| Dimension | Training-time processing | Inference-time processing |
|---|---|---|
| What is processed | Historical datasets, scraped text, licensed corpora, user content collected over time | A live prompt or request submitted by an individual user in real time |
| Most common lawful basis | Legitimate interest, following a documented three-step balancing test | Contract performance, consent, or legitimate interest, depending on the feature |
| Regulatory scrutiny focus | Whether collection was proportionate and whether data subjects could reasonably expect this use | Whether the output decision materially affects the individual and whether they were informed |
| Retrospective risk | Data can be memorised inside model weights, complicating later deletion requests | Lower retrospective risk if outputs are not persistently logged against the individual |
| Key regulator reference | EDPB Opinion 28/2024 on AI models | General GDPR Articles 6 and 22 on automated decision-making |
Why AI Training and Inference Need Separate Lawful Basis Analysis
One of the most persistent mistakes in AI compliance programmes is treating “GDPR compliance for our AI system” as a single exercise that produces one lawful basis covering the whole product. Regulators do not see it that way, and neither should engineering and legal teams. The European Data Protection Board made this explicit in its Opinion 28/2024 on AI models, which noted that collecting data, training a model on it, and later using that model to serve live inference requests are distinct processing activities that may each require their own justification under Article 6 of the GDPR.
This distinction matters because the risk profile, the population affected, and the practical options for compliance differ sharply between the two phases. Training touches historical data, often scraped or aggregated at scale, where individuals had no direct interaction with the AI provider at the point of collection. Inference touches a live individual, submitting a live request, often with a reasonable expectation about how their input will be used right then. Conflating the two into a single blanket lawful basis statement is precisely the kind of superficial compliance that a data protection authority is now trained to spot.
Lawful Basis Options for Training Data Collection
GDPR Article 6 lists six lawful bases, but in practice, AI training data collection narrows quickly to three realistic candidates: consent, contract, and legitimate interest.
Consent
Consent is the cleanest basis in theory but the hardest to operationalise at the scale most training pipelines require. Valid GDPR consent must be freely given, specific, informed, and unambiguous, which is difficult to obtain retroactively for datasets scraped from the open web or aggregated from years of historical product usage. Consent remains realistic for narrowly scoped, opt-in training programmes, such as a company asking existing customers to explicitly opt in to having their support tickets used for fine-tuning a specific assistant.
Contract performance
Contractual necessity applies narrowly. It covers processing that is objectively required to deliver a service the individual has signed up for, not processing that merely improves that service over time. Training a general-purpose foundation model rarely qualifies as strictly necessary to perform a specific contract with a specific individual, which is why most providers do not rely on this basis for large-scale training.
Legitimate interest
Legitimate interest has emerged as the dominant lawful basis for AI training following clarifications from both the EDPB and France’s CNIL. To rely on it, an organisation must satisfy a three-part test: identify a genuine legitimate interest, show the processing is necessary to achieve it, and demonstrate that the interest is not outweighed by the individual’s rights and freedoms. The EDPB’s opinion gave concrete examples of interests that can qualify, including developing a conversational agent to assist users, improving product performance, and building AI systems for fraud prevention. Crucially, the EDPB and CNIL both stress this is not a one-time checkbox; it requires a documented, case-by-case balancing assessment, revisited as the processing or the model’s use changes.
| Lawful basis | Realistic for AI training? | Key condition to satisfy |
|---|---|---|
| Consent | Only for narrow, opt-in, clearly scoped programmes | Freely given, specific, informed, revocable at any time |
| Contract performance | Rarely, except where training is objectively required to deliver the specific contracted service | Processing must be strictly necessary, not merely beneficial |
| Legitimate interest | Most common basis for large-scale training | Documented three-step balancing test, revisited periodically |
| Legal obligation | Rare, applies mainly to regulatory or safety-mandated model behaviours | A specific legal duty must exist requiring the processing |
The Legitimate Interest Balancing Test, Step by Step
Because legitimate interest carries the most weight in AI training decisions, it is worth walking through the three-step test regulators expect to see documented.
