What Is the Lawful Basis for AI? Navigating GDPR in a Probabilistic World

The rapid adoption of AI systems (particularly generative AI) is challenging how companies and institutions apply one of the most fundamental concepts in data protection: lawful basis. GDPR was designed for predictable, purpose-driven processing. By contrast, AI systems are probabilistic, adaptive and often trained on large-scale, multi-purpose datasets. This raises critical questions. What is the lawful basis for training and deploying AI? Can legitimate interest operate at scale? Is consent meaningful in complex AI ecosystems? At the same time, evolving discussions on the implementation and simplification of the EU AI Act—particularly for general-purpose AI—are reshaping how companies and institutions approach compliance. This panel will explore how lawful basis operates across the AI lifecycle, combining regulatory developments, emerging case law and practical implementation strategies. As the AI Act evolves, a key question remains: does simplification make lawful basis easier, or simply shift where the hardest decisions sit?

What you will learn:

• How to determine and justify lawful basis across the AI lifecycle, including when legitimate interest is defensible and where its limits are emerging. 
• When consent is required in AI systems and how to make it meaningful and operational in complex, large-scale environments.
• Practical strategies to align GDPR lawful basis with evolving AI regulation, including AI Act simplification trends and regulator expectations.