The final report of the series analysing different aspects of the new AI rulebook examines the interaction of the AI Act with existing or draft legislation on data protection and cybersecurity.
The report addresses the references in the AI Act to the General Data Protection Regulation (GDPR), the Law Enforcement Directive (LED), the draft Cyber Resilience Act (CRA) and the Digital Services Act (DSA).
The new AI rulebook provides a new legal basis for further processing lawfully collected personal data in the context of regulatory sandboxes. Such processing will nevertheless need to be compatible with the GDPR requirements.
Moreover, providers of high-risk AI (HRAI) systems are allowed to process special categories of personal data as defined under the GDPR only exceptionally. Providers can resort to such processing only to correct biases in the datasets, and subject to safeguards additional to those foreseen in the GDPR.
For HRAI systems which fall within the scope of the draft CRA and fulfil its cybersecurity requirements, a presumption of conformity will apply vis-a-vis the mandatory cybersecurity requirement for HRAI systems under the AI Act (e.g. resilience against unauthorised use by third parties).
Further, if AI systems are embedded into very large online platforms or very large search engines under the DSA, the AI Act clarifies that such systems are subject to the risk assessment obligations in the DSA.
See also:
Part 1: Scope
Part 2: Obligations
Part 3: Enforcement
For more information and to access our AI Act report series, please click on “Access the full content” - or on “Request Access”, in case you are not subscribed to our European Digital Economy service.
more news
10 September 25
Transposition status of key EU environmental directives
Our new benchmark contains summary information on the transposition status of six key EU environmental directives.
09 September 25
What use of the 6 GHz band? A global update
The 6 GHz spectrum band is suitable for both Wi-Fi and 5G/6G technologies, leading to competing industry demands in recent years. Our new Global Trends Report provides an update about the state of play, regulatory debates and plans to use the 6 GHz band, following decisions at the latest World Radiocommunication Conference (WRC-23).
01 September 25
Regulating submarine cable infrastructure
Our new Global Trends benchmark analyses key aspects of policies and regulations on submarine cable infrastructure in the telecoms sector. The research covers 16 jurisdictions around the world: Australia, Brazil, China, Egypt, the EU, India, Indonesia, Japan, Kenya, Korea, Nigeria, Peru, Singapore, South Africa, the UK, and the US.