What is AI Model Development and Deployment under GDPR?

In practice, organizations must identify where personal data enters the model lifecycle, determine the lawful basis for each processing activity, limit data use to specified purposes, and apply safeguards such as minimization, retention controls, access restrictions, and vendor contracts. Depending on the system, teams may also need to address automated decision-making rules, data subject access and objection requests, international transfers, and privacy by design and by default.

This topic matters because many AI projects fail compliance at the training, fine-tuning, or deployment stage, not just at data collection, and because model outputs can still implicate personal data even when the system is not obviously a privacy tool. It is most directly tied to GDPR, but it also overlaps with the EU AI Act, especially where high-risk systems, transparency duties, and governance documentation intersect with privacy obligations.