←Blog 一覧へ
◆34 分で読了

【Part 5】 How AI leaks data at every stage of its lifecycle — and what actually stops it

Hiroshi Nakagoe, CTO at CODAS & VPoE at Archetype Digital

BLOG

This is the fifth post in a series on privacy preservation for the GenAI era. The earlier posts were about what leaks and what stops it. The fourth reached the regulatory edge of that from the provider side — which sovereignty and residency programs exist, how narrowly a sector certification is scoped, and what a compelled-production order can reach. This one starts from the obligations themselves: the regulations that decide an architecture, and the machinery that actually satisfies them.

Earlier posts in this series:

【Part 1】 How AI leaks data at every stage of its lifecycle — and what actually stops it

【Part 2】 How AI leaks data at every stage of its lifecycle — and what actually stops it

【Part 3】 How AI leaks data at every stage of its lifecycle — and what actually stops it

【Part 4】 How AI leaks data at every stage of its lifecycle — and what actually stops it

Privacy-Protection-wise Managing Regulatory Obligations

Almost every obligation below resolves to a control already described in the earlier posts — a retention setting, a region pin, a provenance record, an access check — and the handful that do not resolve to anything are the most important paragraphs here.

Carry the confidentiality-versus-privacy distinction into this section too, because no regulator accepts the substitution. Confidentiality is about who can read the data; privacy is about what may be learned from it, by whom, and for how long. A supervisory authority asking for your lawful basis for training, honoring an erasure request, or explaining an automated decision is asking a privacy question, and a reply that describes encryption, key custody and an access log is answering a different one. That answer is not wrong so much as off-topic, and it is the single most common way a technically competent team fails an assessment.

One framing before the survey. Regulatory status as at 25 September 2026 is not what a reader would have predicted a year ago: the ratchet slipped in the West and tightened in Asia. The EU deferred its stand-alone high-risk obligations by sixteen months and failed to pass its GDPR reform; Colorado repealed and replaced its AI Act; the United States federal government is actively litigating against state AI laws; and the only significant European fine against generative AI training was annulled in March 2026 — on jurisdictional grounds, at first instance, with nothing decided about the training itself. Meanwhile Korea created a model-deletion remedy and used it, Japan legislated a training carve-out, China formalized a third cross-border transfer route, and India’s substantive regime lands in 2027. Build against what did not slip.

The regimes you are subject to

Europe

The GDPR was never amended, and it remains the binding constraint. The provisions that actually bite on a model build are narrower than the whole regulation. Article 6(1)(f) is the only practical basis for a web-scraped corpus, and requires documenting three conditions the EDPB treats as cumulative: that a legitimate interest is actually being pursued, that processing the personal data is necessary for it, and that “the interests or fundamental freedoms and rights of the concerned data subjects do not take precedence” over it (Guidelines 1/2024). Fail any one and the basis is unavailable. Where customer or product data is repurposed into a training set instead, the obstacle is purpose limitation: data collected to run a service was not collected to train on. Article 6(4) sets out how to test whether the new purpose is compatible with the original one, weighing the link between the two purposes, the context of collection and the relationship with the data subject, the nature of the data, the consequences for those people, and what safeguards such as pseudonymization are in place. This is the most commonly skipped step in enterprise builds, because holding the data lawfully gets mistaken for being allowed to reuse it. Article 9 makes special-category data — among others, data revealing political opinions, religious or philosophical beliefs or racial or ethnic origin, and data concerning health or sex life — prohibited in principle, and a scraped corpus will contain it. Article 14(5)(b) disproportionate effort, the exemption from Article 14’s duty to notify every individual whose data was obtained from someone other than them, is the standard position for scraping, but it requires a published notice. Articles 15 to 17 cover access, rectification and erasure, and Article 22 governs solely automated decisions. Article 25 pushes memorization suppression and tenant isolation into the architecture, Article 32 now reads on membership inference, extraction and vector-store leakage, and Article 35 makes a data protection impact assessment (DPIA) effectively mandatory for large-scale scraping and for most deployments touching special categories.

