This is where most training plans fall down, so a few legal questions need answers before you feed a customer database to an AI model.
Settle your role first, then build the dataset
A SaaS vendor processes customer content on the customer's documented instructions, and Article 28(3)(a) GDPR gives a processor no other basis. Training the vendor's own model on that content is a new purpose, and the instructions say nothing about it. Nor can the vendor decide on its own that the new purpose is compatible with the original one. The compatibility test in Article 6(4) GDPR shows whether data can be used for a new purpose that is linked to the original one. It looks at the link between the purposes, the context in which the data was collected and the relationship with the individuals, the nature of the data, the possible consequences for those individuals, and safeguards such as encryption or pseudonymisation. The test is carried out by the controller, which is the customer and not the vendor. On top of that, the purpose limitation principle in Article 5(1)(b) rules out using data for purposes the parties never agreed on.
The picture changes when the data really is yours: your own users, telemetry, licensed datasets, or customer data that the contract expressly allows you to use for training. You are then the controller and can rely on legitimate interests under Article 6(1)(f) GDPR.
To do that, you need to pass the three steps the EDPB set out for AI models in Opinion 28/2024:
- The interest is lawful, specific and already real. "Improving document search for our users" qualifies. "Developing AI" does not.
- The goal cannot be reached without this data or with less of it, for example because the model will not learn from anonymised or synthetic data.
- The rights and interests of the people whose data you use do not override your interest. The assessment considers whether they could reasonably expect this use and what safeguards you have put in place, such as a right to opt out, minimisation and pseudonymisation.
In Case C-621/22 (Koninklijke Nederlandse Lawn Tennisbond, October 2024), the CJEU confirmed that a purely commercial interest can also be legitimate. Plans usually fail at the second and third steps.
For special categories of data, meaning data on health, biometrics, ethnic origin, political opinions and the other information listed in Article 9 GDPR, this route is closed. Legitimate interests do not extend to such data. The new Article 4a of the AI Act makes a narrow exception: special category data may be used only where the model's bias cannot otherwise be detected and corrected, for example to check whether it screens out candidates of a particular origin. Safeguards are required, and the data is deleted once the bias has been corrected.
You will have to prove anonymisation
Teams often treat anonymisation as a box to tick before training starts. For a regulator it is a claim, and the vendor is the one who has to prove it.
Pseudonymisation means replacing names, email addresses and other direct identifiers with codes, while a key for re-linking them is kept somewhere. For a vendor that holds both the key and the source data, such data remains personal data under Article 4(5) GDPR. Hashing an email address or user ID is also only pseudonymisation: the same address always produces the same hash, so the record is easy to link back to a person.
Data becomes anonymous when neither you nor anyone else can link it to a specific person using means reasonably likely to be used (Recital 26 GDPR). The Regulation does not apply to such data.
A trained model is not anonymous by default. What a model has learnt is stored in its parameters, known as weights. If personal data can still be extracted from the weights or obtained by querying the model, the model itself falls within the GDPR. A supervisory authority may then order it to be deleted or retrained.
On 8 July 2026 the EDPB adopted draft guidelines on anonymisation and on web scraping for generative AI, and the consultation runs until 30 October 2026. Under the proposed criterion, data counts as anonymous only if it cannot be used to single out a person, link records to them or infer new information about them.
We recommend putting the anonymisation conclusion in writing, as a separate opinion prepared before training begins. It should describe what data was used, how it was de-identified and how you checked that the model does not reproduce source records in response to test prompts. This is the document a supervisory authority will ask for, and an opinion written once an investigation is already under way will prove very little.
Liberalisation has not arrived yet
In November 2025 the European Commission proposed the Digital Omnibus package of amendments. It would give AI developers an express right to rely on legitimate interests and would narrow the definition of personal data. For now it is only a proposal and is unlikely to be adopted before 2027. In February 2026 the EDPB and the EDPS, the EU's data protection bodies, also issued a critical joint opinion on it.
On the AI side, a separate package of amendments to the AI Act, the Digital Omnibus on AI (Regulation 2026/1744), has already been adopted. It left the obligations of general-purpose AI model providers under Article 53 unchanged. The AI Act uses this term for large, versatile models such as GPT, Claude or Llama (general-purpose AI, GPAI) that can be built into many different products. Anyone who trains such a model and places it on the market must still keep technical documentation, have a copyright compliance policy that respects rightsholders' reservations, and publish a summary of the training data using the Commission's template. A SaaS business that trains a narrow model for a single product feature is usually outside these requirements. One that releases its own general-purpose model is caught by them.
