AI training data · A CEO perspective
Legitimate Interest Is Not a License for AI Training Data
By Manuel Herranz, Founder and CEO of Pangeanic
After my participation in the European Language Data Space’s Audiovisual Data and AI Forum, I found myself returning to a question that occupies rather more of my working week than discussions about model size: what, exactly, are we entitled to deliver when someone buys training data?
I have spent much of my professional life working with language, first through translation and subsequently through the corpora, machine translation systems, and data operations that grew around it. That history gives me a particular perspective on the current market. I recognize the enthusiasm for volume. I also recognize the moment when a buyer discovers that volume is an inadequate description of what they need.
In translation, counting words never told us whether a contract preserved its meaning. In AI, counting hours, files, or tokens tells us remarkably little about whether a dataset is suitable for its intended use.
My view is that the GDPR and the AI Act are accelerating a change in what a serious data supplier must be able to explain. Origin, permitted use, processing history, and review increasingly belong to the product itself. They affect what can be bought, how quickly it can be delivered, and whether the buyer can use it with confidence.
What buyers actually ask us
In our commercial conversations about training data, the questions quickly become practical. Where does the material come from? Does it reflect real activity or a constructed scenario? What has been annotated? Where has a machine contributed, and what did a person subsequently check? Which uses can we support with documented permissions?
Those questions are familiar to anyone who has tried to turn a promising collection into a usable dataset. A sample may demonstrate relevance. It cannot, by itself, establish the availability, rights, or quality of a larger delivery.
I find clinical speech particularly instructive. A recording of an actual consultation and a consultation performed by people from a fictional case brief may both be described as “doctor–patient data.” Their provenance, privacy questions, and suitability for evaluation differ considerably. A buyer asking for naturally occurring speech is specifying something that a convincing simulation cannot simply replace.
At Pangeanic, I want that distinction established before anyone discusses scale. Our guide to real, simulated, and synthetic clinical conversation data explains the categories. The larger commercial lesson is that an attractive sample should open an investigation, rather than close one.
The GDPR affects what we can prepare and share
The GDPR asks us to examine the processing of personal data: its purpose, lawful basis, necessity, safeguards, and the rights of the people concerned. The appropriate basis depends on the operation. A supplier’s assessment does not automatically settle the buyer’s position for a different use.
Legitimate interest already exists within that framework. The EDPB’s opinion on AI models describes the need to establish the interest, assess necessity, and balance it against individuals’ rights. It also cautions against assuming that a model trained on personal data is necessarily anonymous.
The Council’s October 2026 Digital Omnibus negotiating position proposes changes to the digital framework, including the GDPR. I welcome efforts to make the rules more workable. But a negotiating position is not adopted GDPR law, and clearer privacy rules would still leave copyright and contractual rights to examine separately.
That distinction affects the everyday work of a data company. We may identify relevant material and still need to establish which downstream uses its source can support. Availability is partly a question of permissions. A file on a server is not yet an asset we can responsibly offer for every purpose.
The AI Act changes the evidence buyers need
The AI Act approaches the industry from another direction. For providers of general-purpose AI models, Article 53 includes technical documentation, a policy for compliance with EU copyright law, and a public summary of training content. The Commission provides a mandatory template for that summary, while the General-Purpose AI Code of Practice is a voluntary compliance tool.
These distinctions are consequential. Selling a dataset does not, by itself, make a company a general-purpose model provider. Nor does every purchaser of training data acquire the same obligations. Roles and intended uses need to be identified.
Nevertheless, I see a straightforward commercial consequence: a buyer who must explain its training sources needs information from the businesses that supply them. The legal obligation may sit with the model provider, while requests for source documentation, processing records, and contractual assurances travel upstream.
For a supplier, this changes the work behind a quotation. We need to know which information we can substantiate and deliver. For the buyer, it changes the specification: documentation needs to be agreed before the files arrive.
A public training summary is also not a certificate that every use is lawful. Transparency helps scrutiny; it does not replace the underlying assessment. Our provenance and licensing guide addresses that chain of evidence in more detail.
Removing names is only the beginning
The shift toward enterprise AI makes these questions more interesting. A company’s operational knowledge is distributed across documents, messages, records, and code. A useful agent may need to understand how a request became an approval, what changed between versions, or why an exception was escalated.
Consider a constructed example. A purchasing manager asks for a revised proposal, a colleague checks a restriction, and someone with the appropriate authority approves the expenditure. Those events appear in different records. If we replace the same person with a different identity in every record, we can destroy the relationship we wanted the model to learn. If we preserve all the context without examining identification risk, we may leave the person recognizable.
This is an engineering and governance problem together. Consistent substitution can preserve useful relationships. It does not, on its own, demonstrate anonymization. The EDPB distinguishes pseudonymization from anonymization: reducing the link to a person and making a person no longer identifiable are different outcomes.
I want that difference stated plainly in a specification. The assessment must consider the recipient, the context, and the information reasonably available for identification. Even an effectively anonymized output does not retrospectively settle the lawfulness of collecting or processing the original personal data.
There are other interests to protect, too. Corporate confidentiality, intellectual property, and contractual restrictions do not disappear when personal identifiers are removed. Privacy preparation cannot manufacture the right to resell a business’s information.
This is the practical territory of multilingual data masking and anonymization. It calls for decisions about what to preserve, what to transform, and how to assess the result for the intended use.
The value is moving toward context and judgment
I see a growing opportunity in preparing enterprise document datasets that preserve the structure of real work. But I would distinguish learning how an organization operated from learning how it ought to operate. An archive contains mistakes, obsolete policies, and exceptions as well as good decisions.
An agent trained to imitate those records may reproduce their defects. Buyers therefore need to decide which examples demonstrate desirable behavior, which provide context, and which should be reserved for evaluation. Cleaning the files is one stage in a longer process.
Here my experience in translation becomes useful again. A fluent sentence can still reverse an obligation. A plausible account of a business decision can still assign authority to the wrong person. In both cases, quality depends on understanding relationships and consequences that a surface check may miss.
That comparison deserves a longer discussion. For now, the lesson I draw is that the data industry needs room for specialist judgment, and a way for purchasers to recognize what that judgment contributes.
What I would put in the purchase order
I would ask for a defined source history, a documented basis for the proposed uses, a description of privacy transformations, and review results relevant to the languages and modalities being purchased. I would also agree how to identify and handle an affected source if a problem emerges after delivery.
Then I would connect those commitments to a versioned pilot acceptance decision. The buyer should know which delivery was reviewed, what passed, what remains uncertain, and who authorized the next step.
There is a temptation to regard all this as administrative ballast. I regard much of it as the information that makes the asset tradable. The industry has become extremely good at moving files. We now need comparable discipline in moving the evidence that accompanies them.
For Pangeanic, this is a central part of AI Data Operations: connecting source material, rights, preparation, human review, and evaluation into a process that a buyer can examine.
Europe will not resolve every difficulty in the data market by writing another rule. Nor will suppliers resolve those difficulties by attaching a reassuring label to a download. My ambition is more practical: to build a business in which the customer can understand what they are buying, why it is useful, and what supports its intended use.
That is a responsibility I am quite willing to put my name to.
If you are planning a training or evaluation dataset, discuss the intended use with our team. Source selection, privacy preparation, review, and acceptance should be part of the same conversation.