European copyright protects works automatically, without any registration. The result is a gap: there is no public, machine-readable record of what is protected, by whom and on what terms. For decades, publishers, collecting societies and picture agencies absorbed the cost of that gap in their internal catalogs. Now automated systems make copyright-relevant decisions about billions of works. Platforms filter uploads, AI developers assemble training corpora, and software decides who may use what. The gap has become a structural problem.

That is the starting point of a strategy paper published in September 2026 by CommonsDB, a pilot project funded by the European Commission. In From a Registry to a Registry Ecosystem (Deliverable 1.3), Paul Keller of Open Future and Sebastian Posth of Liccium take stock after roughly 18 months of operation. Their finding: whether registries for copyright information can be built is settled. The open question is who should run them, certify them and connect them.

Their answer is federation over centralization. The EUIPO should not be the registrar of first resort, but the certifier, aggregator and anchor.

CommonsDB has built a prototype public registry for public-domain and openly licensed works. The subject was chosen deliberately: with such works, every architecture question can be tested without contested legal claims or powerful gatekeepers distorting the result. The project beat its target of five million declarations and now holds more than 6.6 million, supplied by data partners from the Europeana and Wikimedia Commons communities (Wikimedia Sverige).

The technical idea rests on the International Standard Content Code (ISCC, ISO 24138:2024). The code is computed from the media file itself, not from metadata that is often lost in circulation. Anyone holding a copy of a work can derive the same code independently and use it as a search key. Each declaration is signed by the declaring party, countersigned by an independent timestamp authority and bound to an organizational identity verified under the EU's eIDAS framework. Entries can be synchronized through an open peer-to-peer service, and the full registry has already been replicated on independent nodes outside the project's infrastructure.

According to the project, variable running costs come to about €350 per million API transactions. The expensive parts, the paper says, are software development and maintenance, identity checks, onboarding and support for data partners.

From this the authors derive their central thesis. If registries are technically and economically feasible, many will appear, run by collecting societies, member states, publishers, agencies and service providers. The paper says two ISCC-based opt-out registries are already on the market commercially. The question is no longer one registry or none, but many registries, connected how?

The paper sets two models against each other. In the centralized model, all verified declarations flow into a single database run by one institution. Every query goes through its interface, and that operator issues the authoritative answers and proofs. In the federated model, the authors' proposal, entries stay in independently operated but certified registries. A public institution certifies the registries against common standards, keeps the signed, machine-readable list of certified registries and runs cross-registry search. A discovery layer then routes a content code to the responsible registry, which the paper likens to the domain name system.

The case is political rather than technical. Registries belong close to the communities that fill them, the authors argue: a music association understands music mandates better than an agency in Brussels, and it can correct errors and answer to its own community. A central registry, they say, flattens sector differences to the lowest common denominator and moves every dispute into an institution that is far from everyone affected.

High query volumes also favor federation, in the authors' view. Because registry data can be synchronized, an AI developer can hold a full local copy of the certified registries and check millions of codes locally. Occasional users such as rightsholders, platforms or courts query a public search interface. Both work from the same data and get the same answers.

The EU institutions took up the registry question themselves in 2026, and their answers differ.

• EUIPO mapping study (May). It maps a fragmented landscape of copyright databases and metadata standards and sketches “CopyrightView,” a federation layer on top. It is explicitly not a new central database, and its recommendations favor a federative approach with light interconnection.

• Commission feasibility study (July). Commissioned by DG CNECT, it examines an EU registry for opt-outs from the text and data mining (TDM) exception. It finds such a registry feasible, as a complementary, non-mandatory option alongside existing opt-out methods. According to the Commission's conference slides, it recommends neither a pure central nor a pure federated design, but a hybrid: a central, authoritative resolution layer plus distributed onboarding nodes run by sectoral or national actors.

• European Parliament resolution (March 10, 2026). Adopted 460 to 71 with 88 abstentions, it is non-binding. It proposes the EUIPO as a trusted intermediary that manages and lists rights reservations. Whether that means a central register or a listing of existing catalogs is read differently: the paper takes the federated view, while other commentators describe a central EU register at the EUIPO.

