Responding to a request from the Irish Data Protection Commission, the European Data Protection Board (EDPB) issued an opinion late last year addressing data protection concerns in the development and deployment of AI models (Opinion). In its densely packed Opinion, the EDPB reviewed whether AI models trained with personal data can be considered anonymous, notably not taking a hard line on the answer, and instead emphasizing the need for a case-by-case assessment. This first article in a two-part series, including insights from Bird & Bird, McDermott Will & Emery, Morrison Foerster and Steptoe, examines the Opinion’s key determinations and their implications for entities subject to the GDPR. Part two will address legal risks and best practices for controllers related to the processing of personal data in the context of AI development and deployment. See “Can GDPR Hinder AI Made in Europe?” (Jul. 10, 2019).