Global AI Compliance Is No Longer Just a Legal Question

1. Establishing the right to train on customer data

A technology company collects information from EU users, sends selected datasets to a U.S. service provider, and uses them to improve an AI model offered in several markets. The arrangement is commercially familiar, but its legality depends on decisions that may have been made by different teams months apart: what users were told, why particular records were retained, whether the provider can reuse them, and which engineers can obtain access. Counsel cannot assess the arrangement reliably from a vendor agreement alone. The starting point must be a sufficiently precise account of the proposed training activity to distinguish it from delivering the service for which the information was collected.

Under the GDPR, an Article 6 lawful basis and compliance with purpose limitation must be established independently of any international transfer mechanism. Contractual necessity is a demanding test; adding model improvement to standard terms does not make it necessary to perform the user's contract. Legitimate interests requires a defined interest, a necessity assessment, and a balance against individuals' rights and reasonable expectations. For the company in this example, improving a narrowly defined support function presents a different case from contributing private customer conversations to a vendor's general-purpose model. The EDPB's Opinion 28/2024 supports case-specific analysis of AI development and deployment, rather than a presumption that commercial innovation justifies the processing. EDPB Opinion 28/2024.

Purpose limitation requires its own reasoning. Where Article 6(4) applies, the company must examine the relationship between the original and proposed purposes, the collection context, the data's nature, the consequences for individuals, and available safeguards. A generic reference to improving services cannot settle that assessment. Incompatible reuse cannot simply be repaired by asserting legitimate interests; it requires an appropriate legal route, such as valid consent for the new purpose, or a redesign. Consent, when used, must be specific, informed, freely given, and withdrawable. Special-category information also requires an applicable Article 9 condition. Customer records containing health information or revealing political beliefs therefore require more than an ordinary legitimate-interests assessment. GDPR, Articles 5–7 and 9.

These distinctions should influence dataset selection before training begins. The company should determine whether the objective can be achieved with fewer records, filtered fields, or genuinely anonymous information. Removing names alone does not establish anonymity, and a trained model cannot automatically be assumed to fall outside the GDPR: extraction and identification risks require evidence. Where processing is likely to create high risks, the data protection impact assessment must precede it. That assessment should address how applicable access, objection, and erasure rights will be handled across source records, training copies, and model outputs, rather than assuming that deleting an account resolves every consequence. EDPB AI opinion; GDPR, Articles 12–22 and 35.

2. Assessing the transfer and the access that follows it

Once the proposed use is defensible, Chapter V requires a separate assessment of the transfer. The EU–U.S. Data Privacy Framework remains a recognized adequacy route in the official materials reviewed for this article, but it covers qualifying transfers to participating U.S. organizations, not every recipient located in the United States. The exporter should verify the receiving legal entity's active participation and the relevant certification scope. A covered transfer does not require SCCs or an SCC-style transfer impact assessment merely because it goes to the United States. Other GDPR duties, including an Article 28 agreement where the recipient is a processor, remain applicable. EDPB DPF business FAQ.

Where the DPF does not cover the arrangement, SCCs may be available, subject to their scope and the parties' actual roles. Clause 14 requires a documented assessment of whether relevant destination-country laws and practices could prevent compliance with the clauses. This transfer impact assessment must address the actual recipient, processing chain, data, and access arrangements. If effective supplementary safeguards cannot remedy an identified deficiency, the transfer cannot proceed on that basis. Encryption in transit and at rest may provide valuable security without resolving government-access concerns where the recipient must process readable data and controls the keys. That distinction matters directly to U.S. model training: a contractual promise to protect information must be assessed against the provider's technical ability to do so. Commission SCC guidance; EDPB supplementary-measures recommendations.

The same analysis must follow subsequent access. Keeping the database in Europe does not prevent a Chapter V transfer when personal data are made available to a separate controller or processor in a third country, including a group company providing engineering support. Conversely, an employee of the same EU controller accessing data while traveling abroad is not automatically a separate importer; the EDPB distinguishes that situation while preserving the controller's security obligations. For the proposed training operation, the relevant map therefore includes support access, subprocessors, and onward disclosures, with the receiving entity identified at each stage. “EU hosting” is too imprecise to describe that arrangement. EDPB Guidelines 05/2021.

TikTok's Irish proceedings illustrate the consequences of inadequate transfer analysis, although they concern China and do not decide the legality of U.S. AI training. In May 2025, the DPC announced €530 million in fines and corrective measures concerning EEA user data transfers and transparency. The High Court's June 3, 2026 judgment rejected challenges to the underlying Article 46 and Article 13(1)(f) findings. Its June 30 judgment identified fine-calculation questions for reference to the CJEU. Separately, the Supreme Court had continued a stay of corrective orders pending determination of the High Court proceedings. The materials reviewed do not establish a later resolution of those questions or the present enforceability of every corrective order; neither a wholly unresolved merits appeal nor a fully concluded enforcement outcome should be assumed. DPC announcement; June 3 judgment; June 30 judgment.