Both studies rely on the ISCC as a content-based identifier. The real tension therefore sits inside the EU institutions: the EUIPO study points to federation, the Commission study to a hybrid with a central layer, and the Parliament leaves both readings open. The strategy paper argues for the federated route. Its authors say the studies leave open how an ecosystem of registries should be built and what role public institutions should play, and they want to fill that gap before the first EU-level systems lock in decisions that are expensive to revisit.

The role the paper assigns to the EUIPO is deliberately restrained:

1. Registry certifier. It sets the criteria under which entries “count” and keeps the authoritative list of certified registries. The criteria should be published early.

2. Registry aggregator. It runs search interfaces and publishes signed checkpoints that prove what was in the certified holdings at a given time.

3. Anchor of the discovery layer. It operates a hub of the ISCC discovery protocol and takes part in its governance.

4. Migration of its own registers. Its orphan works database and out-of-commerce works portal should move to the shared architecture over time. It should operate registries itself only where EU law already makes it the registrar.

The paper warns against three mistakes: centralizing by default, absorbing community-run registries into the agency, and procurement that locks a public infrastructure into a single vendor.

The urgency comes mainly from AI regulation. The EU's 2019 Copyright in the Digital Single Market Directive lets rightsholders reserve their works against automated text and data mining (Article 4(3)). Member states had to transpose it by 2021. In practice, these reservations do not reliably reach the systems they are aimed at, or are not reliably recognized there. Under the AI Act (Article 53(1)(c)), providers of general-purpose AI models must now have a policy to identify and comply with such reservations. The problem is no longer only the rightsholders' but the AI providers' too.

CommonsDB supplies the positive side: it answers whether a work is free to use. According to the paper, it is the only initiative in the EUIPO mapping study aimed at legal certainty for reuse, a claim that has not been independently confirmed. Where a verified public-domain or open-license status exists, the opt-out question falls away for that work.

The authors' position should be read alongside this. The paper comes from inside a registry project. Sebastian Posth works for Liccium, CommonsDB's technical partner, and the ISCC grew out of an initiative of the ISCC Foundation. The authors name this perspective in their closing chapter. The case for federation is well argued, but it is also the architecture in which CommonsDB-style registries keep a role as certified operators.

How contested the registry question is for writers became clear at the project's final conference on September 14, 2026, at the EUIPO campus in Alicante. According to the European Writers' Council (EWC), a federation of national authors' and translators' associations, the attendees included the consortium, representatives of the Commission (DG CNECT) and the EUIPO Observatory, an AI developer, a collecting society and the Copyright Infrastructure Task Force. The EWC attended by invitation, by its own account as the only representative of authors. The Commission presented the results of its feasibility study there. According to the EWC, it also announced a pilot with the EUIPO that would probably start with publishing (news, books) and visual art, accompanied by CopyrightView.

The Commission's conference slides are more cautious. They say the Commission is considering a pilot project (“considering the implementation of a pilot project”), that cooperation with the EUIPO is possible and that the roll-out would be phased. The pilot would test the study's hybrid architecture: the central resolution layer (fingerprint lookup), the ISCC alongside sector identifiers, onboarding and identity verification through selected nodes, and performance and resilience. The slides name neither sectors such as publishing or visual art nor a link to CopyrightView. Whether either was said aloud cannot be read from them.

The EWC summarized its position in five messages, in its own words:

• TDM is not AI. An opt-out is only self-defense.

• The term “registry.” It grates; databases of rights declarations should be voluntary and called a directory or database.

• Authors are the majority. They hold most AI-relevant rights, so any database must follow their needs.

• Reliable confirmation. Opt-outs make sense only if AI companies reliably confirm that they honor them, which they avoid, the EWC says, citing recently unsealed court documents.

• Transparency. Only title-specific documentation of use in generative AI development closes the circle of information.

