How we train AI models at SIFAMO without using a single piece of personal data, what the red, gray and green zones of data protection mean, and why everyone in AI is still a junior today.
At the SIFAMO AI Summit 2025 in Dubai, Tanishka from The Technology Express interviewed me. The second part of the conversation was about the question I hear in almost every client meeting in Germany: How do you use AI in a company that is subject to the GDPR and the EU AI Act without sliding into illegality and without regulating the project to death? Here is my answer, in more detail than in the video.
Interview with Tanishka (The Technology Express), recorded at the SIFAMO AI Summit 2025 in the Burj Khalifa, Dubai. Part 2.
Why there are no senior AI experts today
I say this deliberately to provoke: to this day, there is no senior super-expert in AI. The field is simply too new for that. When someone tells me they have 20 or 30 years of experience with AI, they usually mean statistics, data warehousing or classic automation. That is valuable, but it is not what companies have been building since 2023 with large language models, RAG architectures and agents.
We are all junior developers. We are all trainees. I hope that in five or six years we will be the seniors and truly understand what AI can do and where its limits are. Anyone presenting themselves as an AI expert today should bring that honesty with them. For companies, this means: distrust anyone who claims to have seen it all. Trust the people who have a clean concept and say openly what they do not know yet.
AI training without personal data: pseudonymization with IDs
The biggest problem with using AI in Europe is data protection. Germany and the EU have strict rules, and that is a good thing. The question is how you still train models. Our solution is easy to explain: we never train with real personal data.
I am not allowed to use your name to train a model. So I take your data, anonymize it and assign an ID.
Only this ID and the business content go into the model. Names, addresses and dates of birth stay out.
When an answer comes back, the ID is mapped again in our system. That way we know how the model was trained without it ever having seen a real person.
We train exclusively with pseudonyms. This lets us guarantee that no model we deploy was trained with real personal data. Large clients like Bosch, Zurich or public authorities in Germany want exactly that: no data gaps, no surprises in the audit. If you are wondering how this fits with regulatory supervision, you will find more in my post on Agentic AI governance under BaFin and the EU AI Act (German).
Red, gray, green: the three zones of data protection
In the interview I talked about three zones. This is not a legal model but the language we use internally and with clients to talk about risk.
Red zone: In Europe, this is the illegal zone. You can do it, the client signs something, and the real problem is hidden somewhere deep in the contract. For me, that is not an option.
Gray zone: It is not illegal, but you are not sure whether it feels right. This is where you need a conscious decision and documentation.
Green zone: Everyone knows what is happening. The client is informed, the data flows are explained, nothing is hidden.
With pseudonymization we operate in the gray-green zone, and we make that deliberately visible to the client. That is the core of AI governance: not whether something is technically possible, but whether every decision can be traced and explained afterwards.
Transparency belongs in the first sentence, not in the fine print
We tell every client, and not somewhere in a subordinate clause. It is the first sentence we say: We would like to use your data. Is that okay with you? And if so, not your personal data, but pseudonymized representatives of it.
You can lie. But in the end every fraud gets exposed, and then you are the fraudster. We have large clients in Germany who trust us because they trust our quality. That trust does not come from marketing. It comes from saying the uncomfortable things first. That is why we held the summit in the Burj Khalifa: to show how you earn trust, not to sell buzzwords.
The riskiest project: four weeks for free
Tanishka asked me about the riskiest project. It was one of our very first AI projects. A client wanted a document management system with AI, with a huge volume of documents. We had a concept, but we had never trained a model ourselves.
So we told the client honestly: this is the first time for us. Look at our other products, we have strong developers and a clear idea. We will work four weeks for free. If the result convinces you, you pay for the four weeks retroactively. That was the deal. For me as an entrepreneur with a large team, that was a real risk. After four weeks it was clear: we can do this. The project is still running today and will stay with us for at least another one to two years.
The lesson is not “work for free”. The lesson is: honesty about your own level of experience plus a solid concept beats any senior label. How this is evolving with agentic AI in software development (German) is something I have described elsewhere.
Three takeaways for AI governance in your company
Never train with real personal data. Pseudonymization with IDs is technically simple and takes the fear out of data protection.
Name the zone. Red, gray or green: if you cannot say internally where a use case sits, you are not ready for the rollout.
Transparency first. The data protection sentence belongs at the start of the client conversation, not in Appendix C of the contract.
And finally, the question from the video that I want to ask here as well: Is pseudonymization a gray zone or a green zone for you? Let me know on LinkedIn or in the comments under the video on my channel. Part 1 of the interview, which covers the founding of SIFAMO, the journey from Berlin to Dubai and AI in recruiting, is there as well.
Frequently asked questions
Are you allowed to train AI models with customer data?
With real personal data only on a solid legal basis, and usually it is not sensible. Pseudonymized data, where identifiers are replaced by IDs and stored separately, reduces the risk considerably. The mapping table stays in your own system, never in the model.
