Aipedia: Data protection consultants

Legitimate interests assessments for AI training

Aipedia, by the Apex broking team · Last reviewed 2026-10-27

Consultants advising on training or fine-tuning AI with personal data must identify a lawful basis that genuinely fits, and legitimate interests is often the candidate. The ICO set out new positions in October 2026, so assessments written earlier may need revisiting.

Part of: AI in Data protection consultants

In short

Clients that build or fine-tune AI models on customer, employee or public data need a lawful basis, and legitimate interests is the usual candidate. The DUAA added recognised legitimate interests, a separate basis for a set list of purposes; it cannot support solely automated significant decisions, and advisers should not assume it covers AI training. Special category data needs an Article 9 condition as well. In October 2026 the ICO published its position on how special category data can be used lawfully and whether foundation models contain personal data. A weak assessment can unravel a client's whole AI project.

What clients ask

The questions come from clients building their own models, fine-tuning a general model on their data, or letting a vendor use their data to improve a product. Examples include a software business training a support model on customer tickets, a recruiter fine-tuning a matching tool on past candidate files, and a retailer training a recommendation model on purchase histories. The consultant is asked to write or review a legitimate interests assessment, or to say whether another basis is better. Each scenario raises an expectation question, because the people whose data is used did not provide it for model training.

The rules that apply

Legitimate interests: the controller must identify a legitimate interest, show the processing is necessary for it and balance it against individuals' interests and rights. Training on data collected for another purpose raises compatibility and expectation questions.
Recognised legitimate interests: the DUAA added a basis for a set list of purposes, which removes the balancing test for those purposes. Check the list rather than assuming AI training is on it.
Article 22B: recognised legitimate interests cannot support a solely automated significant decision, so a trained model used to make such decisions needs a different basis for that use.
Article 9: special category data, including biometric data used for unique identification, health data and data revealing ethnic origin, needs an Article 9(2) condition as well as a lawful basis.

The October 2026 ICO positions

On 8 October 2026 the ICO reported that ten foundation model developers had made or committed to changes on transparency, rights and safeguard assessments. Its report set out the ICO's position on how special category data can be used lawfully and whether foundation models themselves may contain personal data. The ICO also said that current foundation model training practices present technical challenges and that it is raising these with Government. Foundation models guidance is listed for Autumn 2026.

Consultants should read the report itself before advising, and should revisit assessments written before October 2026 where they relied on assumptions about special category data or about whether a model holds personal data.

What can go wrong

Illustrative scenario: a consultant prepares a legitimate interests assessment for a client fine-tuning a model on several years of customer support chats. The assessment does not consider that some chats contain health information, nor whether customers would expect their messages to be used this way. After the model launches, a customer complaint leads to ICO enquiries. The client has to stop using the model and retrain without the affected data, and claims its wasted costs from the consultant.

How PI usually responds

An assessment that fails to identify obvious risks is a professional negligence issue, and PI usually responds to the client's claim, subject to the terms. Losses here can be large, because a model trained on data without a lawful basis may need to be rebuilt. Check whether your policy has limits or exclusions for clients' AI development work and how it treats AI clauses. Consultants who also build or sell AI tools should read AI insurance in the UK.

Practical controls

Establish exactly what data goes into training, including free text that may hold special category data.
Test individuals' reasonable expectations, not just the client's interest.
Do not assume recognised legitimate interests applies; check the list.
Separate the training basis from the basis for any decisions the model makes; see advising on automated decisions.
Reflect the conclusions in the DPIA and the privacy notice.
Date the assessment and list the ICO material relied on.

How Apex helps

Apex arranges PI for data protection consultants. A broker can review how your policy treats advice on clients' AI development; see the data protection consultants' AI hub.

Sources

Frequently asked

Can recognised legitimate interests be used for AI training?

Only if the training falls within one of the purposes on the DUAA list, which should be checked rather than assumed. It cannot support solely automated significant decisions under Article 22B. Otherwise, ordinary legitimate interests, with a balancing test, or another basis is needed.

What if training data includes special category data?

An Article 9(2) condition is needed as well as a lawful basis. The ICO's October 2026 report sets out its position on how special category data can be used lawfully in foundation models, and should be read before advising.

Do assessments written before October 2026 need updating?

Often, yes. The ICO published its positions on special category data and on whether models contain personal data on 8 October 2026, and foundation models guidance is due in Autumn 2026. Assessments that relied on earlier assumptions should be reviewed.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.