From GDPR to the EU AI Act and beyond.

The Regulatory Moment for AI

AI has moved fast—regulators are catching up. The EU AI Act, now in force as of 2024, is widely regarded as the first comprehensive, risk-based legal framework for AI, complementing existing laws like GDPR and cybersecurity directives. Digital Strategy+2Artificial Intelligence Act

Other regions are following with a mixture of binding laws, voluntary codes, and sector-specific rules. For multinational organizations, the challenge is less “What does one law say?” and more “How do we reconcile ten overlapping regimes?”

Understanding the EU AI Act’s Risk Tiers

The AI Act classifies AI systems into four buckets—unacceptable, high, limited, and minimal risk—each with different obligations. High-risk systems (for example, those impacting critical infrastructure, employment, or access to essential services) face the strictest requirements for risk management, documentation, and human oversight. Artificial Intelligence Act+2Artificial Intelligence Act

Key obligations for providers of high-risk AI include:

• A quality management system and comprehensive technical documentation.

• Rigorous data governance, robustness testing, and cybersecurity measures against adversarial threats. TechRadar

• Logging, transparency, and post-market monitoring, backed by conformity assessments and CE marking. Artificial Intelligence Act

The Intersection with Privacy and Cybersecurity Laws

The AI Act doesn’t replace GDPR, CCPA, or sectoral cybersecurity rules; it layers on top of them. Compliance teams now have to think in matrices:

• Privacy: GDPR/CCPA govern how personal data is collected, processed, and shared; AI adds requirements for impact assessments and automated decision-making transparency. Palo Alto Networks

• Cybersecurity: NIS2, the Cyber Resilience Act, and industry-specific regulations demand secure-by-design software and resilient critical infrastructure—requirements that explicitly extend to AI systems. TechRadar

The upshot: AI compliance can’t live in a silo. It has to be woven into enterprise privacy, information security, and risk management frameworks.

DPIAs, Risk Assessments, and AI-Specific Audits

Risk assessments for AI go beyond standard security reviews. They blend:

• Impact on fundamental rights (e.g., discrimination, due process, freedom of expression).

• Technical vulnerabilities like data poisoning, model theft, and adversarial attacks that can undermine model integrity or safety. ENISA

• Systemic risks, such as large models being reused across multiple applications and sectors.

Regulators increasingly expect ongoing assessment—not just a one-time pre-deployment check—but continuous monitoring, model updates, and incident reporting.

Global Patchwork: From Deepfake Labels to AI Offices

The EU’s approach is influencing others, but every jurisdiction adds its own twist. Recent moves include:

• Spain’s proposed deepfake law with large fines for failing to label AI-generated content, aligned with EU AI Act transparency rules. Reuters

• Dedicated AI supervisory bodies (like the EU’s planned AI Office) with mandates to oversee compliance, issue guidance, and coordinate with data protection authorities. Le Monde.fr

Meanwhile, industry and foreign governments are lobbying to soften timelines and obligations, prompting ongoing debate inside the EU about grace periods and enforcement. Reuters

Closing Thoughts and Looking Forward

Regulation is no longer a future concern; it is shaping AI strategy today. Over the next few years, expect:

• Convergence around core principles—risk-based classification, transparency, human oversight—even as details differ by region. ISACA

• AI compliance engineering to emerge as a discipline, linking legal requirements to security controls, test suites, and automated documentation.

• Regulatory technology ecosystems—auditing tools, conformity assessment services, registries of high-risk systems—as governments operationalize their new powers.

The smart move isn’t to wait for every detail to settle; it’s to build adaptable governance now, designed to flex with the next wave of AI rules.

Reference Sites

1. AI Act – Regulatory Framework for AI – European Commission
   https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai Digital Strategy

2. High-Level Summary of the AI Act – artificialintelligenceact.eu
   https://artificialintelligenceact.eu/high-level-summary/ Artificial Intelligence Act

3. Article 16 – Obligations of Providers of High-Risk AI Systems – artificialintelligenceact.eu
   https://artificialintelligenceact.eu/article/16/ Artificial Intelligence Act

4. Understanding the EU AI Act – ISACA White Paper
   https://www.isaca.org/resources/white-papers/2024/understanding-the-eu-ai-act ISACA

5. The EU AI Act: What It Means and How to Comply – TechRadar Pro
   https://www.techradar.com/pro/the-eu-ai-act-what-it-means-and-how-to-comply TechRadar

Author: Serge Boudreaux – AI Hardware Technologies, Montreal, Quebec
Co-Editor: Peter Jonathan Wilcheck – Miami, Florida