From NVIDIA's Gretel to the EU AI Act: Synthetic Data's 2026 Consolidation and Regulatory Reckoning

Two things are happening to synthetic data right now, and most teams are watching only one of them. Big tech is buying the companies that make it. Privacy researchers and EU regulators are dismantling the reason anyone wanted it. Put those together and the era of free, anonymous training data is closing.

The Loophole Closes as the Market Consolidates

Thesis: Synthetic data is being absorbed into enterprise platforms at the exact moment its core promise — privacy by default — is being exposed as conditional, and that collision is what makes this a structural shift, not a news cycle.

For years the pitch was clean. Generate fake records that behave like the real ones, skip the privacy review, train on whatever you want. Synthetic Data Generation got sold as a way around the lawyers and GDPR exposure.

That pitch is breaking on two fronts at once.

On one side, the EU AI Act and a wave of privacy-attack research are turning “anonymous” into “anonymous, conditionally, if you tested it.” On the other, the independent vendors who built the category are being bought out from under it.

The choice for any team still leaning on this data narrows fast: pay for governance now, or inherit someone else’s privacy debt later.

This isn’t a product update. It’s the end of synthetic data as a compliance shortcut.

Three Buyers, One Move, and a Research Problem

Look at who’s buying.

NVIDIA acquired Gretel in March 2025, in a reported nine-figure deal the companies never officially confirmed (TechCrunch). SAS folded the UK generator Hazy into its analytics stack in late 2024 (StartUs Insights). KPMG moved to absorb YData’s technology and IP last autumn (Inside HPC).

A chipmaker, an analytics vendor, and a consultancy. Three different businesses, three different reasons, one identical move. When buyers who share no strategy converge on the same kind of target, that’s not coincidence. That’s a category being repriced as infrastructure.

Now the part the M&A headlines skip.

The promise of Synthetic Data Ethics rested on a simple claim: fake data can’t leak real people. The research says it depends. Partially-synthetic datasets are vulnerable to Membership Inference Attack at high rates, and even fully-synthetic sets leak through outliers and copied source records that stay Re-Identification-able (NCBI/PMC).

Older anonymization crutches like K Anonymity don’t save you, because the failure isn’t in the aggregation. It’s in the rare records the model memorized.

The law already knows this. Synthetic data sits outside GDPR only when re-identification is reasonably impossible, a bar the attack research keeps lowering, while Article 10 of the AI Act sets explicit data-governance criteria for high-risk systems (IAPP). “We used synthetic data” is becoming a question, not an answer.

The money hasn’t slowed. The synthetic data market reached roughly $0.92 billion in 2026, up from about $0.68 billion the year before, per The Business Research Company, though estimates diverge widely by firm. The demand is real. What it buys is changing.

Who Comes Out Ahead

The winners moved before the market made them.

Platform owners. NVIDIA, SAS, and KPMG didn’t buy these startups for the code alone. They bought the ability to bundle generation, validation, and governance into a single stack their enterprise customers already trust.

Vendors who treat privacy as something you measure, not something you claim. The open-source ecosystem around tools like CTGAN keeps shipping, and the teams winning enterprise deals are the ones who can hand a buyer a re-identification risk report instead of a marketing promise.

The independents with a moat. MOSTLY AI and Tonic.ai are still standing because they solved a specific problem well, not because they were cheapest.

The pattern is consistent: governance is the product now. Privacy you can prove beats the privacy you assert.

Who’s Running Last Year’s Playbook

The losers all share one belief: that synthetic data is a checkbox.

Anyone still pitching it as “automatically GDPR-exempt” is selling a position regulators and researchers have already undercut. Treating generated data as a clean-hands workaround is Consent Laundering by another name, and it’s exactly the framing the new rules are built to catch.

Teams using synthetic data to dodge fairness problems are in for a worse surprise. Bias Amplification doesn’t disappear when you synthesize. The model learns the skew in your source data and can sharpen it. Garbage in, confident garbage out.

The same trap is spreading into evaluation. Benchmark Datasets built on naive synthetic data without re-identification testing inherit both the privacy risk and the bias, then launder them as “validation.”

You’re either building governance into your synthetic-data stack now, or you’re buying a liability you can’t see yet.

What Happens Next

Base case (most likely): Vendors use the regulatory runway to bake governance in. Transparency obligations under the AI Act apply from August 2026, watermarking and labeling of generative output deferred to December 2026, while the heavier high-risk requirements slip to 2027 and 2028 under the Digital Omnibus, the first amendment to the AI Act and still provisional as of this spring (Consilium; Gibson Dunn; Latham & Watkins). Synthetic data quietly becomes governed infrastructure. Signal to watch: Vendors shipping membership-inference test suites and data provenance by default, not as paid add-ons. Timeline: Through 2026 into 2027.

Bull case: “Privacy as a measured property” becomes a procurement requirement. Enterprise buyers start demanding re-identification risk reports the way they already demand security attestations. Signal: Risk reports showing up in RFPs and vendor due diligence. Timeline: 2027.

Bear case: Vendors read the deadline deferral as permission to stall, and a high-profile re-identification incident lands before governance catches up. Trust takes the hit, and regulators tighten faster than planned. Signal: A publicized membership-inference breach on data marketed as anonymous. Timeline: Any time. This one doesn’t wait for a calendar.

Frequently Asked Questions

Q: What are real-world examples of synthetic data privacy failures? A: Research on synthetic health data found partially-synthetic datasets vulnerable to membership inference attacks at high rates, and even fully-synthetic sets leaked through outlier records and verbatim-copied source rows, leaving specific individuals re-identifiable (NCBI/PMC).

Q: How will the EU AI Act regulate synthetic data in 2026? A: Transparency obligations apply from August 2026 and watermarking of generative output from December 2026. Article 10 sets data-governance rules for high-risk systems, though those heavier deadlines were deferred to 2027 and 2028 under the provisional Digital Omnibus deal.

Q: What is the future of the synthetic data market in 2026? A: The market reached roughly $0.92 billion in 2026, up from about $0.68 billion a year earlier (The Business Research Company), but it is consolidating fast. Growth is shifting from standalone tools toward governed enterprise platforms with privacy validation built in.

The Bottom Line

Synthetic data isn’t dying. It’s growing up, and growing up costs more than the loophole did. The companies treating privacy and bias as measurable, auditable properties are being bought and rewarded; the ones treating synthetic data as a way to skip the hard questions are about to meet the rules written for exactly that move. Watch for one signal above all: the first vendor to make re-identification testing a default, not a feature.

Stay ahead, Dan.