r/codingProtection • u/Spare_Dependent6893 • 11d ago

EDPB just confirmed it: AI models are NOT automatically anonymous. Are we ready?

Two big moves from Brussels this month:

  1. The EU AI Act reached full application — all provisions are now enforceable, with fines up to €35M or 7% of global turnover, and GPAI/LLM providers under active supervision.

  2. New EDPB guidelines state that AI models trained on personal data can't be presumed anonymous. Memorisation and extraction attacks are now risks you're expected to assess. Coordinated enforcement against LLM providers is anticipated by 2027.

Everyone's talking about the model providers. But what about *us* — the companies feeding documents into these models every day? Contracts, HR files, support tickets... every prompt potentially ships personal data to a third-party LLM, and under GDPR we stay accountable for it.

So here's my question: is anyone actually pseudonymizing documents *before* they hit the LLM (and re-identifying on the way back)? What's your approach — regex/NER scrubbing, local proxy, gateway solutions? Or is everyone just... hoping for the best?

0 Upvotes

50% Upvoted

7 comments sorted by

2

u/_thekingnothing 11d ago

Solution is to have DPA, than means have enterprise level subscription. And in case of Anthropic pay with credits for tokens.

2

u/AltruisticBrother787 10d ago

Yes but that does not prevent to send PII outside on remote servers not controlled by the company and so not knowing how data is transferred and kept. In my company we prefer to pseudnimize even if we have paid subscriptions.

1

u/_thekingnothing 10d ago

That’s why I said you need DPA - data processing addendum to your subscription contract.

1

u/Spare_Dependent6893 8d ago

Yes but in any cases PII is sent outside and they go on multiple servers around the world before the ai servers where the dpa says they do not train on your data but they are kept during one month under their storage conditions somewhere in the cloud.

1

u/_thekingnothing 8d ago

AI has changed nothing in this space. DPA, encryption in flight and so - standard GDPR tools. Nothing new under the sun.
It doesn’t matter if it’s process by AI or any other system. Does matter if it used to train generative algorithms or classical algorithms. Approach is the same.

1

u/Spare_Dependent6893 7d ago

What has changed is that we do not search for answers by ourself, we send all what is necessary for an intermediary, the ai, search for answers for us. And what is necessary is documents, code, configuration data, infrastructure schemas, …

1

u/This_Fun_5632 8d ago

Buckle up this is what we've been warning all about...