Using personal data to train an AI model counts as processing under GDPR, so the same lawful basis and data protection principles still apply.