasets” among what counts as a Training Dataset. Whoever brings a model in-house sooner or later inherits the same question, asked by a buyer, an auditor, or a regulator: what trained it, and on what right?

On 6 September 2026, at 11:12 UTC according to the createdAt field of the Hugging Face API, OpenBMB published MiniCPM5-2B: the second model in the MiniCPM5 series after MiniCPM5-1B, a dense 2-billion-parameter model, licensed apache-2.0, not gated, tagged on-device, edge-ai, long-context, tool-calling, with declared languages English and Chinese. Nothing unusual for this slot so far — another small model built to run outside the cloud. The card carries a rarer declaration, though: the datasets field of the frontmatter lists eight proper names — Ultra-FineWeb, UltraX-Preview, Ultra-FineWeb-L3, UltraData-Math, UltraData-Code, UltraData-SFT-2605, UltraData-SFT-Agent-2609, UltraData-RL-2609 — each a link to a specific dataset, not a generic line about filtered web data.

Eight names, checked one by one

A name in a frontmatter proves nothing on its own: it can point to a private repository, a deleted one, or one that never existed. We queried the public endpoint https://huggingface.co/api/datasets/openbmb/<name> for each of the eight, and all eight exist, are public, and are apache-2.0. Seven are downloadable without restriction; one, UltraData-SFT-2605, comes back gated: auto — access behind automatic acceptance of terms, not an editorial barrier. The numbers we read on 9 September: Ultra-FineWeb, 64,669 files, 120,491 downloads; UltraX-Preview, 483 files; Ultra-FineWeb-L3, 1,771; UltraData-Math, 1,831; UltraData-Code, 1,131; UltraData-SFT-2605, 1,510; UltraData-SFT-Agent-2609, 57; UltraData-RL-2609, 26. Eight corpora named, eight corpora that answer.

Where the declaration stops

The heaviest name on the list is Ultra-FineWeb, over 64,000 files on its own. Its card explains how it is built, verbatim: “We use the proposed efficient verification-based high-quality filtering pipeline to the FineWeb and Chinese FineWeb datasets” — that is, downstream of Common Crawl, the open-web scan underlying FineWeb. Ultra-FineWeb does not collect from scratch: it filters what others have already collected.

We read that card in full: 1,242 words, counted by us. The word copyright never appears. Neither do the words opt-out or robots: no line about a rightsholder flagging that they do not want to end up in a training corpus, nor about how the pipeline treats robots.txt files upstream. There is, though, a detail pointing the other way: the dataset’s schema, queried via the API, lists three fields per record — content, score, source — the last a reference to each document’s provenance. Provenance per document is recorded somewhere in the pipeline; it simply is not told, or aggregated, in the public card.

Article 53, paragraph 2

The AI Act — Regulation (EU) 2024/1689, Article 53, paragraph 1, authentic English text downloaded from Cellar, the Union’s official archive — imposes four obligations on providers of general-purpose AI models. Two concern exactly this point. Point (c): providers “put in place a policy to comply with Union law on copyright and related rights, and in particular to identify and comply with, including through state-of-the-art technologies, a reservation of rights expressed pursuant to Article 4(3) of Directive (EU) 2019/790.” Point (d): they “draw up and make publicly available a sufficiently detailed summary about the content used for training of the general-purpose AI model, according to a template provided by the AI Office.”

Then comes the paragraph that people working with open models often cite from memory, and often imprecisely: the exception covers only two points out of four. “The obligations set out in paragraph 1, points (a) and (b), shall not apply to providers of AI models that are released under a free and open-source licence that allows for the access, usage, modification, and distribution of the model, and whose parameters, including the weights, the information on the model architecture, and the information on model usage, are made publicly available. This exception shall not apply to general-purpose AI models with systemic risks.” The exemption covers only internal technical documentation, point (a), and the information for downstream integrators, point (b). The copyright policy and the training-content summary — points (c) and (d) — remain owed regardless of licence: MiniCPM5-2B, apache-2.0 with public weights, would fall under the exemption for only two obligations out of four.

Naming is not having the right

Eight proper names, each verifiable with one API call, is more than any cloud interface offers, where training data stays an undiscussed trade secret. It is a concrete step toward what point (d) asks for — a public summary of the corpora used, before anyone demands it. But naming a dataset does not amount to proving the right to have used it, and the document that one day lands on the table — an acquisition, a due-diligence request, a request from the AI Office — does not ask for the corpus’s name: it asks for proof of the right.

This is where the perimeter changes the terms of the deal. With a frontier model consumed via API, data provenance stays behind a gate no customer can open: the model is judged by its output, not by the data that built it. Whoever brings a model like this in-house gains, along with control over the data that flows through it, the concrete ability to go and look — download Ultra-FineWeb, open the source fields, check the documents cited, exactly as we just did. And inherits, in the same move, the job of documenting what it saw: no cloud provider will ever do that in its place.

See the service · Talk to an engineer

What we don’t know

We have not downloaded the eight corpora nor inspected the documents inside them: we know the files exist and are public, not that every document inside each one is legitimately part of a training dataset. The apache-2.0 licence attached to each dataset covers the collection as published on Hugging Face, not necessarily every source document that makes it up — Ultra-FineWeb, built on third-party corpora like FineWeb, shows that well. We do not know whether OpenBMB has published a copyright policy or the summary required under point (d) somewhere else: we have not looked outside Hugging Face. Nor, finally, do we know if and when OpenBMB places MiniCPM5-2B on the Union market in a way that triggers the obligations of Article 53: the regulation applies to whoever does that, not to publication on a public repository.

The two axes

Comply. Whoever brings MiniCPM5-2B inside their own perimeter does not inherit the obligations of Article 53: those stay with OpenBMB, the provider. What they do inherit is the same question a buyer, an auditor, or a customer will ask sooner or later: what trained what you installed, and on what right. Answering requires a register kept from day one — model, declared datasets, verified datasets — not reconstructed on the day of the question.

Decide. The ability to go and look — open a dataset, read its schema, count the words in a card — is what sets a model brought in-house apart from one consumed via API. It is worth spending: not to trust OpenBMB’s declaration on faith, but to build your own record on top of it — which eight datasets you verified, when, with which numbers. That is the summary that will, one day, answer for you instead of leaving you scrambling for one.

Sources