The EDPB's Opinion 28/2024 on AI models, adopted in December 2024, settled the question European compliance teams had been circling for two years: an AI model is only "anonymous" — and therefore outside GDPR — if personal data is neither used to build it nor retrievable from it, and if the risk of re-identification is negligible. In practice, that means most enterprise AI models are not anonymous, and the organisations that assumed otherwise are carrying unmanaged GDPR exposure. The answer for enterprises is to stop debating the legal theory and operationalise the obvious: run AI on governed data with documented legal bases, DPIAs where required, and audit trails that can answer a supervisory authority's questions on demand.
Key Insight: GDPR is the de facto global rulebook for AI processing while the AI Act matures: cumulative fines passed €5 billion per DLA Piper's annual GDPR survey, with Ireland's Data Protection Commission alone fining Meta €1.2 billion in 2023 and a further €1.3 billion in September 2025. EDPB Opinion 28/2024 makes clear that anonymisation is a high bar most AI models will not meet, so enterprises should plan for AI systems as personal-data processing — with legal bases, purpose limitation, data-subject rights, and explainability built in from the start.
The Data Governance Imperative for AI
GDPR has governed AI longer than most people realise. Every stage of an AI lifecycle that touches personal data — collecting training data, building and fine-tuning models, running inference on individuals, profiling, or making automated decisions — is personal-data processing under the regulation, with the full apparatus of legal bases, purpose limitation, data minimisation, and data-subject rights attached. The enforcement record shows this is not theoretical: DLA Piper's annual GDPR survey counts more than €5 billion in cumulative fines since 2018, and the headline cases are AI-adjacent — Ireland's DPC fined Meta €1.2 billion in May 2023 over unlawful data transfers and a further €1.3 billion in September 2025 over transfers of EU user data, while French, Italian, and Dutch authorities have repeatedly sanctioned processing practices that AI systems inherit. When Gartner warns that 85% of AI projects deliver erroneous outcomes due to bias in data, algorithms, or the teams managing them, it is describing exactly the failures GDPR was designed to catch: data processed without a valid basis, decisions made without explanation, and systems that cannot account for themselves.
The timing of the guidance update matters. EDPB Opinion 28/2024, adopted 17 December 2024, addresses the question of when an AI model qualifies as personal data — and by extension when GDPR applies to models at all. Its conclusion frames the compliance burden: the assessment must be made at each stage of the lifecycle, the burden of proof for anonymisation lies with the controller, and mere pseudonymisation or low re-identification probability is insufficient. The opinion effectively tells enterprises to assume models are personal data unless they can prove otherwise — which reshapes how AI systems should be built, documented, and governed.
Framework Design and Implementation
Operationalising the new guidance means building GDPR into the AI lifecycle rather than treating it as an afterthought. The implementation framework has six components. First, an inventory of AI systems that process personal data, mapped to their legal bases under Article 6 — consent, contract, legal obligation, vital interests, public interest, or legitimate interest, with legitimate interest requiring a documented balancing test. Second, purpose limitation: data collected for one purpose cannot silently be repurposed for model training, and controllers must document how training data was obtained. Third, DPIA under Article 35 for high-risk processing — which includes large-scale profiling and automated decision-making — completed before deployment, not after an incident. Fourth, data-subject rights workflows, including Article 22 rights concerning automated decision-making and the right to explanation in practice. Fifth, security and retention controls across the model lifecycle, including what happens to training data when a model is retired. Sixth, cross-border transfer compliance, which the Meta fines show is enforced aggressively.
A practical GDPR-plus-AI programme should include:
- A legal-basis map for every AI use case, including how training data was obtained and why that basis is valid.
- DPIAs for high-risk systems, refreshed whenever models or data change materially.
- Anonymisation or pseudonymisation decisions documented against the EDPB's Opinion 28/2024 criteria, with evidence.
- Data-subject rights workflows covering access, erasure, and Article 22 explanation requests.
- Audit logging and access controls that let you show any supervisory authority what data a system touches, who can access it, and how decisions are made.
The governance implication is that the data layer — lineage, definitions, access controls, audit — is where GDPR compliance for AI actually lives. A model is only explainable if the data and definitions that produced its outputs are documented; a DPIA is only credible if the system's data flows are actually known; an Article 22 challenge is only answerable if decisions can be traced to their inputs. This is why governed data architecture and AI compliance have become the same project.