- Purpose test: Identify a specific, genuine interest being pursued, such as building a customer support assistant, improving fraud detection accuracy, or advancing a defined research goal. Vague interests like “improving AI capabilities generally” do not pass this test.
- Necessity test: Demonstrate that the processing is genuinely necessary to achieve that interest, and that no less intrusive method would work as well. This is where data minimisation intersects directly with lawful basis: over-collecting data undermines the necessity argument.
- Balancing test: Weigh the organisation’s interest against the rights, freedoms, and reasonable expectations of the individuals whose data is used, considering mitigating measures such as opt-outs, filtering of sensitive categories, and transparency notices.
Two lawful basis decisions, one AI system
A single AI product typically requires two separate lawful basis records: one covering the historical data used to train or fine-tune the model, generally anchored in legitimate interest with a documented balancing test, and a second covering each live inference feature, anchored in whichever basis matches how that specific feature is presented and used by the individual.
Lawful Basis for Inference: A Different Question Entirely
Inference-time processing, meaning the moment a live user submits a prompt or request and the model generates a response, raises a different set of questions. Here, the relevant basis usually depends on how the feature is framed to the user and what happens to their input afterward.
A chatbot embedded in a paid product that answers account-specific questions can often rely on contract performance, since responding to the user’s query is core to delivering the service they signed up for. A recommendation feature that profiles behaviour to personalise content typically needs either consent or a carefully scoped legitimate interest assessment, particularly if the profiling could be considered a form of automated decision-making under Article 22. Where an AI system’s output triggers a decision with legal or similarly significant effects on an individual, such as automated credit scoring or employment screening, Article 22 imposes additional safeguards regardless of which Article 6 basis is used, including a right to obtain human intervention and to contest the decision.
Inference lawful basis decisions should also account for what happens to the prompt after the response is generated. If the interaction is logged and later fed back into a training pipeline, the organisation is now triggering a second, training-time lawful basis analysis for that same data, layered on top of whatever basis justified the original inference response.
Where Training and Inference Lawful Basis Interact
The two phases are not fully independent in practice. A common real-world pattern looks like this: a user interacts with an AI feature under a contract-performance basis, unaware that their prompt may later be selected for use in a fine-tuning dataset. If that reuse was not disclosed and is not covered by a separate legitimate interest assessment or consent mechanism, the organisation has a compliance gap, even though the original inference-time basis was sound. This is precisely the scenario the ICO’s five-part 2024 consultation series on generative AI addressed, covering lawful basis, purpose limitation, accuracy, individual rights, and how those rights are engineered directly into generative AI models and their surrounding data pipelines.
Common mistake
Applying a single, generic “legitimate interest” statement to an entire AI product and assuming it covers both the historical training dataset and every live inference feature built on top of it. Regulators increasingly expect separate, documented assessments for training data collection versus each distinct inference use case, especially where inference output could trigger Article 22 automated decision-making protections.
What worked
Organisations that maintained a living register mapping each AI feature to its specific lawful basis, reviewed at every model update or new deployment, were able to respond to regulator inquiries and subject access requests far faster than teams relying on a single product-wide privacy notice. The register approach also made it easier to spot when a feature’s actual behaviour had drifted from the basis originally documented for it.
Practical Steps for Building a Defensible Lawful Basis Record
Legal and engineering teams often approach this record-keeping differently, which is itself a common source of gaps: legal teams tend to think in terms of a single company-wide privacy notice and a periodic legitimate interest assessment, while engineering teams think in terms of individual features, data pipelines, and API calls. A defensible record reconciles both views, mapping each engineering-level data flow to the specific legal basis and balancing test that justifies it, so that a regulator’s question about a specific feature can be answered by pointing to a specific, dated assessment rather than a general policy document.
- Document a separate lawful basis assessment for every distinct training dataset and every distinct inference-facing feature, rather than one blanket statement.
