This article proposes the concept of purpose limitation for AI models as an approach to effectively regulate AI. Unregulated (secondary) use of specific models creates immense individual and societal risks, including discrimination against individuals or groups, infringement of fundamental rights, or distortion of democracy through misinformation. We argue that possession of trained models, which in many cases consist of anonymous data (even if the training data contains personal data), is at the core of an increasing asymmetry of informational power between data companies and society. Combining ethical and legal aspects in our interdisciplinary approach, we identify the trained model, rather than the training data, as the object of regulatory intervention. This altered focus adds to existing data protection laws and the proposed Artificial Intelligence Act. These are inefficient in preventing the misuse of trained models due to their focus on the procedural aspects of personal data or training data. Drawing on the concept of risk prevention law and the principle of proportionality, we argue that the potential use of trained models by powerful actors in ways that are damaging to society warrants preventive regulatory interventions. Thus, we seek to balance the asymmetry of power by enabling democratic control over where and how predictive and generative AI capabilities may be used and reused.
Keywords: EU AI Act; GDPR; purpose limitation; regulating models; data power