And the scope of GDPR is the *processing* of personal data. So any use of the model is processing personal data and so subject to GDPR.

The business model of most AI makers relies on them avoiding this realisation