The EDPB’s Opinion 28/2024 of December 2024 is the document to read: a model trained on personal data is not automatically anonymous, anonymity must be demonstrated case by case against extraction and regurgitation risk, and a model trained on unlawfully processed data can taint its own deployment. On 8 July 2026 the EDPB adopted draft guidelines on anonymization and on web scraping for generative AI; both were in public consultation until 30 October 2026, so they are direction of travel rather than settled law. CNIL finalized its AI recommendations in July 2025, taking the position that models with memorization capability are in scope — there is no blanket exemption for weights.

The EU AI Act timeline changed in 2026 and the detail matters. Regulation (EU) 2026/1744 of 8 July 2026, the digital omnibus on AI, deferred the high-risk regime — the obligations that attach once a system is classified high-risk, such as a conformity assessment before the system reaches the market. Stand-alone high-risk systems, meaning those falling in one of the Annex III use cases such as biometrics, employment, essential services or law enforcement, move from August 2026 to December 2027; embedded ones, where the AI is a safety component of a product already requiring third-party assessment under the legislation in Annex I, move from August 2027 to August 2028. General-purpose AI obligations were not deferred. Article 53 has applied since 2 August 2025, and the penalty article took effect on 2 August 2026, exposing a provider to a Commission fine of up to fifteen million euro or 3% of global turnover, whichever is higher. Article 50 transparency was not deferred either and applies from 2 August 2026, with providers of systems already on the market before that date given until 2 December 2026 to meet its marking duty. Models placed on the market before August 2025 have until 2 August 2027 to comply. The separate digital omnibus on data and the GDPR is still a proposal, and the June 2026 compromise reduced its AI-training legal-basis language to a recital — assume it does not exist.

The United Kingdom diverged in a specific direction. The Data (Use and Access) Act 2025 received Royal Assent in June 2025 and its data-protection provisions commenced in February 2026. It liberalized automated decision-making, removing the requirement for a qualifying lawful basis before significant automated decisions except where special-category data is involved, while retaining notice, human-intervention and contest safeguards. It also added a list of recognized legitimate interests needing no balancing test, a statutory definition of scientific research, and a proportionality standard for subject access searches. On automated decisions the UK is now materially more permissive than the EU.

The United States

There is no federal privacy statute and no federal AI statute. What exists instead is Executive Order 14365 of December 2025, which directs a Department of Justice litigation task force against state AI laws, conditions certain federal broadband funds on a state’s AI posture, and asks for a preempting federal framework. Preemption has not been enacted. State law still governs, and state law is now unstable — the Colorado sequence is the illustration. SB 24-205’s effective date was postponed once, from February to 30 June 2026, by SB 25B-004 in the August 2025 special session; enforcement was then stayed by a federal court on 27 April 2026 in litigation the DOJ intervened in; and SB 26-189, signed on 14 May 2026, repealed and replaced it. What survives from 1 January 2027 is notice and transparency: developers must give deployers the intended and harmful uses, the categories of training data, and oversight instructions, and consumers keep access, correction and a right to meaningful human review.

Twenty-four states have enacted comprehensive privacy laws and twenty are in force. The obligations that constrain a model build recur across them: opt-outs of sale and of targeted advertising, which matter because embeddings and inference-derived segments can constitute a sale under the broader definitions; opt-outs of profiling producing legal or similarly significant effects; mandatory recognition of universal opt-out signals, now in a majority of the laws, which your inference endpoint must read server-side rather than in the browser; data protection assessments; and opt-in consent for sensitive data. Two states now require a privacy notice to say whether personal data is used to train large language models: Connecticut got there first, through SB 1295 of 2025, in force since 1 July 2026, and Vermont’s Act 145, enacted in 2026, follows on 1 January 2028.

