AI Regulation: EU AI Act, GDPR & Global Rules
AI governance starts with a specific use case: who is using the system, what it does, and who could be affected. A chatbot helping with a study plan and a system deciding access to education raise different questions.
Source review: October 6, 2026. This lesson teaches how to investigate obligations. A classroom classification is not a legal determination for a live deployment.
What You'll Learn
- Distinguish a system's purpose from its marketing label
- Check scope, role, and application dates before drawing conclusions
- Understand how AI rules and data protection can apply together
- Build a short, source-backed governance checklist
The EU AI Act: A Starting Map
The Act uses a risk-based approach. Its categories help orient a review, but they do not replace the definitions and exceptions in the law.
| Category | Starting question |
|---|---|
| Prohibited practices | Is the use covered by a specific prohibition? |
| High-risk systems | Does its intended purpose meet the classification rules? |
| Transparency obligations | Must people be told about AI interaction or generated content? |
| Minimal or no risk | Which other laws or organizational rules still apply? |
General-purpose models also have their own obligations. Consult the European Commission's overview.
Under Article 6, high-risk classification depends on specified product-safety conditions or listed use cases, with qualifications. Do not assume every medical, educational, or financial tool has the same status. An essay-scoring system and a student brainstorming assistant have different intended purposes. Record the purpose and relevant provision before assigning a category.
Check Who Is Covered
Article 2 covers several roles, including providers placing systems on the EU market and deployers established in the EU. Certain non-EU providers and deployers are also covered when system output is used in the EU. Scope exceptions matter, including deployer use in a purely personal, non-professional activity.
For example, a supplier and the organization operating its product may have different duties. Simply saying âwe use AIâ or âan EU person saw the outputâ does not complete the scope analysis.
Check the Date as Well as the Rule
The Commission's current timeline distinguishes these stages:
- February 2, 2025: initial prohibited-practice rules and AI literacy obligations
- August 2, 2025: governance and general-purpose-model obligations
- August 2, 2026: general application, with exceptions
- December 2, 2027: high-risk rules for specified Annex III uses
- August 2, 2028: high-risk rules for regulated products under Annex I
The two high-risk dates come from the AI Omnibus amending regulation, published in the Official Journal and in force since July 27, 2026. It moved those dates back from the original August 2026 and August 2027 deadlines. Check the current consolidated text and transition provisions for the actual system. A future deadline for one requirement does not suspend other applicable duties.
GDPR and Automated Decisions
GDPR addresses personal-data processing. The AI Act addresses AI-system obligations. Check the scope of each separately; meeting one set of obligations does not satisfy the other.
The European Data Protection Board's guide explains protection against solely automated decisions with legal or similarly significant effects. Article 22 has exceptions and safeguards; it is not a ban on every automated recommendation. Information, access, correction, and erasure rights also have conditions and limits.
For your project, identify the data involved, who is responsible for it, and whether a person can actually challenge a consequential outcome. A reviewer who automatically accepts every recommendation is not a useful operational safeguard. For real processing decisions, involve the organization's privacy or legal team.
Global Rules: Verify Status, Not Just a Bill Number
Local and sector-specific rules may matter alongside general AI laws. Two examples show why a source check is necessary:
- New York City's Local Law 144 guidance describes bias-audit, publication, and notice requirements for covered automated employment decision tools. Start with its definition of a covered tool instead of assuming all hiring software is included.
- California's SB 1047 was vetoed in September 2024, as the Governor's announcement confirms. A widely discussed bill is not necessarily an enacted law.
When researching another country or state, use its legislature or regulator. Record whether a document is a proposal, enacted law, guidance, or voluntary framework; then check amendments and effective dates. Avoid using a chatbot's remembered summary as the final authority.
Hands-on: Build a Governance Note
Use this hypothetical scenario: a university plans to use AI to rank scholarship applications. Do not upload real applications.
Write a one-page note with six fields:
- Purpose: What decision does the system influence?
- People and roles: Who supplies it, operates it, and is affected?
- Data: What personal information is needed, and what can be left out?
- Possible obligations: Which official provisions might apply? What facts are still missing?
- Dates and status: Is each source current, enacted, and applicable to this use?
- Oversight: Who checks results, hears challenges, and can stop the system?
Example starting point: Ranking scholarships affects access to education and involves personal data. Investigate the AI Act's classification rules and relevant data-protection obligations. Record uncertainty about the tool's purpose and decision process. Do not write âcompliantâ merely because a human clicks the final button.
You may ask an AI to organize your notes, but verify every cited provision and date yourself. Save the source links and review date so another person can check your work.
Key Takeaways
- Classify the actual use, not the product name.
- Scope, role, exceptions, and dates all matter.
- AI-system and data-protection obligations can both apply.
- Distinguish proposals, enacted laws, and voluntary guidance.
- A good governance note makes uncertainty and responsibility visible.