Does adopting an AI tool need this looked at again?

Where the tool does something new with material, yes. Summarising, classifying or generating from records collected for another purpose is a different activity from holding them, and whether the original ground reaches that far is a question somebody has to actually ask.

Why is consent discouraged for ongoing activities?

Because it can be withdrawn, and an organisation relying on it has undertaken to stop for anybody who withdraws. For something a business needs to keep doing at scale, that creates an obligation the activity may not survive, which is why other grounds usually fit better.

Is this the same everywhere?

The structure is broadly shared across modern regimes, and the specific grounds and their conditions differ. A choice made carefully under one set of rules is a strong starting position elsewhere rather than a portable answer, so the work transfers better than the conclusion does.

Glossary

Lawful basis

The legal ground relied on to process personal data, chosen from a fixed set rather than argued from first principles.

In plain terms

The answer to why you are allowed to hold this at all. There is a short list of acceptable answers, you have to pick one before you start, and the one most people reach for first is frequently the weakest available to them.

Why it matters

Because it is decided before processing rather than defended afterwards, and adopting an AI tool is frequently a new processing activity that nobody revisited the question for. Material collected years ago under one justification does not automatically carry that justification into a new destination doing something new with it.

How it works

The grounds are enumerated rather than open, which is the property that surprises people. Processing rests on one of a closed set, so the exercise is choosing the one that genuinely fits rather than constructing a reasonable-sounding argument, and an activity fitting none of them is an activity that does not happen.

Consent is one ground and is treated as the default far more often than it deserves. It has to be freely given and it can be withdrawn, which makes it fragile for anything an organisation needs to keep doing, and reaching for it reflexively creates an obligation to stop that the organisation may not be able to honour.

The choice is made in advance and recorded, not selected later to fit what happened. That ordering is the whole discipline: a basis identified before processing shapes what is collected and why, while one identified afterwards is a justification, and regulators can tell the difference by looking at what was written down and when.

Switching grounds partway through is difficult and is where organisations get caught. Having told people one thing and then relying on another is a change in the arrangement they agreed to, so the honest path is usually to get the choice right at the start rather than to plan on revising it.

Where an AI tool is the new activity, the question is whether the original ground stretches to cover it. Summarising, classifying or generating from material collected for a different purpose is doing something new with it, and the ground that covered the collection may or may not extend that far.

When the question gets asked

The reason the ordering is the whole of it, rather than a procedural nicety, is that a ground chosen in advance actually constrains something. It decides what may be collected, how long it can be kept and what it may be used for, so an activity that cannot fit any available ground gets changed or abandoned before anybody has invested in it. A ground selected afterwards constrains nothing, because the activity already exists and the exercise is finding words that accommodate it, which can nearly always be done. That is why the second column is not a shortcut to the same place: it produces an identical-looking document describing a decision that was never made. For AI adoption specifically, this is the moment worth catching, because a new tool is a new processing activity arriving through a product decision rather than a legal one. Nobody in the room is thinking about grounds, the material already exists and was already collected lawfully, and the question of whether the original justification reaches this new use is one that simply does not come up unless somebody raises it deliberately.

Seen in the wild

Asking what ground covers feeding existing customer correspondence into an assistant for summarising.
ChatGPT
A search deployment reaching material collected under several different justifications at once.
Glean
An automation that begins processing records for a purpose nobody stated when they were collected.
Make

Common misconceptions

People assume

Consent is the safest choice.

In fact

It is the most fragile for anything ongoing, because it must be freely given and can be withdrawn. An organisation relying on it has committed to stopping when somebody says so, which is a real obligation and frequently not one the activity can survive.

People assume

Having collected the data lawfully covers what we do with it later.

In fact

The ground attaches to the processing rather than to possession. A new activity on existing material is a new question, and an AI tool doing something the original justification never contemplated is exactly that kind of new activity.

Questions

Does adopting an AI tool need this looked at again?: Where the tool does something new with material, yes. Summarising, classifying or generating from records collected for another purpose is a different activity from holding them, and whether the original ground reaches that far is a question somebody has to actually ask.
Why is consent discouraged for ongoing activities?: Because it can be withdrawn, and an organisation relying on it has undertaken to stop for anybody who withdraws. For something a business needs to keep doing at scale, that creates an obligation the activity may not survive, which is why other grounds usually fit better.
Is this the same everywhere?: The structure is broadly shared across modern regimes, and the specific grounds and their conditions differ. A choice made carefully under one set of rules is a strong starting position elsewhere rather than a portable answer, so the work transfers better than the conclusion does.