The foundation of GDPR compliance lies in clearly defined legal bases for the processing of personal data. While the appropriate application of Article 6 and 9 of the GDPR to standard processing activities is sometimes already difficult, these challenges vastly increase when applied to AI training. The complex data processing activities involved therein, as well as the concrete personal data that is collected and used, turn GDPR-compliant AI training into a potential legal obstacle for a successful AI deployment. With that in mind, we aim to shed light on the different legal bases AI developers can use in practical scenarios, identifying both the advantages and limitations of each, creating a roadmap based on practical application and the categories of personal data involved.