California is where the training-time obligations concentrate. The CPPA’s regulations on automated decision-making technology, risk assessments and cybersecurity audits took effect on 1 January 2026. Risk assessments must be conducted from that date, with the first submission to the agency due 1 April 2028, and the trigger list expressly includes training automated decision-making, facial-recognition, biometric and identity-verification technologies — the most direct training-time obligation in American law. The ADMT notice, opt-out and access rights apply from 1 January 2027 for significant decisions in lending, housing, education, employment and healthcare. Separately, AB 2013 has required since 1 January 2026 a public high-level summary of training datasets for generative systems released or substantially modified since 2022, including whether the datasets contain personal information as the CCPA defines it.

Texas took the opposite approach. TRAIGA, effective January 2026, is intent-based rather than risk-based, and it amended the state biometric statute so that biometric data used to develop or train a model is exempt from consent unless it is used to identify a specific individual, and so that only media an individual published themselves can establish consent. That is a genuine safe harbor and a rare one. Illinois BIPA remains the largest American litigation risk for face and voice embeddings, with a private right of action and statutory damages, and Washington’s My Health My Data Act reaches inferences, which means model-derived health signals fall inside a consumer health data definition backed by a private right of action.

Canada has no AI statute: Bill C-27 and with it AIDA died on prorogation in January 2025 and were not revived. Bill C-36, tabled in June 2026, would modernize federal private-sector privacy including transparency for automated decisions, but it is tabled only. Quebec’s Law 25 is fully in force and its automated decision provisions are the most concrete Canadian obligation biting on inference today.

Asia-Pacific

China regulates generative AI directly rather than by analogy. PIPL provides the base, including Article 24 on automated decision-making and Article 55 requiring an impact assessment for, among other triggers, sensitive data, automated decisions and cross-border transfer. The Interim Measures for generative AI services, effective August 2023, apply to services offered to the public in China and require lawful data sources, content labeling, security assessment and algorithm filing. The labeling measures and the mandatory national standard GB 45438-2025, effective 1 September 2025, require both an explicit visible label on potentially misleading generated content and an implicit metadata label carrying the provider name and a content identifier, with distribution platforms classifying content as confirmed, possible or suspected AI-generated. Cross-border transfer runs through three routes — the CAC security assessment, the China standard contract with provincial filing, and certification, which the October 2025 measures formalized with effect from 1 January 2026 — layered over the 2024 relaxations that exempt contract-necessary transfers, cross-border human-resources data and non-sensitive personal information below one hundred thousand people, plus free-trade-zone negative lists.

Japan moved to accommodate training. The APPI amendment promulgated in July 2026 as Act No. 56 of 2026 creates a consent exception for statistical creation that expressly includes AI training data, permitting third-party provision and use without consent where risk is low, conditioned on transparency and public disclosure and prohibiting onward sharing. Criminal provisions commence in January 2027 and the main reforms by July 2028. The same amendment creates a category of specified biometric personal information with stricter handling and no opt-out transfers, and introduces administrative surcharges. Japan’s copyright Article 30-4 remains the most permissive text-and-data-mining position of any major economy.

Korea is the jurisdiction most likely to order you to delete a model, and has done it. The AI Framework Act has been in force since 22 January 2026, is extraterritorial, and imposes on generative AI both advance notice that the product uses AI and labeling of generated output, with safety obligations above a training-compute threshold and a domestic representative requirement for larger foreign providers. Fines were indicated to follow a one-year grace period. Separately, in its January 2025 plenary the PIPC fined Kakao Pay 5.97 billion won for unlawfully transferring some 40 million users’ data abroad and, rather than fining the recipient, ordered Alipay to destroy the scoring model it had built on that data — the deletion remedy applied to a trained artifact, not to a database. It fined SK Telecom 134.8 billion won on 28 August 2025, its largest penalty to date. A PIPA amendment passed on 20 August 2026 would permit training on original, non-pseudonymized personal data without consent subject to case-by-case PIPC approval; it takes effect six months after promulgation and is not in force today.

