The European Data Protection Board (EDPB), based on the request of the Irish Supervisory Authority, issued its opinion under Art. 64(2) GDPR on certain data protection aspects related to the processing of personal data in the context of AI models (the "Opinion").
Below, I briefly summarise the…
Deep Dive into the AI Act - Part 7: general-purpose AI models
The rules of the AI Act, which came into effect as of August 1, 2024, will become applicable in several stages. Initially, from February 2, 2025, the provisions related to prohibited AI practices must be applied, and from August 2, 2025, the rules related to general purpose AI models will become…
How does the new Product Liability Directive affect liability for AI-systems?
The new Product Liability Directive (PLD, Directive 2024/2853) has recently been published in the Official Journal of the European Union, renewing the previous product liability regime established by the old product liability directive adopted in 1985. Member States shall bring into force the laws,…
Responsible authorities for the enforcement of the AI Act on national level
The AI Act entered into force on 1 August 2024 and its provisions on AI governance (Chapter VII) will apply from 2 August 2025. The AI governance on the EU level includes the AI Office, the European Artificial Intelligence Board, an advisory forum and a scientific panel of independent experts should…
There is nothing new under the sun: shadow AI
The concept of shadow IT is by no means new, it is a decades-old phenomenon that gained momentum with the advent of cloud services and the spread of increasingly advanced computing devices among a wide range of users (especially with the advent of smartphones, laptops, tablets - cf. the so-called…
Do large language models store personal data?
The rise of large language models (LLMs) poses challenges to the applicability of data protection rules. There is a lot of debate about the question of whether or not LLMs themselves store personal data. Recently, the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburg DPA)…
Deep Dive into the AI Act - Part 6: AI literacy
In connection with the AI Act, which will enter into force shortly, on 1 August 2024 (and will become applicable in several steps thereafter), we most often talk about prohibited AI practices, high-risk AI systems and related obligations of service providers and deployers, or even specific rules for…
Deep dive into the AI Act - Part 5: Prohibited AI practices
The provisions of the AI Act on prohibited AI practices (Article 5 of the AI Act) will become applicable quite quickly, 6 months after the entry into force of the AI Act (i.e. from February 2, 2025).
As discussed in a previous post, the AI Act takes a risk-based approach and accordingly, we can…
Deep dive into the AI Act - Part 4: what does the risk-based approach mean in practice?
The AI Act is classified as a regulation with a risk-based approach. But what does this mean in practice? What risks does the AI Act address and how? I address this topic below, also taking into account the risk-based approach of the GDPR and its similarities and possible differences with the AI…
Deep dive into the AI Act - Part 3: the definition of AI systems
From the point of view of the application of the AI Act, the question of how to interpret the definition of AI systems is a crucial question. Therefore, in this post, I will examine what can be understoodunder the concept of an AI system under the AI Act and how an AI system can be distinguished…