Short paper: Models in the dark -- Rectification and erasure under GDPR in ML supply chains

2026-06-04

AI Summary

This study addresses the significant challenges in implementing the General Data Protection Regulation (GDPR) rights to rectification and erasure within machine learning (ML) supply chains, particularly in complex, multi-party workflows. It introduces the novel concept of “dark models”—opaque and non-traceable downstream derivative models that exacerbate compliance risks by undermining data subjects’ rights. By integrating legal and artificial intelligence perspectives, the work develops an interdisciplinary analytical framework through a synthesis of scholarly literature and regulatory guidance to evaluate the capacity of current technical approaches to meet GDPR requirements. The analysis reveals that most existing methods fall short of fulfilling core GDPR obligations, identifying critical compliance gaps across the ML supply chain. These findings offer theoretical grounding and actionable pathways for the co-governance of trustworthy AI through aligned institutional and technical solutions.

Abstract

The rights to rectification and erasure, as established under the General Data Protection Regulation (GDPR), are central to protecting individuals' privacy. However, their effective enforcement in machine learning (ML) systems remains challenging. Existing work has largely addressed these rights from either a legal or a technical perspective in isolation and disregards the fact that models are produced in complex supply chains involving multiple actors across development, distribution, and deployment. This paper presents a holistic survey of challenges in implementing the rights to rectification and erasure in ML models. Drawing on academic literature and guidance from data protection authorities, we find that many GDPR requirements cannot yet be technically met in practice. Our findings further suggest that issues arising in ML supply chains are insufficiently addressed in research. To tackle this gap, we introduce the notion of models in the dark -- derived models created further downstream in an ML chain without sufficient transparency or traceability -- and analyse the urgent challenges posed by this phenomenon. By adopting an interdisciplinary perspective, this work contributes to bridging the gap between legal requirements and the technical implementation of data subject rights in ML, ultimately supporting the development of trustworthy artificial intelligence.

Problem

• rectification
• erasure
• GDPR
• machine learning supply chains
• data subject rights

Innovation

• models in the dark
• GDPR compliance
• machine learning supply chains
• right to erasure
• right to rectification