India’s DPDP Act is phased through its 2025 Rules: administrative machinery from November 2025, consent-manager obligations from late 2026, and the substantive regime — grounds for processing, notice, data-principal rights, breach notification, penalties to 2.5 billion rupees, or 250 crore — in 2027. There is no legitimate-interest balancing basis — only consent and a closed list of enumerated legitimate uses — and no AI-training carve-out, which makes the landing harder than the GDPR position. Australia’s tranche-one reforms are in force including a statutory tort for serious invasions of privacy, with automated-decision transparency commencing in December 2026 and a second tranche whose exposure draft closed consultation in September 2026. Singapore remains guidance-led: the PDPA’s business improvement and research exceptions are the practical bases for training on customer data, and the Model AI Governance Framework for Generative AI is voluntary.

Elsewhere, and by sector

Brazil’s LGPD mirrors the GDPR structurally, and the ANPD’s Meta proceeding is the reference case: training was suspended in July 2024 and resumed at the end of August under conditions including advance notice, pseudonymization during pre-training and a simplified opt-out, with the suspension left in force for minors’ data. The Brazilian AI bill passed the Senate and remains in the Chamber of Deputies. Saudi Arabia’s PDPL has been fully enforceable since September 2024, with transfers subject to a risk assessment or an adequacy determination rather than a blanket residency mandate, though the National Cybersecurity Authority’s cloud controls require certain services to be delivered from inside the Kingdom. The UAE federal law is in force but its executive regulations remain outstanding, which leaves the DIFC and ADGM regimes as the operative ones for most enterprise deployments.

The American sectoral rules are often the ones that actually decide an architecture. HIPAA’s proposed Security Rule overhaul has not been finalized, so the 2003 rule still governs; what binds a generative build today is the minimum-necessary standard, the business associate agreement any model provider touching protected health information must sign, and the de-identification standard, where safe-harbor de-identification fits free-text clinical notes badly enough that expert determination is usually the only defensible route. The GLBA Safeguards Rule requires oversight of service providers, which captures third-party model APIs, and its privacy rule conditions sending customer financial data to an external inference endpoint on notice plus a contract confining the provider to the purpose disclosed, which a provider training on that data would breach. FERPA’s school-official exception confines a vendor to the purposes the school authorized and bars redisclosure, which puts re-using student records to train a model outside it. And the COPPA amendments, with full compliance required since April 2026, added biometric identifiers to personal information, required separate parental consent for disclosure to third parties, and prohibited indefinite retention — which makes an indefinitely retained children’s-data training corpus expressly non-compliant.

One distinction is worth stating because vendors blur it. Most regimes restrict transfer and permit processing abroad with a mechanism; only a few mandate in-country processing. China for critical information infrastructure operators and important data, Russia for the primary database of citizens’ data, Indonesia for public-scope electronic system operators, Vietnam for designated foreign providers on ministerial demand, and India for payment data are genuine residency mandates. The GDPR is not one. European sovereign-cloud demand is driven by the Data Act’s third-country access safeguards, procurement policy and the CLOUD Act, not by a statutory localization rule.

Practical methods to comply

The same test as the rest of this post series: what can a team actually deploy. Several of these obligations have clean technical answers, several have partial ones, and a few have none at all.

Keeping data in the region you promised

Storage residency is easy and widely misunderstood as the whole answer. Inference residency is the harder half, and in all four major providers the default setting silently breaks it.

Google Vertex AI has the strongest written commitment, and it is keyed to the endpoint you call rather than to where the data sits: a regional endpoint keeps machine-learning processing, inference included, inside that region. The global endpoint voids it, and Google’s own documentation says so plainly. Azure is the clearest documented: data at rest stays in the designated geography, while global deployment types may process a prompt in any Azure region, data-zone types stay within the specified data zone, and standard and regional provisioned types stay in the customer’s geography. The default most teams pick for capacity and price is the global one. Amazon Bedrock draws the same line between geographic inference profiles, which stay within their geography, and the global profile, which does not and is about ten percent cheaper — exactly the kind of thing a cost-optimization change introduces quietly. OpenAI offers storage and processing residency in the United States, Europe and the UAE, with other regions storage-only, and the European configuration is not a checkbox: it requires OpenAI’s eligibility approval and a newly created project, which then runs with zero data retention. Anthropic’s first-party API offers US-only inference but had no European residency option as at September 2026; the deployable route for Claude in Europe is Bedrock geographic profiles or Vertex AI European regions, where the hyperscaler’s commitment applies.