3. Allocating obligations across the AI supply chain

The AI Act introduces a different inquiry: what is being developed or deployed, for which purpose, and by whom? Sending personal data abroad for training does not itself make a system high-risk. A customer-support application and a system used to rank employment candidates can involve similar underlying models while attracting materially different obligations. Nor does purchasing access to a model necessarily make the buyer its provider. In the example, counsel must distinguish the upstream model provider, any downstream system provider, and the organization deploying the application. Changes to branding, intended purpose, or the system itself can require that allocation to be reconsidered. EU AI Act.

Providers of general-purpose AI models face obligations concerning technical documentation, information for downstream providers, copyright policies, and public summaries of training content, subject to applicable exemptions. Providers of models presenting systemic risk face additional evaluation, risk-management, incident-reporting, and cybersecurity duties. High-risk system providers have a separate set of responsibilities, including risk management, data governance, documentation, and conformity requirements; deployers have obligations tied to their use and oversight of those systems. A business integrating an external model therefore needs enough supplier information to discharge its own duties, while retaining responsibility for the customer data it contributes. An upstream assurance of AI Act compliance does not supply a GDPR lawful basis for that contribution. Commission GPAI guidance; AI Act overview.

Timing now requires particular care. Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on July 27, 2026. The amended timetable places the principal Annex III high-risk requirements on December 2, 2027, and corresponding Annex I product-related requirements on August 2, 2028. Those extensions do not postpone the entire Act: applicable prohibitions, GPAI obligations, and transparency requirements operate on their own schedules, with relevant transitional provisions. GPAI models placed on the market before August 2, 2025 also have a distinct August 2, 2027 compliance deadline. The company's implementation plan should therefore identify the provision, regulated role, product version, and applicable transition, rather than assign one “AI Act deadline” to the business. 2026 amending Regulation; Commission implementation guidance; GPAI transition.

4. Making the legal assessment govern the operation

For the EU-to-U.S. training project, approval should attach to a defined operating arrangement. Product leadership should own the proposed purpose and dataset; engineering should demonstrate that exclusions, retention limits, and access restrictions work; procurement should secure enforceable supplier commitments; and legal and privacy teams should record the conditions on which the arrangement is permissible. If the vendor reserves the right to train its own models, that use must be assessed on its merits. Calling the vendor a processor in the agreement cannot settle its role where it determines a separate purpose. The company should resolve that issue before transferring records, because contractual remediation after training may offer limited practical control over what has already occurred.

ISO/IEC 42001 can organize the AI management system, while ISO/IEC 23894 and NIST's AI Risk Management Framework provide methods for assessing and managing risk. Their value lies in making review responsibilities and supporting evidence repeatable across products. They do not independently authorize processing or international transfers. Nor should an ISO certificate be represented as comprehensive AI Act approval: any statutory presumption of conformity depends on the relevant legal mechanism and the requirements covered. For this project, the useful output is a maintained record connecting the approved dataset and purpose to supplier terms, access testing, model evaluations, and release decisions. ISO/IEC 42001; ISO/IEC 23894; NIST AI RMF.

Supplier review may also expose a separate sanctions issue. Where U.S. jurisdiction and the relevant sanctions rules apply, screening the provider's name is insufficient if blocked persons own 50 percent or more, directly or indirectly and in the aggregate. OFAC's ownership rule can capture an unlisted entity; applicable authorizations and the particular transaction still require examination. This belongs within broader third-party diligence, without confusing sanctions clearance with privacy or AI compliance. OFAC ownership guidance.

The approved arrangement should remain reviewable as it changes. A new training source, an additional support location, expanded vendor reuse, or deployment into recruitment can invalidate assumptions that were reasonable at launch. Review should occur before those changes take effect, alongside periodic testing of existing controls. Management needs to know who can stop the affected processing, what evidence would support restarting it, and which unresolved questions require qualified counsel. That makes the original legal assessment usable throughout the product's life, including when commercial pressure favors proceeding before the answers are complete.

About Meridian Strategy Partners

Meridian Strategy Partners provides business and regulatory compliance advisory support, with a focus on U.S. market entry, cross-border business operations, technology governance, and regulatory risk assessment.

Sources

• GDPR (Regulation (EU) 2016/679), EUR-Lex.
• EU–U.S. Data Privacy Framework, U.S. Department of Commerce; EDPB business FAQ, version 2.0.
• Standard Contractual Clauses for international transfers, European Commission.
• Irish DPC, TikTok decision announcement, May 2025; High Court, June 3, 2026; High Court, June 30, 2026.
• EU AI Act (Regulation (EU) 2024/1689), EUR-Lex, as amended by Regulation (EU) 2026/1744; Commission implementation overview.
• ISO/IEC 42001:2023.
• ISO/IEC 23894:2023.
• NIST AI Risk Management Framework.
• OFAC Specially Designated Nationals and Blocked Persons List.
• OFAC guidance on entities owned by blocked persons (50 Percent Rule).
• EDPB Opinion 28/2024 on AI models; Guidelines 05/2021 on international transfers; Recommendations 01/2020 on supplementary measures.
• European Commission, GPAI provider guidance.

Disclaimer: This article is provided for general informational purposes only and does not constitute legal advice. Regulatory requirements and implementation deadlines may change. Businesses should obtain advice from appropriately qualified legal counsel regarding their specific circumstances. The hypothetical scenarios discussed above do not describe actual client engagements.