Confidentiality and copyright
Apart from the personal data angle, customer documents are usually protected as confidential information under the main contract and as trade secrets under Article 11 of the Polish Act on Combating Unfair Competition. If you train a model on them without the customer's permission, you are using them in a way the contract does not allow. The customer can claim damages and terminate the contract. That is a civil dispute with the customer, and anonymising the personal data offers no protection against it. If you plan to train on customer documents, this use has to be written into the contract documents, usually together with the customer's right to opt out of such training.
For material scraped from the internet or obtained under licence, copyright is a further issue to analyse. Since its 2024 amendments, the Polish Copyright Act has permitted automated analysis of text and data (text and data mining, TDM). For commercial purposes the exception applies only if the rightsholder has not expressly opted out. There is no Polish case law on AI training yet, including on whether the TDM exception covers only the training itself or also what the model later memorises.
In November 2025, in GEMA v OpenAI, the Munich Regional Court held that where a model has memorised song lyrics and can reproduce them, this is copying that the TDM exception does not cover. In the same month the High Court of England and Wales reached the opposite conclusion in Getty Images v Stability AI: the model's weights do not store copies of the images, so the model itself is not an infringing copy.
Until the case law settles, SaaS businesses should check rightsholders' reservations before collecting data, keep records of where their datasets come from and test whether the model reproduces training texts word for word.
The market wants no-training clauses
Enterprise customers buying SaaS usually require vendors to agree that their data will not be used for training. OpenAI, Anthropic and Microsoft confirm in their commercial plans that business customer data and data sent through the API are not used for training by default. On request, zero data retention can also be switched on, so the provider does not store prompts or responses.
Regulators are already taking action against AI providers and holding major brands to account for training on personal data. In December 2024 the Italian Garante fined OpenAI EUR 15 million, partly for training without a legal basis, and since April 2025 the Irish Data Protection Commission has been investigating the training of the Grok model on posts by European users of X.
In Poland, the Personal Data Protection Office (UODO) has not yet issued any decisions on AI training. An expert group works within the Office, and its representatives speak publicly about two problems: models memorise data, and the ways of opting out of having one's data used for training (opt-out) still work poorly. According to a UODO survey, 95.9% of organisations are not ready to use AI in line with the GDPR.
REVERA's recommendations
- Sort your data into categories: customer content, your own telemetry, licensed datasets and public data from the internet. Each category has its own rules.
- Determine your role for each category. As a processor, you cannot train a model without the customer's documented instructions.
- Set out the right to train expressly in the main contract and in the data processing agreement (DPA). With enterprise customers, train only with their prior consent (opt-in). For self-serve customers on a standard plan, the most lenient acceptable option is training by default with a right to opt out. The terms should state the categories of data, retention periods and the right to withdraw consent.
- Before training begins, put three documents in writing and keep them with the model documentation:
- a legitimate interest assessment (LIA) following the three steps in EDPB Opinion 28/2024;
- an anonymisation opinion describing the methods used and the results of testing the model for data extraction;
- a data protection impact assessment (DPIA) under Article 35 GDPR, which is carried out before high-risk processing; training on large volumes of customer data usually falls into that category.
- Check the confidentiality and trade secret clauses in your customer contracts separately. Even if your personal data position is sound, training on customer documents may breach those clauses.
- Name model training as a processing purpose in your privacy policy and keep your list of sub-processors up to date.
How REVERA can help
REVERA's Arbitration & IT Disputes practice will be glad to advise SaaS and AI companies that want to train models on data. We usually start with an audit: we sort the data into categories, determine the company's role for each of them and show where training is already happening without a legal basis.
Based on the audit, we draft the training terms for the main contract, the DPA and the user terms, update the privacy policy, carry out the LIA and DPIA, prepare the anonymisation opinion and identify the company's obligations under the AI Act. We can negotiate training clauses with enterprise customers on your behalf. And if a dispute has already started, we represent the company in a dispute with a customer or a rightsholder, or in proceedings before a supervisory authority.
