Data Protection Breaches in AI Training: Consequences for the AI System

​​​​​​​​​​​​​​​​​​​​​​published on 25 June 2025 | reading time approx. 4 minutes

According to Art. 58 GDPR, supervisory authorities can prohibit the use of an AI system or order its deletion if the underlying data processing was unlawful. As a result, the entire AI system could no longer be used, even if it functions technically flawlessly;

Violations of the General Data Protection Regulation can be sanctioned with fines of up to 20 million euros or 4 per cent of the annual global turnover in accordance with Art. 83 GDPR. 

In addition, from August 2, 2025, the sanction provisions of the AI Act will apply, which provide for further fines in the event of prohibited AI systems or a lack of transparency - with an upper limit of up to 35 million euros or 7 per cent of the annual global turnover. For data-driven AI systems that are provided externally or exploited commercially, this can become a significant business risk, not only financially but also strategically;

In addition to official measures, data subjects can assert claims under civil law, in particular for damages in accordance with Art. 82 GDPR. This presupposes that they become aware that their personal data has been used unlawfully, for example through requests for information on data protection, public proceedings or media reports. In the case of complex AI systems, it is often not readily apparent to data subjects whether and how their data is being processed in the AI system. Nevertheless, a verifiable reference is sufficient to trigger claims, e.g. if a personal reference can be technically reconstructed or the AI system generates content that can be traced back to identifiable data. 

Publicly known breaches also often lead to reputational damage - the trust of customers, partners or investors can be permanently impaired, especially if the AI system is already visible on the market.​