The engineering conclusion is the same in every case: pin the endpoint explicitly, and enforce it with a service control policy, an Azure Policy denying global deployment SKUs, or an IAM condition on the inference-profile ARN. Do not rely on a configuration default. And note one audit trap: Bedrock records logs only in the source region regardless of where processing happened.

For an EU-operated sovereign stack, the AWS European Sovereign Cloud became generally available in January 2026 with a region in Brandenburg. It is a separate partition rather than a region, so endpoints, ARNs and identity are distinct and existing infrastructure code does not transfer unchanged — but Bedrock and SageMaker were in the launch service set, so a managed frontier-model inference API was there from day one. Oracle, Microsoft and Google offer sovereign constructs with sharply varying service coverage; check whether the model service you need is actually in the package.

Key control, and the thing it does not do

All three hyperscalers ship hold-your-own-key: the AWS KMS External Key Store, Google Cloud EKM with Fortanix, Futurex and Thales, and Azure Managed HSM external key management, which remains in preview behind an account-team gate and a documented ten-million-dollar annual Azure commitment. Google’s Key Access Justifications is the one genuinely distinctive capability in the group: every key-unwrap request carries a code stating the reason for the access, and your external key manager can be configured to deny on codes you do not accept. An AWS external key store proxy can deny as well, but on the caller and operation metadata AWS sends rather than on a stated reason, so Google’s is the only place a customer can refuse a specific justification programmatically.

State the limit plainly, because this is where compliance architecture most often deceives itself. These are all encryption-at-rest mechanisms — Azure’s is explicitly restricted to wrap and unwrap operations. A model cannot run on ciphertext, so prompts and completions exist in plaintext in the provider’s memory and accelerators regardless of who holds the key. Key custody is not a control on inference confidentiality. That problem belongs to the confidential computing described earlier in this series, and AWS’s own documentation warns that for most customers the availability and latency risk of an external key store exceeds the perceived security benefit.

Cross-border transfer machinery

For Europe, the 2021 standard contractual clauses remain the operative instrument, paired with a transfer impact assessment following the EDPB’s six-step methodology — for which there is no official template, only law-firm and vendor ones. The EU–US Data Privacy Framework adequacy decision is still valid; the General Court dismissed the Latombe challenge in September 2025 and an appeal to the Court of Justice was lodged in October 2025. The engineering consequence is cheap insurance: keep clauses and an assessment in place alongside framework reliance, because a framework-only architecture has a single point of legal failure with no notice period.

For China the three routes are manual and no tooling performs the filings. Note that the certification route, formalized with effect from January 2026, has eligibility thresholds and a three-year certificate, and that splitting volumes to stay under a threshold is expressly prohibited.

Training-data provenance and the Article 53 summary

This is the obligation that most rewards having built the right thing early and most punishes not having. The AI Office template published on 24 July 2025 requires model identification and modality, a list of data sources, and — the part that decides your data engineering — the top ten percent of domain names by volume for scraped content, five percent or a thousand domains for smaller providers. It must be refreshed every six months or on material change.

No product generates it. The domain-share disclosure requires URL-level provenance retained through crawling, deduplication and shuffling, and nobody sells that; it is a commitment you make before training starts or a disclosure you cannot make afterwards at all. What does exist is the documentation substrate: Croissant 1.1, released in early 2026, adds machine-actionable provenance through PROV-O and governance through the Data Use Ontology and ODRL, so a consumer can check whether a proposed use is permitted, and Hugging Face emits Croissant metadata automatically for every dataset its viewer can convert to Parquet. CycloneDX machine-learning bills of materials and the SPDX 3.0 AI and dataset profiles are the most plausible substrate for the AI Act’s technical documentation, though tooling to generate them from a live training pipeline is immature. California’s AB 2013 summary is a separate artifact with a different shape, and the two do not substitute for one another.

