If AI data includes personal information, then pursuant to the GDPR a controller should consider what is the least amount of personal information that may be needed for training, and what is the least amount of time the AI model needs access to such information.