AI regulation
Regulation EU 2024/1689 differentiates prohibited practices, high-risk systems, transparency and general-purpose AI obligations. Its application timetable and amendments require up-to-date verification for each project.
Privacy and data
GDPR applies whenever personal data is processed, even when an AI tool is not classified as high risk. Establish purpose, legal basis, minimisation, retention, transfers and rights.
Technical ownership
Identify provider, integrator, deployer, data sent, processors, outputs and human oversight. A generic “AI-assisted” label alone is not a sufficient control.
Practical safeguards
Log important decisions, check source quality, avoid sensitive data by default, record failures and define a manual fallback or shutdown path.
At a glance
| Dimension | AI Act | GDPR |
|---|---|---|
| Scope | AI systems and models | Personal data |
| Trigger | Role, use and risk | Processing and purpose |
| Can both apply? | Yes | Yes |
How SFERE can support
SFERE: AI vendor/data-flow inventory, technical controls, human oversight and implementation documentation.
Official laws, standards & publisher resources
This is an editorial explanation. Verify consolidated laws, applicable standards and interpretations for your activity, country and date. Full standards may require a licence.