Nothing verifies provenance. Licensing marketplaces sell forward rights; they do not audit what you already ingested. Croissant records assertions; it does not check them.

Honoring text-and-data-mining opt-outs

The AI Act’s Article 53(1)(c) requires a copyright policy that respects the reservations permitted by Article 4(3) of the Digital Single Market (DSM) Directive, Directive (EU) 2019/790, which means honoring machine-readable opt-outs at crawl time and being able to show what you honored and when. There are four competing mechanisms and none is authoritative. Robots.txt user-agent blocks are the de facto standard and are per-vendor and unversioned. TDMRep, a W3C community group final report from May 2024 rather than a standard, defines a well-known JSON file, HTTP headers and HTML metadata, and was built specifically for the DSM Directive. The IETF’s AI preferences work defines a content-usage vocabulary and an HTTP header and is the likely long-term winner, but it remains an Internet-Draft with parts explicitly lacking working-group consensus. RSL 1.0 expresses training permissions and inference compensation alongside commercial terms, and has significant publisher backing. The one mechanism with actual enforcement leverage is a content delivery network’s traffic policy, because it sits in the request path.

One correction worth making because it circulates widely: the training-and-mining assertion was removed from the C2PA specification in version 2.0, so guidance that points at a c2pa.training-mining label is out of date. The capability did not disappear — it moved to the Creator Assertions Working Group as cawg.training-mining, which is carried inside a C2PA manifest but is not defined by C2PA. A text-and-data-mining opt-out is therefore still expressible; it is a CAWG assertion, and the label changed.

Two European judgments bear on this and they point different ways. The Hamburg appellate court in Kneschke v. LAION dismissed the photographer’s appeal in December 2025, holding that the natural-language terms-of-use reservation before it did not reserve the right: the test is whether a machine can interpret the reservation, and mere machine detectability is not enough. Leave to appeal to the Federal Court of Justice was granted. The Munich regional court in GEMA v. OpenAI held in November 2025 that memorization of works in model weights is a copyright-relevant reproduction and that the mining exception does not cover such training — a holding that contradicts the industry position on weights, and which OpenAI appealed in December 2025 with no decision yet. For EU-facing products, plan to the Munich position, because it is the one that creates liability. It also means output-side deduplication is part of a copyright policy, not just crawl-side filtering.

Marking generated content

Four regimes now require some form of marking or disclosure — the AI Act’s Article 50 from August 2026, China’s labeling measures and GB 45438-2025 from September 2025, Korea’s AI Framework Act from January 2026, and California’s transparency act, operative from August 2026 — and they are not technically compatible. Build one provenance layer that satisfies the strictest and map outward. C2PA 2.4 with its AI-disclosure assertion and digital-source type, implemented through the c2pa Rust library and its command-line tool, is the deployable substrate; SynthID’s detector left its waitlist in October 2026 and now reads watermarks from Google and from partners including OpenAI, NVIDIA and Kakao, though only where one of those systems did the watermarking; IPTC metadata carries the same information in a different envelope.

The honest problem is downstream. Manifests do not survive the major social platforms’ upload and re-encoding pipelines, nothing detects AI content that was never watermarked in the first place, and California’s approach of mandating per-provider detection tools institutionalizes the fragmentation rather than resolving it.

Assessments, records and certification

This category is in better shape than the rest. For impact assessments, CNIL publishes an open-source PIA tool, the ICO publishes an AI risk toolkit, and the EDPB adopted its first harmonized DPIA template in April 2026. For management systems you can certify against, ISO/IEC 42001 covers AI management with accredited certification bodies now in place, and ISO/IEC 27701 became a standalone management-system standard in October 2025. For risk frameworks to align to, the NIST AI Risk Management Framework and its generative AI profile are the reference, though NIST intends them for voluntary use and neither carries a certification scheme. For records of processing and data mapping at scale, the established platforms all automate evidence assembly rather than judgment; the code-scanning approach is the only one that keeps pace with a codebase that changes weekly.

