GDPR and AI Act Compliance

The duty to disclose certain uses of AI: telling people when they are interacting with a machine, marking synthetic content in a machine-readable format, and labelling deepfakes and AI-generated text published to inform the public on matters of public interest (Article 50, EU AI Act).

An AI model trained on large amounts of data that displays significant generality and can competently perform a wide range of distinct tasks — the kind of model behind general-purpose chat assistants (Article 3(63), EU AI Act).

Uses of AI banned outright in the EU, including social scoring, inferring emotions in the workplace or in education, biometric categorisation to infer protected characteristics, and untargeted scraping of facial images (Article 5, EU AI Act).

An AI system whose use poses a significant risk to health, safety or fundamental rights — including systems used in recruitment, credit scoring, education and access to essential services (Article 6 and Annexes I and III, EU AI Act).

The skills, knowledge and understanding that allow staff to use AI systems informedly and to recognise their risks. Providers and deployers must take measures to support its development (Article 4, EU AI Act).

Any organisation using an AI system under its own authority in the course of its activities. Most businesses using off-the-shelf AI tools are deployers rather than providers (Article 3(4), EU AI Act).