What is the difference between anonymization and pseudonymization?
Anonymized data can no longer be linked to a person. Pseudonymized data can be linked again with a separately stored key and therefore still counts as personal data under the GDPR. That is why pseudonymization belongs in the gray-green zone and requires transparency towards the client.
What does the EU AI Act require for AI training?
For high-risk systems, the EU AI Act requires, among other things, data governance, meaning documented origin, quality and processing of the training data, as well as traceability of decisions. A pseudonymization concept with clean documentation is a concrete building block for this.
How we train AI models at SIFAMO without using a single piece of personal data, what the red, gray and green zones of data protection mean, and why everyone in AI is still a junior today.
At the SIFAMO AI Summit 2025 in Dubai, Tanishka from The Technology Express interviewed me. The second part of the conversation was about the question I hear in almost every client meeting in Germany: How do you use AI in a company that is subject to the GDPR and the EU AI Act without sliding into illegality and without regulating the project to death? Here is my answer, in more detail than in the video.
Why there are no senior AI experts today
I say this deliberately to provoke: to this day, there is no senior super-expert in AI. The field is simply too new for that. When someone tells me they have 20 or 30 years of experience with AI, they usually mean statistics, data warehousing or classic automation. That is valuable, but it is not what companies have been building since 2023 with large language models, RAG architectures and agents.
We are all junior developers. We are all trainees. I hope that in five or six years we will be the seniors and truly understand what AI can do and where its limits are. Anyone presenting themselves as an AI expert today should bring that honesty with them. For companies, this means: distrust anyone who claims to have seen it all. Trust the people who have a clean concept and say openly what they do not know yet.
AI training without personal data: pseudonymization with IDs
The biggest problem with using AI in Europe is data protection. Germany and the EU have strict rules, and that is a good thing. The question is how you still train models. Our solution is easy to explain: we never train with real personal data.
We train exclusively with pseudonyms. This lets us guarantee that no model we deploy was trained with real personal data. Large clients like Bosch, Zurich or public authorities in Germany want exactly that: no data gaps, no surprises in the audit. If you are wondering how this fits with regulatory supervision, you will find more in my post on Agentic AI governance under BaFin and the EU AI Act (German).
Red, gray, green: the three zones of data protection
In the interview I talked about three zones. This is not a legal model but the language we use internally and with clients to talk about risk.
With pseudonymization we operate in the gray-green zone, and we make that deliberately visible to the client. That is the core of AI governance: not whether something is technically possible, but whether every decision can be traced and explained afterwards.
Transparency belongs in the first sentence, not in the fine print
We tell every client, and not somewhere in a subordinate clause. It is the first sentence we say: We would like to use your data. Is that okay with you? And if so, not your personal data, but pseudonymized representatives of it.
You can lie. But in the end every fraud gets exposed, and then you are the fraudster. We have large clients in Germany who trust us because they trust our quality. That trust does not come from marketing. It comes from saying the uncomfortable things first. That is why we held the summit in the Burj Khalifa: to show how you earn trust, not to sell buzzwords.
The riskiest project: four weeks for free
Tanishka asked me about the riskiest project. It was one of our very first AI projects. A client wanted a document management system with AI, with a huge volume of documents. We had a concept, but we had never trained a model ourselves.
So we told the client honestly: this is the first time for us. Look at our other products, we have strong developers and a clear idea. We will work four weeks for free. If the result convinces you, you pay for the four weeks retroactively. That was the deal. For me as an entrepreneur with a large team, that was a real risk. After four weeks it was clear: we can do this. The project is still running today and will stay with us for at least another one to two years.
The lesson is not “work for free”. The lesson is: honesty about your own level of experience plus a solid concept beats any senior label. How this is evolving with agentic AI in software development (German) is something I have described elsewhere.
Three takeaways for AI governance in your company
And finally, the question from the video that I want to ask here as well: Is pseudonymization a gray zone or a green zone for you? Let me know on LinkedIn or in the comments under the video on my channel. Part 1 of the interview, which covers the founding of SIFAMO, the journey from Berlin to Dubai and AI in recruiting, is there as well.
Frequently asked questions
Are you allowed to train AI models with customer data?
With real personal data only on a solid legal basis, and usually it is not sensible. Pseudonymized data, where identifiers are replaced by IDs and stored separately, reduces the risk considerably. The mapping table stays in your own system, never in the model.
What is the difference between anonymization and pseudonymization?
Anonymized data can no longer be linked to a person. Pseudonymized data can be linked again with a separately stored key and therefore still counts as personal data under the GDPR. That is why pseudonymization belongs in the gray-green zone and requires transparency towards the client.
What does the EU AI Act require for AI training?
For high-risk systems, the EU AI Act requires, among other things, data governance, meaning documented origin, quality and processing of the training data, as well as traceability of decisions. A pseudonymization concept with clean documentation is a concrete building block for this.
Related: AI Governance · EU AI Act · AI Speaker
Recent Posts
Recent Comments