France's data regulator, the CNIL, has issued guidance confirming that legitimate interest is a viable legal basis under GDPR for training AI models on personal data scraped from public sources. Three conditions apply: a credible balancing of interests, demonstrable safeguards, and clear documentation. Skadden published the analysis.

This is one layer cleared, not the whole stack. The guidance addresses training-phase GDPR exposure only. Copyright, database rights, commercialisation constraints, and post-training litigation risk sit outside its scope entirely. Labs operating in Europe now have a cleaner path on one specific question, but the adjacent liabilities remain open.

Watch how enterprise buyers and cloud providers respond. A GDPR green light on training data sourcing makes European AI development marginally more viable, but operators deploying models still face deployment-phase constraints the CNIL did not touch. The compliance picture is narrower than the headline suggests.