- For legitimate interest claims, keep a written record of the purpose, necessity, and balancing test, updated whenever the processing scope changes.
- Flag any inference feature whose output could produce a legal or similarly significant effect on an individual, and apply Article 22 safeguards, including a path to human review.
- Track whether inference data is later reused for training, and treat that reuse as triggering its own lawful basis question.
- Revisit legitimate interest balancing tests periodically, not just at initial launch, since public expectations and regulatory guidance continue to evolve.
- Compatible purpose testAssessing whether a new use of previously collected data is compatible with the original purpose it was collected for, a required step before reusing inference logs for training.
- Automated decision-making thresholdsThe Article 22 trigger for outputs that produce legal or similarly significant effects, which layers extra safeguards on top of whichever lawful basis applies.
- Balancing test documentationThe written record showing purpose, necessity, and rights-balancing for a legitimate interest claim, expected by regulators as evidence, not just an internal assumption.
- Cross-border training data flowsTraining datasets often draw from global sources, which can separately trigger international transfer rules layered on top of the lawful basis question.
- Special category data filteringHealth, biometric, or other special category data requires an additional Article 9 condition beyond the standard Article 6 lawful basis, and is frequently missed during large-scale scraping.
How Regulators Are Signalling Enforcement Priorities
Regulatory activity through 2026 has sharpened rather than softened. The European Data Protection Board’s guidelines adopted on 8 July 2026 clarified that developers relying on legitimate interest for scraping and training must complete a case-by-case balancing test before each deployment, not a single test performed once at the company level. France’s CNIL has published its own detailed recommendations on legitimate interest as an AI training basis, largely aligned with the EDPB’s approach but offering more granular examples for common scenarios. The direction of travel is consistent across regulators: generic, product-wide lawful basis statements are increasingly treated as insufficient evidence of compliance, and organisations are expected to show their working, feature by feature.
Documenting Lawful Basis Across Multi-Model and Vendor Pipelines
Most organisations deploying AI today are not training a single model in isolation. A typical product might combine a licensed foundation model for general reasoning, a fine-tuned smaller model for a specific classification task, and a third-party embeddings provider for retrieval, each of which may have processed the same underlying personal data under a different arrangement. Lawful basis documentation has to follow the data through this chain, not just the first hop. If a company’s own legitimate interest assessment covers the initial collection of customer support transcripts, but those transcripts are then passed to a third-party fine-tuning vendor under a separate data processing agreement, the lawful basis question does not disappear at the handoff; it has to be traceable through the vendor relationship as well.
This becomes particularly important when a vendor’s own terms of service reserve the right to use customer-submitted prompts for their own model improvement. An organisation that unknowingly forwards user prompts to a vendor with such terms may find that its own carefully documented lawful basis for the customer-facing feature does not extend to cover the vendor’s downstream training use, creating a gap that only becomes visible during a data protection audit or a customer’s own compliance review. Reviewing vendor contracts specifically for downstream training rights, and either negotiating them out or capturing them explicitly in the lawful basis record, closes this gap before it becomes a live incident.
A practical safeguard is to maintain a data lineage map alongside the lawful basis register, showing which vendors and models touch a given data category at each stage of the pipeline. This does not need to be an elaborate system; a shared table listing each data category, every internal and external system that processes it, and the lawful basis attached to each hop is often sufficient to answer a regulator’s questions quickly and to spot gaps before an external party does.
- Lawful basis
- One of the six legal grounds under GDPR Article 6 that must apply before personal data can be lawfully processed.
- Legitimate interest
- A lawful basis permitting processing necessary for a genuine interest of the controller or a third party, provided it is not outweighed by the individual’s rights and freedoms.
- Automated decision-making (Article 22)
- GDPR provisions granting individuals additional rights, including human review, where a decision based solely on automated processing produces legal or similarly significant effects.
- Balancing test
- The documented three-step assessment of purpose, necessity, and rights-impact required to justify reliance on legitimate interest as a lawful basis.
