EU Anonymization Rules Tightened: AI Inference Attacks Drive New Thre…

The EU's data protection authority adopted new anonymization rules on 8 July 2026 that require datasets to resist individual isolation, linkage, and AI-powered inference attacks simultaneously. Any data failing even one of the three tests remains subject to full GDPR requirements, with retroactive implications for AI companies that trained models on data classified as anonymous under the previous standard. If you've trained an AI model on EU data you classified as anonymous, you may have violated GDPR without knowing it. You have until 30 October to assess whether your training corpus passes the new three-test standard — and if it doesn't, you owe a lawful basis, impact assessment, and data subject notification retroactively.