The starting point worth knowing
At the end of 2024 the European Data Protection Board issued an opinion on data processing in connection with AI models, answering four questions from the Irish supervisory authority. That document has been the reference point ever since.
Its most important finding: AI models trained on personal data cannot be considered anonymous in every case. The Board rejected the general presumption that a model becomes anonymous purely by virtue of being a model.
The test is twofold, and both conditions have to hold: the probability must be negligible that (1) personal data can be extracted directly from the model, and (2) that it can be obtained through queries. The assessment has to take into account "all means reasonably likely to be used", case by case — and the design decisions, the analysis and the resistance testing have to be documented.
The practical translation: the "it is only a model, the data is not in there" argument is not an acceptable default.
Legitimate interest: the three-step test
If you rely on legitimate interest, you have three steps to work through:
1. Does the interest exist at all? According to the Board it is legitimate if it is "lawful; clearly and precisely articulated; real and present, not speculative".
2. Is it necessary? There is no less intrusive route to the same purpose, and the purpose cannot reasonably be achieved another way.
3. Does it survive the balancing? This is where practical cases are decided, and the Board lists the factors: was the data publicly accessible, what is the relationship with the data subject, where was it collected from, what else the model could be used for, and whether the data subject actually knows about it.
And a sentence worth remembering: transparency on its own is not enough. Writing it into your privacy notice does not make it lawful.
If the model was trained unlawfully
The opinion distinguishes three scenarios, and one of them has a direct business consequence for you:
If you take over a model and build it in behind your product, then you have to carry out an appropriate assessment to establish whether the model was developed through unlawful processing. This is not a theoretical duty — it is becoming part of supplier due diligence.
The third scenario is reassuring, though: if the model was genuinely anonymised afterwards, the GDPR does not apply to its subsequent operation. Unlawfulness in development does not "poison" lawful use forever.
What happened in 2025–2026 — three cases and one absence
The Italian 15-million-euro fine was set aside. This is the most important recent development and it is missing from a lot of summaries. In November 2024 the Italian authority imposed a 15-million-euro fine and a six-month public information campaign on a large chatbot provider — for failing to report a data breach, for a missing legal basis for training, for breaching transparency, and for the absence of age verification. A Rome court judgment published on 18 March 2026, however, upheld the appeal, and the authority took the decision off its website. The reasoning of the judgment and whether it is final are not public.
What can be used instead is a 158,000-euro fine imposed in the summer of 2026 on a US conversational chatbot provider. This one is more instructive, because the list of provisions breached is exactly what a company launching its own chatbot could trip over: accountability, transparent information, information duties for data collected from the subject and from elsewhere, controller responsibility, data protection by default, the absence of an EU representative, and the failure to carry out a data protection impact assessment.
An Irish inquiry opened in February 2026 into a social platform's generative feature: over the creation and publication of intimate images without consent, involving children too. The provisions under examination: the GDPR principles, the legal basis, data protection by design, and the impact assessment. The same conduct becomes a prohibited practice under the AI Act from 2 December 2026 as well.
National enforcement practice, though, is missing in most member states. Enforcement so far sits with a handful of authorities — the Italian, the Irish, the French — while plenty of national regulators have not published a single decision on an AI chatbot or a generative model. The absence does not have the same cause everywhere, and that difference matters if you were going to build an argument on it. Open the one that applies to you:
Hungary — the NAIH does not have a single chatbot decision
Going through the published decision list of the Hungarian data protection authority, the NAIH — whose most recent published item dates from May 2026 — not one decision concerns an AI chatbot or a generative model. On the authority's website the word "chatbot" returns a single hit, and that is a news item about an Italian decision.
That is important information in itself: there is no Hungarian enforcement practice on this question yet. Anyone saying "the NAIH has ruled on this" is wrong — or is quoting an EU-level board opinion as if it were a national decision.
What must not be inferred from it: the absence of a decision is not a permission. The GDPR applies exactly the same, the authority has the competence, and the first case simply has not happened yet.
Spain — the AEPD investigated one of the big providers, then let it go, and is still far from idle
On 13 April 2023 the Spanish authority opened an own-initiative investigation into the largest chatbot provider, and asked for the matter to be put on the European Data Protection Board's agenda. It then closed the file: since 15 February 2024 the provider's Irish subsidiary has been the controller for the European Economic Area, so under the one-stop-shop mechanism the Irish authority is the lead supervisor. No Spanish fine followed — but not because the authority found the service in order.
