EDPB just confirmed it: AI models are NOT automatically anonymous. Are we ready?

[u/Spare_Dependent6893]

Two big moves from Brussels this month:

1. The EU AI Act reached full application — all provisions are now enforceable, with fines up to €35M or 7% of global turnover, and GPAI/LLM providers under active supervision.

2. New EDPB guidelines state that AI models trained on personal data can't be presumed anonymous. Memorisation and extraction attacks are now risks you're expected to assess. Coordinated enforcement against LLM providers is anticipated by 2027.

Everyone's talking about the model providers. But what about *us* — the companies feeding documents into these models every day? Contracts, HR files, support tickets... every prompt potentially ships personal data to a third-party LLM, and under GDPR we stay accountable for it.

So here's my question: is anyone actually pseudonymizing documents *before* they hit the LLM (and re-identifying on the way back)? What's your approach — regex/NER scrubbing, local proxy, gateway solutions? Or is everyone just... hoping for the best?