Operational Challenges and Solutions
The operational challenges of GDPR-compliant AI are the same ones that defeat most compliance programmes, with a privacy twist. Legal-basis drift is the first: a model trained under one basis is deployed for a different purpose, and the purpose limitation violation only surfaces in an investigation. Data-subject rights at scale are the second: erasure requests that touch training data, access requests that require explaining model logic, and Article 22 challenges that demand human review processes. Cross-border transfers are the third: the Meta fines demonstrate that transfer mechanisms — standard contractual clauses, adequacy decisions, transfer impact assessments — are enforced with severity, and AI systems that move data across borders inherit the exposure. Model-lifecycle governance is the fourth: models are versioned and updated continuously, and each update is a new processing activity that should trigger a legal-basis and DPIA review, yet almost no organisation treats it that way.
The solutions converge on the same architectural answer. Document data flows with lineage so that purpose and basis can be verified. Hold metric definitions and data sources in a governed semantic layer so that explainability is a property of the system rather than a reconstruction effort. Log access and queries so that supervisory-authority questions can be answered with evidence. And centralise the control plane so that when a model is updated, the legal-basis and DPIA reviews happen as part of the deployment pipeline rather than as an afterthought. For organisations without the in-house privacy-engineering depth for all of this, a managed platform removes most of the burden: Beehive Strategy's conversational BI deploys in roughly two weeks as a managed service, connects to existing data sources through standard protocols without rebuilding the warehouse, and answers questions in real time inside chat and IM platforms such as Teams, WeChat Work, DingTalk, and Feishu — with every query logged, every metric definition governed in one semantic layer, and every answer traceable to its data source.
When Is an AI Model "Anonymous" Under the EDPB's New Opinion?
Under EDPB Opinion 28/2024, a model is anonymous — and therefore outside GDPR — only if three cumulative conditions hold: the model was not trained on personal data, or any personal data used cannot be extracted from the model; the model does not output personal data, even under prompts designed to extract it; and the model does not permit the re-identification of individuals through its outputs, whether directly or in combination with other information. The opinion stresses that this must be assessed at each stage of the lifecycle — development, deployment, and use — and that the burden of proof sits with the controller claiming anonymity. In practice, very few enterprise models will clear this bar: most are trained on data that includes personal information, most can memorise and reproduce fragments of that data, and almost none have been tested for extraction resistance. The operational conclusion is not to abandon models but to stop treating anonymisation as the escape hatch and instead run AI as what it usually is: personal-data processing with documented legal bases, DPIAs, rights workflows, and audit trails. That framing is liberating in a way: it means the compliance question is settled by good data governance — which most enterprises can build — rather than by legal arguments that will be tested in court for a decade.
Implementation Strategies
Sequence the work in four phases. Phase one is inventory and legal-basis mapping: list every AI system that touches personal data, map each to a defensible legal basis, and flag any that lack one — those are the priority remediation targets. Phase two is DPIA and controls: complete DPIAs for high-risk systems, implement access controls and audit logging, and document anonymisation or pseudonymisation decisions against the EDPB criteria. Phase three is operationalisation: wire rights workflows into the systems that handle access and erasure requests, and make Article 22 explanation a documented, testable capability. Phase four is continuous review: treat every model update, new data source, or new deployment as a triggering event for the legal-basis and DPIA review cycle. McKinsey's finding that 65% of organisations now use generative AI regularly means the volume of AI processing is growing faster than most compliance programmes can keep pace — which is precisely why phase four, the cadence, matters as much as the initial remediation. The organisations that survive the enforcement wave will be the ones that made GDPR compliance a property of their data architecture — lineage documented, definitions governed, access logged, decisions explainable — rather than a binder of policies.
Preparing for the Next Wave of Regulation
The regulatory direction over the next 18 months is unambiguous. The EU AI Act's high-risk obligations phase in from August 2026, layered on top of GDPR; the EDPB's 2025 work programme continues issuing AI-related guidance; and the enforcement pattern — more fines, larger amounts, cross-border coordination — shows no sign of easing. The practical consequence is that GDPR compliance and AI compliance are merging into a single discipline, and the evidence base for both is the same: documented data flows, governed definitions, audit trails, and explainable decisions. Enterprises that build that foundation now will find each new guideline an incremental step; those that defer will retrofit under investigation, which is always the slower and more expensive path. The question is no longer whether AI will be regulated in Europe — it already is — but whether your organisation's data architecture can answer for its AI when the supervisor asks. Build the inventory, the legal-basis map, the DPIAs, and the audit trails today, and the answer will be yes.
The market data from the first half of 2025 tells a compelling story. The 2025 Data Governance Benchmark Report shows that organizations with mature data quality frameworks experience 4.2x fewer data incidents than those without structured governance. This trend is particularly pronounced among organizations that have invested in structured approaches to compliance, suggesting that the "Wild West" era of ad-hoc data quality deployment is giving way to more disciplined, governance-aware implementation strategies. Industry analysts project that this shift will accelerate through Q3 and Q4, driven by both competitive pressure and evolving data lineage requirements.