There is still no Spanish fine over generative AI. AI-adjacent ones there are plenty of, and they are all biometric: facial recognition during online exams at a university, and a fine of roughly 10 million euros on the airport operator over an incomplete impact assessment for biometric boarding.
A third case sits closer to the "what may I type in" question than any chatbot decision: in March 2024 the AEPD used an emergency measure to halt the Spanish data collection of an iris-scanning identity project, and the Spanish national court upheld that measure on 30 June 2026.
On guidance, Spain is one of the most active authorities: recommendations for chatbot users, a March 2025 blog post stating that a generative model can retain training information and that it may be recoverable or disclosable, and two separate 2026 documents on voice transcription and on agentic AI. So: no decision, but a position — and the position lines up with the European board's.
The seven questions to work through in order
This is the practical core of the article. Before you type anything into an AI tool, this is the sequence:
1. Is there personal data in it? If not, there is no GDPR question — what remains is trade secrecy and contractual confidentiality, which is reason enough for caution on its own. Important: pseudonymised data stays personal data. The yardstick for anonymity is that no single record can be singled out, linked, or used to infer anything.
2. What legal basis are you processing it on in the first place? If you collected the customer data to perform a contract, then feeding it to a chatbot is a new purpose. That needs either a compatibility assessment or its own legal basis.
3. Who is the recipient, and in what capacity? This is the sharpest dividing line:
| What you use | The provider's role | Can customer data go in |
|---|---|---|
| Paid business subscription with a signed data processing agreement | processor | yes, with a documented legal basis |
| Free or consumer account | typically no such agreement, and processing for its own purposes too | no |
4. Does it leave for a third country? Transfers to the United States need an adequacy framework or contractual safeguards. The current EU framework is in force but has been challenged: the EU General Court dismissed the action in September 2025, the applicant appealed, and the case is pending.
5. Is there special category data in it? Health, biometric, belief-related, trade union or sex-life data. On top of the usual legal basis this needs a separate exception as well. In customer complaints, HR files and CVs this comes up more often than you would think.
6. Is there children's data in it? Both the Italian and the Irish case turned on this. The absence of age verification was a standalone infringement in both authorities' findings.
7. Do you need an impact assessment? If you are launching a publicly accessible generative chatbot, then in practice yes — one item of the 2026 Italian fine was precisely the failure to do one.
The legal value of "zero data retention"
Several providers offer a setting where the data you submit is not stored at all. This is useful, but it is a contractual promise, not a legal status. Five things it does not solve:
- It does not turn what you send into non-personal data. The transfer and the use have happened — only the storage is skipped. The concept of processing covers collection, use, consultation and transmission as well.
- It does not replace the legal basis. The fact that it is not stored does not remove the need for a basis to send your customer's data to a third party at all.
- It does not replace the data processing agreement, and it does not solve the question of transfer to a third country.
- It is conditional. It can typically be requested for certain endpoints and certain use cases, not automatically for everything.
- It does not protect you from liability if the submission itself was unlawful — for example if purpose limitation or data minimisation was breached.
On the provider side the defaults are mostly favourable these days: on business plans the large providers commit contractually to not training on customer business data, and they have a data processing addendum you can sign. Retention periods, however, differ from plan to plan, and those are worth reading item by item rather than assuming. Where the data stays inside the company is the subject of private AI inside your company, in practical terms.
The rule of thumb
| Fine to send | Only on a business account, with a contract and a documented legal basis | Do not send, or only with a separate exception |
|---|---|---|
| public company text | customer name, email address | health data |
| your own legal document template | contract text | children's data |
| anonymised or invented sample | customer support ticket | biometric data |
| technical log without identifiers | CV, job application | data about a third party you cannot inform |
Two misunderstandings worth clearing up
"If they do not store it, it is not processing." It is. Transmission and use are processing in themselves.
"An EU server sorts it out." It helps with the transfer question, but it does not replace the legal basis, the contract or the impact assessment. European availability and its limits are what the European AI options cover.
What to take away
Two new EU guidelines are in preparation — one on anonymisation, the other on web scraping for generative AI purposes — but in the autumn of 2026 both are drafts, with the public consultation running until 30 October 2026. They cannot be cited as binding rules yet; next quarter it will be worth checking where they got to.
Until then the seven questions are the usable compass. The two most important: what kind of account you are working in (business, with a signed contract — or a free one), and whether it contains data you did not give about yourself. The rest follows from those.
And if the team is already using AI tools, just from personal accounts, then this article arrives later than it should have: mapping your shadow AI starts with finding out what is actually there.