- Special category data
- Sensitive personal data such as health, biometric, or racial origin information that requires an additional Article 9 condition beyond a standard lawful basis.
Key Takeaways
- GDPR treats AI training data collection and live inference as distinct processing activities, each requiring its own lawful basis analysis.
- Legitimate interest, following a documented three-step balancing test, is the most common realistic basis for large-scale AI training.
- Consent works best for narrowly scoped, opt-in training programmes rather than broad web-scraped datasets.
- Inference-time lawful basis usually depends on how a specific feature is framed, often contract performance or a feature-specific legitimate interest assessment.
- Article 22 imposes extra safeguards, including a right to human review, whenever an AI output produces legal or similarly significant effects.
- Reusing inference logs for later training triggers a second, separate lawful basis question that is easy to overlook.
- The EDPB’s Opinion 28/2024 and July 2026 guidelines, along with CNIL recommendations, both push organisations toward documented, case-by-case assessments rather than blanket statements.
FAQs
Does GDPR require a different lawful basis for AI training versus inference?
Yes. The EDPB has confirmed that collecting data, training a model, and running inference are distinct processing activities that may each need their own lawful basis justification, since the risk profile and affected individuals differ between the two phases.
Can legitimate interest be used as a lawful basis for AI training?
Yes, both the EDPB and France’s CNIL have confirmed legitimate interest can serve as a valid basis for AI model training and deployment, provided the organisation documents a case-by-case three-step balancing test rather than relying on a generic, one-time assessment.
Is consent required to train an AI model on personal data?
Not necessarily. Consent is one option but is difficult to obtain retroactively at scale for scraped or historical datasets; legitimate interest is more commonly used for large-scale training, while consent remains realistic for narrow, opt-in programmes.
What lawful basis applies to a chatbot answering customer questions?
It often depends on the product context, but contract performance frequently applies where responding to the query is core to delivering a service the user has already signed up for, while personalisation or profiling features may need a separate legitimate interest or consent basis.
Does Article 22 apply to generative AI outputs?
Article 22 applies when an automated decision based on AI output produces legal or similarly significant effects on an individual, such as credit decisions or employment screening, requiring safeguards including the right to request human review regardless of the underlying lawful basis.
Can inference data be reused to retrain a model without a new lawful basis check?
No. Reusing inference logs, such as user prompts, for later training is generally a new processing purpose and should trigger its own compatibility and lawful basis assessment, separate from whatever basis justified the original inference response.
What did the EDPB’s July 2026 guidelines change for AI training data?
The guidelines clarified that developers relying on legitimate interest for scraping or training must complete a case-by-case balancing test before each deployment, reinforcing that legitimate interest is not a one-time, company-wide determination.
What is the biggest compliance gap organisations have in AI lawful basis documentation?
The most common gap is applying a single, generic lawful basis statement across an entire AI product rather than documenting separate assessments for the training dataset and for each distinct inference-facing feature built on top of it.
References
- European Data Protection Board, “Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models,” edpb.europa.eu
- Wilson Sonsini, “EU Privacy Regulators Confirm That Legitimate Interest Is a Valid Legal Basis for AI Model Training and Deployment,” wsgr.com
- IAPP, “A legitimate interest in AI training,” iapp.org
- Skadden, Arps, Slate, Meagher and Flom LLP, “CNIL Clarifies GDPR Basis for AI Training,” skadden.com
- Tech Times, “GDPR Applies to AI Training Data: EU Ends Web Scraping Free Pass for Every Lab,” techtimes.com
This lawful basis analysis builds directly on the minimisation practices covered in data minimisation by design in AI products, since a stronger necessity argument depends on collecting only what is required. Cross-border AI training datasets also raise questions addressed in our guide to cross-border data transfer mechanisms after Schrems and data sovereignty requirements by region. Anonymisation claims for training data should be tested against the standards described in anonymisation versus pseudonymisation. Where AI systems process workplace data, see our coverage of employee monitoring compliance.