Some of this overlaps with the paper, some does not. The paper stresses that registries should be voluntary, declaratory and without effect on protection. Under the Berne Convention, such non-constitutive registers are not a prohibited formality. The paper keeps the term “registry,” however, and does not settle whether or how AI providers must confirm compliance or disclose title-level use. Whether practice stays voluntary when unregistered works become easier to use is an empirical question. The burden of declaring is also open: declaring requires procedures, signature services and identity credentials, a considerable hurdle for individual authors without a publisher or collecting society. That last point is an assessment, not an EWC statement.

The Commission study records reservations of its own. According to the slides, some rightsholder groups, music among them, doubt the scope and cost of a registry and whether it would improve transparency and enforcement. AI developers worry about performance at scale and about the registry's legal weight when it conflicts with other opt-out signals. STM, the international trade association of scientific, technical and medical publishers, has also called such a registry expensive to build and maintain and doubted that it alone ensures AI companies honor reservations.

The paper names its own weaknesses. Four problems remain unsolved.

Data protection. Append-only logs, in which nothing is ever finally deleted, sit badly with the GDPR and with rightsholders' legitimate interest in withdrawing a reservation. The paper concedes the issue needs its own analysis before an EU body adopts such logs for registry purposes.

Error rates. As holdings grow, the 64-bit content codes produce more false matches; reliable matching across the ecosystem requires the full 256-bit units. There is also a limit of principle: similarity between two files is not identity between two works, and says nothing about legal status or authorship. The paper therefore calls for conservative thresholds and warns that a public body presenting similarity as legal equivalence would claim more than the technology supports.

Identity as the bottleneck. The hardest part of the pilot was not the technology but obtaining and using qualified organizational credentials. They are rare among institutions holding relevant collections, and tooling is limited. Any EU-wide scale-up depends on this.

Incentives. For public-domain content, a declaration benefits the commons, not the declarer. For opt-outs the incentive is reversed: a reservation creates legal effect for whoever makes it, and the AI Act gives developers a concrete reason to check it. Participation therefore follows purpose. The paper sees certification itself as an incentive: those who meet the criteria get entries that count.

Two further limits belong in an honest account. The ISCC Foundation's discovery specifications are drafts, and the service is currently run by those who started it. And the expectation that the public layers would cost “lower than, or at worst in line with” a central registry is an assumption, not a calculation.

The paper's closing passage gives the debate a political dimension. An openly specified, publicly anchored infrastructure for rights information, it argues, is a piece of European digital sovereignty: machine-readable knowledge about European works as open public infrastructure, rather than accumulating exclusively in the data holdings of the largest platform and AI companies. The adversary here is not an EU central body but the private concentration of rights information. Federation is meant to prevent any single operator, agency or vendor, from becoming the gatekeeper over whose entries are visible.

Whether the model holds depends on its legal footing. The legal analysis attached to the paper finds that the EUIPO can, under current law, pilot and even host voluntary, non-constitutive services, provided they stay declaratory and have no effect on protection. A durable regime needs legislation, for example by amending Regulation (EU) No 386/2012, amending the DSM Directive or adopting a dedicated instrument on copyright information infrastructure.

Until then the situation is paradoxical. The building blocks exist: an ISO standard for the content code, an eIDAS trust model, a synchronization layer proven in the pilot, a discovery protocol in early testing, the first operating registries and an agency with relevant mandates. What is missing is the connecting decision. Who takes it, and how, will settle not a technical question but who controls rights information in Europe.

Sources

• CommonsDB, Deliverable 1.3, From a Registry to a Registry Ecosystem (September 2026)

• CommonsDB Final Conference slide deck (September 14, 2026): European Commission, DG CNECT (Krzysztof Nichczynski), “Study to Assess the Feasibility of a Registry of Text and Data Mining Opt-outs,” slides 94–102; EUIPO (Philippe Rixhon), slides 105 ff.

• EWC, EWC joined the CommonsDB Final Conference (September 15, 2026)

• CommonsDB Feasibility Study, Part 1 (IViR)

• Commission study on a TDM opt-out registry, summary

• STM on the TDM feasibility study

• EUIPO mapping study, commentary (Wolters Kluwer)

• European Parliament resolution of March 10, 2026 (Legislative Observatory)

• PwC on the Parliament resolution

• ISO 24138:2024