What Must
Be Built
The principle is clear. The legal argument exists. What is missing is the institutional, legal, and technical infrastructure needed to make commons governance operational. Four gaps stand between the principle and its realization.
You cannot trust what you cannot trace.
Over 70% of widely used AI training datasets omit licensing information. Institutions deploying AI cannot inspect what data trained a system, under what terms, or with what consent. Without machine-readable records of origin, licensing status, and consent, compliance with commons obligations is unverifiable and accountability is impossible.
What's needed: content identification standards that allow training data to be traced to its origins; consent registries that record which knowledge producers have authorized use of their work in AI training and under what conditions; opt-out systems that allow rights holders to exclude their contributions from future training runs. This is the foundational layer without it, every other trust claim is unverifiable.
The licensing environment was built for a different era.
Standard copyright licenses do not address AI training use. Open-source licenses designed for software do not translate cleanly to model weights or training data. The terms under which the commons is used are effectively set by the organizations doing the using without the participation of the communities whose knowledge is involved.
Commons-compatible licensing frameworks must create enforceable obligations for those who train on the commons; be compatible with open-source norms; function across jurisdictions; and include verification and enforcement mechanisms that do not depend entirely on litigation. The AMPL framework is AI Commons' work toward this gap.
Legal frameworks without institutions are unenforceable in practice.
Legal frameworks and licensing structures require institutions to administer and enforce them. Those institutions do not yet exist for the AI knowledge commons. The governance institutions that do exist were not designed for this problem and are not currently structured to represent the full range of affected communities.
The governance institutions of the AI commons need structural protections: constituency-based representation that gives individual creators, small organizations, and communities in the Global South real decision-making power; anti-capture provisions; and financial structures that make institutional sustainability independent of the largest commercial beneficiaries of the commons.
When something goes wrong, there is currently nowhere to go.
There are no standardized pathways for a creator whose work was used without consent to seek correction. No structured mechanisms for a community whose knowledge was misrepresented to challenge that misrepresentation. No shared audit pathways for institutions that need to verify a system's provenance claims.
What's needed: dispute intake processes accessible to individuals and small organizations not only to well-resourced institutions; takedown and correction pathways for AI outputs that violate rights or cause identifiable harm; and audit infrastructure that makes compliance verifiable by parties other than the organizations subject to those obligations.