GDPR and the EU AI Act in 2027

Two things are true about EU data regulation at the same time going into 2027, and they are pulling in different directions. Enforcement against AI systems that process personal data is intensifying, with regulators treating "the model was trained on it" as no defense against GDPR obligations. At the same time, the EU Digital Omnibus proposal is actively debating loosening parts of GDPR specifically to reduce friction for AI training, which has drawn pushback from regulators warning it could narrow the definition of personal data and weaken purpose limitation.

A work email, a job title, a LinkedIn profile URL are personal data under GDPR regardless of the B2B context, and regulators have been explicit that a model trained on personal data cannot always be treated as producing anonymous output. For a company whose product is structured people and company data, that means the compliance posture cannot be a policy document written once, it has to be an operational mechanism that holds up under actual enforcement scrutiny, which is a materially higher bar than it was a few years ago.

Erasure requests are the part of GDPR compliance that is easiest to claim and hardest to actually implement correctly. Deleting a record once is trivial. The part that separates a provider that has built this properly from one that has not is what happens on the next scheduled data refresh, whether a deleted identifier silently reappears because the ingestion pipeline has no persistent memory of the erasure.

Expect the regulatory debate over AI-specific carve-outs to continue without fully resolving, which means the safer operating assumption for any B2B data provider is to build to the stricter interpretation rather than wait for the looser one to become settled law. A provider that architects its erasure and lawful-basis handling around the current, stricter reading is not exposed if the looser Digital Omnibus language stalls or narrows in negotiation, which is the more likely outcome given the pushback it has already drawn.