What is fine-tuning?
Fine-tuning is further training a pre-trained model: usually a foundation model: on your own, narrower dataset so it performs better on your task: support tickets, contract clauses, medical notes. Technically it updates the model’s weights; legally it can update your role.
The three legal lines
1: Regulatory role. Under the AI Act, modifying a GPAI model can make you a provider of the modified model, with documentation and transparency duties of your own; the boundary turns on the significance of the change. Downstream builders should record what was tuned, on what data, and how capabilities changed. 2: Data protection. Fine-tuning on customer or employee data is processing: it needs a legal basis, and personal data can become extractable from the tuned model: memorisation is a documented risk, so DPIA-level analysis is warranted for sensitive corpora. 3: Contract and IP. Model licences differ on whether you may tune at all, who owns the adapted weights, and whether your data may flow back into the vendor’s training. The tuning clause in your vendor agreement is where these three lines meet.
Practical guardrails
Curate the corpus (strip identifiers where the task allows), keep a dataset sheet, test the tuned model for regurgitation of training records, and mirror your customers’ restrictions: if your enterprise contracts promise “no training on customer data,” a fine-tune on support logs breaks the promise.
Fine-tuning vs. RAG?
Training-time methods change weights; retrieval-augmented generation (RAG) injects documents at query time and leaves the model untouched: usually the lighter path legally, because data stays in a controllable store.
Does fine-tuning on public data avoid the issues?
No: public personal data is still personal data, and the TDM/opt-out rules govern what you could lawfully collect in the first place.
Related: GPAI, TDM exception.
Working on this? Vircon Legal advises on Startup & Scaleup Advisory and Startup Law in Türkiye guide. Talk to us →
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro call