The most common question we receive from companies adopting artificial intelligence is this: if customer data ends up in an AI system, does the GDPR apply? Since 2025 the answer is unambiguous: yes.
Fine-tuning is not excluded
The GDPR continues to govern any personal data processed to train, fine-tune or run language models. The idea that generative AI is a sector separate from privacy law does not hold: the moment a model is trained on data that identifies people, that data remains personal data, with all the obligations that follow.
The operational consequence is that the baseline guarantees are unchanged: legal basis, transparency, data subject rights, and - where data is transferred outside the EEA - the safeguards for international transfers.
The EDPB opinion: true anonymisation or pseudonymisation
The pivot of the European debate is the EDPB opinion on AI model training, which turns on the decisive question: if data has been genuinely anonymised it leaves the scope of the GDPR; if it is merely pseudonymised it remains personal data and the protection applies in full.
This distinction determines the boundary. A dataset in which names have been replaced with identifiers is not anonymous: with a high risk of re-identification, pseudonymisation does not take data outside the regime. Every company training models must be able to demonstrate which technique was used and with what result.
Italian enforcement in 2026
The Italian supervisory authority's enforcement activity has intensified. On 9 July 2026 a fine was imposed on Character.AI, and proceedings are ongoing concerning entities offering hosting for generative platforms. The OpenAI case remains the best-known precedent: a EUR 15 million penalty with corrective measures, whose possible annulment was debated in 2026.
The direction is clear: the regulator's attention has shifted from enforcement against the model provider to enforcement against the deployer, that is, the organisation using the model. Those adopting generative AI tools in their own name are now the most exposed.
The intersection with the AI Act
The intersection between the GDPR and the AI Act is now structural: the AI Act introduces rules on risk, transparency and governance; the GDPR on legal basis, data minimisation and rights. A chatbot compliant with the AI Act may not be GDPR-compliant, and vice versa: they are autonomous regimes with cumulative obligations.
For the compliance manager the practical consequence is that the mapping cannot stop at the AI Regulation: it must extend to data processing, with a single verification grid covering both.
Do you use chatbots or AI assistants with customer data?
We check legal basis, transparency and extra-EEA transfers: the three points enforcement has moved towards.
Check compliance