The problem: deletion isn’t what it used to be

When we think about deleting data, we usually picture removing a row from a database or closing an account. AI models work differently. Personal data used in training shapes a model’s parameters, and those parameters continue to reflect that data after the original records are gone.

Machine unlearning is the field that tries to remove the influence of specific data from a trained model. This matters because AI is increasingly used in consequential areas such as healthcare, education, and criminal justice. If personal data can’t be removed from what a model has learned, our autonomy, fairness, and accountability are all affected.

Why "Goldilocks"?

The GDPR’s right to erasure (Article 17) was written long before unlearning technology existed. In my reading, it was a well-balanced solution at the time: neither too rigid nor too lenient. It does not demand technical perfection. Recital 66 speaks of "reasonable steps" that take into account available technology and cost. Article 25 ties data protection by design to the “state of the art.” The Data Act takes a similar approach, framing deletion in terms of proportionality.

That flexibility matters. Retraining a model from scratch to remove one person’s data would be computationally expensive, economically inefficient, and environmentally unsustainable. A standard that insisted on perfect deletion would make compliance close to impossible.

Where the strain shows?

The paper’s central question is whether the EU should explicitly recognise machine unlearning as a data subject right, and under which instrument: the GDPR, the Data Act, or the AI Act. I conclude that none of the three is yet equipped for it.

The GDPR offers the most natural legal home for unlearning, but it doesn’t say what “erasure” means once data is embedded in a model. It’s unclear whether retraining, approximate unlearning, or simply ceasing to use the model would satisfy it.

The Data Act promotes data access, portability, and interoperability. All of these look forward, and none addresses removing data’s influence after the fact. It is also silent on who is responsible when data has passed through a chain of developers, cloud providers, and downstream users.

The AI Act focuses on risk management and transparency, but it doesn’t say how erasure should work after training.

Unlearning therefore risks staying a theoretical right: ambitious in law, but without the institutional support to be enforced.

What needs to change

The paper calls for continuous regulatory adaptation and cross-disciplinary collaboration. Concretely, I argue for:

• Explicit legal recognition of unlearning, for example a GDPR provision requiring unlearning where technically feasible, or an explanation where it is not.

• Technical standards and certification so that organisations can demonstrate compliance.

• Transparency requirements on how personal data influences AI systems and whether they support erasure after training.

• Fairness safeguards, including bias audits before and after unlearning, so that privacy rights aren’t exercised at the cost of discriminatory outcomes.

• Coordination across the GDPR, the AI Act, and the Data Act, and internationally, given how data flows across borders.

• Flexible tools such as regulatory sandboxes and updated technical guidelines, so the law can keep pace without constant rewriting.

The takeaway

The current laws are not yet future-proof for machine unlearning. But they do give the field momentum, and with targeted reform, unlearning can become a tool that empowers individuals rather than a loophole for evading responsibility.

This work also connects to our research within AI4POL, where we explore how individuals can keep control in an AI-driven world. Our report in Work Package 2 further explains this idea with empirical research.