Short answer. Synthetic data is artificial data produced by a model trained on real records, so it copies the statistical patterns of the original without copying any real person. In one Bank of England fraud trial, a synthetic set of 308 million transactions across 1.8 million accounts let analysts build and share detection models without exposing a single customer identity. For banks and insurers, that pairing of realistic patterns and zero real identities is the whole point.
Every synthetic dataset starts from real data. A generator, often a deep learning model, learns the distributions, correlations, and edge cases inside a source table, then produces new rows that follow the same rules but match no original record one to one. The OECD describes it as artificial data generated from original data and a model trained to reproduce the characteristics and structure of that original. The output looks like a customer table, a claims file, or a transaction log, and it behaves like one under analysis, yet the people in it are invented.
Teams reach for it when real data is too sensitive to move, too scarce to train on, or too slow to release through legal review. Three patterns show up most often in financial services and insurance:
Banks and insurers in Slovakia, Czechia, and Austria sit inside three overlapping rulebooks at once: the GDPR on personal data, the EU AI Act on high-risk systems, and DORA on operational resilience. Each one raises the cost of touching real customer data. Every copy of a production table is a new place to secure, audit, and potentially breach. Synthetic data lowers that cost by keeping the real records still while the work moves forward on an artificial copy.
The EU AI Act reinforces the point directly. Credit scoring and insurance risk pricing are high-risk uses under Annex III, so the data behind them falls under the Article 10 governance duties. Article 10(5) tells providers to prefer synthetic or anonymised data before they process special categories of personal data for bias detection. DORA adds the resilience angle: fewer live copies of sensitive data mean a smaller attack surface and a cleaner picture of where customer records actually sit, which is exactly what a DORA information register is meant to capture.
Synthetic data is generated by a model trained on real records and copies their statistical patterns without copying any real person.
Not automatically. Synthetic data sits outside the GDPR only when it carries no real personal data and no realistic path back to an individual. If a generator memorises rare records, a customer with an unusual salary, age, and postcode combination can still be re-identified, and the GDPR applies again to that dataset. The UK Financial Conduct Authority, which convened a Synthetic Data Expert Group with the industry, treats synthetic data as a privacy enhancing technology with open questions rather than a guaranteed exit from data protection law. The safe position is to measure re-identification risk on every dataset with a defined metric, set a threshold, and document the result before the data leaves the team that made it.
Article 10 requires high-risk AI systems to run on training, validation, and test data that meet quality and governance standards, including examination for bias. Where a provider needs sensitive attributes to detect and correct that bias, Article 10(5) allows processing of special category data only where the same goal cannot be met with other data, including synthetic or anonymised data, and only under safeguards such as pseudonymisation and technical limits on reuse. In plain terms, the regulation names synthetic data as a first option and treats real sensitive data as the exception. Full obligations for high-risk systems apply from 2 August 2026, so firms building credit or pricing models now should design their data pipelines against these rules today rather than retrofitting later.
Anonymised data starts from real records and strips or masks the identifying fields, so each row still maps back to one real person before the masking. Synthetic data generates new rows from a learned model, so no row corresponds to a specific individual at all. That difference matters under pressure: anonymisation can be reversed when attackers link masked records against outside datasets, while a well built synthetic set has no single person to re-identify in the first place. Synthetic data is not automatically safer, because a poor generator can still leak, but it changes the failure mode from unmasking to memorisation, which is easier to test for.
Synthetic data inherits the flaws of its source. If the original is biased, the synthetic copy repeats the bias with a clean face on it. Generators also smooth over rare events, the exact tail cases that fraud and stress models depend on, so a synthetic set can look complete while missing the patterns that matter most. Utility and privacy pull against each other as well: the closer the synthetic data tracks the original, the higher the re-identification risk, and the more you blur it for privacy, the less useful it becomes for training. None of this rules synthetic data out. It means the dataset needs the same validation, lineage, and sign-off as any other input to a regulated model, plus an explicit check that the rare cases survived generation.
Start with one use case where real data is the bottleneck, usually a fraud model starved of positive cases or a test environment that cannot get production data through legal review. Generate a synthetic set for that single job, then measure two things before anyone reuses it: does it preserve the statistical utility the model needs, and does it pass a re-identification test against a set threshold. Record the source, the generation method, the purpose, and the privacy result as dataset lineage, the same way you would document any high-risk input. Governance leaders can then decide on wider use from evidence rather than a vendor claim, and each later dataset reuses a process that is already audited.
Data access is where most regulated AI projects stall, and synthetic data is one of the levers that keeps them moving. Ableneo shipped 34 production AI projects across banking, insurance, and other regulated sectors in 2025, with roughly 4 of 5 reaching production, and that record comes from treating data governance as part of the build rather than a gate bolted on at the end. Our FS&I work pairs synthetic and privacy preserving techniques with the lineage and validation discipline a high-risk model needs, so a dataset is trusted before it trains anything. See how this fits a wider programme in our guide to high-risk AI systems under the EU AI Act.
Key takeaways
Planning AI in a regulated business? Ableneo takes systems from classification to governed production.