Two gaps inside an otherwise healthy category. No harmonized standard has been cited in the Official Journal yet — CEN-CENELEC published its first in 2026, but citation is what the presumption hangs on — so no presumption of conformity is available to anyone for any high-risk system. And the fundamental-rights impact assessment questionnaire and automated tool that Article 27(5) obliges the AI Office to produce has not appeared; no deadline attaches to it and the deployer obligations it would support are now deferred to December 2027, so plan to do the assessment without it.

Erasure requests that reach the model

Look at what the major labs actually promise, because it is narrower than the headlines. OpenAI operates a personal-data removal process whose stated aim is to “stop certain personal information about you from appearing in ChatGPT responses” — the wording you choose when the mechanism is output-level — and it reserves the right to decline a request where it has a lawful reason. Google’s nearest equivalents sit on either side of the model rather than inside it: the Results about you tool removes URLs from Search, and the Gemini Apps Activity setting governs whether future chats are used for training, while chats already sampled for human review are retained for up to three years and are not deleted along with your activity. Meta is the most explicit of the four. Of the third-party information in its training corpus it says that “we don’t provide the ability to access, download, correct or delete” it, offering instead a form for raising a concern about personal information appearing in a model’s response, which it says it does not automatically fulfill. Anthropic sits at the other end: its commercial terms commit that it “may not train models on Customer Content from Services”, so commercial API traffic does not enter the weights in the first place. Every one of these is output suppression, prospective exclusion or non-use. None is erasure from weights.

What teams actually build, in descending order of defensibility: keep personal data out of the weights entirely and put it in a retrieval layer you control, so a deletion request is a delete statement — this is the real enterprise answer and much of why retrieval with access control dominates enterprise deployment; retrain from a pinned, versioned corpus, which is feasible for fine-tunes and economically absurd for foundation models, and which requires the dataset versioning described in the training posts to have existed before the request arrived; suppress at the output, which is a mitigation and not compliance; and honor opt-out registries, which are prospective.

References

「CODAS Community」へのご参加・ご登録について

一般社団法人AIデータ主権共創機構（CODAS）では、「Privacy-First AI」基盤の構築と持続可能なAIエコシステムの発展に向け、研究者・エンジニア・法務・政策・ビジネス・市民など、立場を越えてオープンに集い、秘匿AIの未来を共に創る共創プラットフォーム「CODAS Community」のメンバーを募集しています。

■ 法人企業様のご参画

CODASの理念や取り組みにご賛同いただき、AIエコシステムの社会実装や標準づくり、共創プロジェクトを共に推進していただける法人企業様を募集しております。ご入会や連携に関するお問い合わせ・お申し込みは、下記フォームより承っております。

お問い合わせフォーム：https://codas-ai.org/contact

※件名に「会員の申込」とご明記のうえ、貴社の簡単なご紹介（事業内容等）を添えてご連絡ください。確認後、担当者よりご案内いたします。

■ 個人・一般の皆様のご参加

公式Discordおよびメールマガジンでは、勉強会・ワークショップ・ミートアップ等のイベントへの優先アクセスや、秘匿性技術・ルール標準化に関する最新の知見をお届けします。東京のリアル拠点での交流も含め、立場を問わずどなたでもご参加いただけます。

CODASについて

一般社団法人AIデータ主権共創機構（CODAS）は、「安全・安心なAI社会」の実現を目指す非営利・中立の法人です。データプライバシー技術の研究開発と、そのオープンソース化による社会実装を推進しています。データを外部に出さずにAIを高度活用できる「Privacy-First AI」基盤を「創る・使う・広げる」ことを基本理念に掲げています。

≪本件に関するお問い合わせ先≫

一般社団法人AIデータ主権共創機構（CODAS）イベント事務局 E-mail：info@codas-ai.org