The Information Commissioner’s Office sets out that organisations using AI must establish a lawful basis for processing personal data, alongside transparency and purpose limitation requirements.

For SaaS and AI-enabled services, this shifts risk into how training data is sourced and used. Contracts should address dataset provenance, allocate responsibility between parties, and include protections where personal data is processed unlawfully.

Source:
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/