The concept of shadow IT is by no means new, it is a decades-old phenomenon that gained momentum with the advent of cloud services and the spread of increasingly advanced computing devices among a wide range of users (especially with the advent of smartphones, laptops, tablets - cf. the so-called…
Do large language models store personal data?
The rise of large language models (LLMs) poses challenges to the applicability of data protection rules. There is a lot of debate about the question of whether or not LLMs themselves store personal data. Recently, the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburg DPA)…
Deep Dive into the AI Act - Part 6: AI literacy
In connection with the AI Act, which will enter into force shortly, on 1 August 2024 (and will become applicable in several steps thereafter), we most often talk about prohibited AI practices, high-risk AI systems and related obligations of service providers and deployers, or even specific rules for…
Deep dive into the AI Act - Part 5: Prohibited AI practices
The provisions of the AI Act on prohibited AI practices (Article 5 of the AI Act) will become applicable quite quickly, 6 months after the entry into force of the AI Act (i.e. from February 2, 2025).
As discussed in a previous post, the AI Act takes a risk-based approach and accordingly, we can…
Deep dive into the AI Act - Part 4: what does the risk-based approach mean in practice?
The AI Act is classified as a regulation with a risk-based approach. But what does this mean in practice? What risks does the AI Act address and how? I address this topic below, also taking into account the risk-based approach of the GDPR and its similarities and possible differences with the AI…
Deep dive into the AI Act - Part 3: the definition of AI systems
From the point of view of the application of the AI Act, the question of how to interpret the definition of AI systems is a crucial question. Therefore, in this post, I will examine what can be understoodunder the concept of an AI system under the AI Act and how an AI system can be distinguished…
Deep dive into the AI Act - Part 2: the scope of the AI Act
In Part 2 of my blog series related to the preparation for the application of the AI Act, I deal with the scope of the AI Act, i.e. I examine in more detail the personal, territorial and material scope of application of the regulation. The exceptions to the scope of the regulation will also be…
Deep dive into the AI Act - Part 1: What does the adoption of the AI Act mean in practice?
The legislative process on artificial intelligence (AI) in the European Union has reached an important milestone, after the EU Council approved the final text of the AI Act on 21 May, so the AI Act can enter into force shortly, 20 days after its publication in the Official Journal.
Update…
ECJ´s judgment in the IAB Europe case: cases of joint controllership seem to develop further
In its recent judgment, the European Court of Justice found that IAB Europe, as the sectoral organisation of the digital advertising market, qualifies as a joint controller by defining and applying the framework established to manage data processing consents for the display of online advertising.…
European AI Office: a key player in the European AI regulatory landscape
The upcoming Artificial Intelligence Act (AI Act) in the EU provides an important role to a new unit, the European Artificial Intelligence Office (AI Office) within the European Commission in the enforcement of the AI Act, especially regarding general-purpose AI systems and also in the…