Map data flows for each AI use case. Choose a lawful basis. Minimize and pseudonymize training data. Explain when AI is in the loop. Honor data rights, secure training sets, and run DPIAs when risk is high or data is sensitive.