In addition to the GDPR, there is a second European law that is being applied step by step: the AI Regulation, also called the AI Act. This law does not regulate privacy itself, but the use of artificial intelligence, and therefore directly affects the tools that many SMEs now use daily: a chatbot for customer contact, a CV scanner for recruitment, or software that analyzes camera footage. For companies using such tools, new obligations will be added this year and in the coming years, on top of what the GDPR already requires.
Whether this is relevant for your company depends on what the AI application does exactly and which data it uses. If you use AI only to draft texts or to schedule meetings, things will probably not change much for you. If you use AI to support decisions about people — selecting applicants, evaluating staff, categorizing customers into risk categories — there is a greater chance that the new rules will affect you, and that they will look together with the GDPR at the same processing of personal data.
What changes this year
The AI Regulation did not come into force all at once. The law has different dates on which parts of it become applicable, spread over several years. For example, stricter rules apply to AI systems classified as high-risk, and separate obligations apply to providers of general-purpose AI models. Which date applies to which part exactly is set out in the Regulation itself; because this is a phased process, we recommend consulting the official text for the exact dates that apply to your situation, rather than relying on a summary.
What is certain, however, is the direction: the more an AI application influences people — in recruitment, evaluation, access to services — the heavier the requirements become. This aligns with how the GDPR has long looked at automated decision-making, but the AI Regulation adds its own obligations, such as requirements for documentation, transparency to data subjects and, in certain cases, a mandatory assessment before the system is put into use.
For whom this brings change
The Regulation distinguishes roles: whoever develops or places an AI system on the market has different obligations than a company that merely uses it as a tool. Most SMEs fall into that second category, as users of a tool built by a software vendor. Even then, there are obligations, although these are typically less stringent than for the builder of the system. Think of informing employees or customers that AI is being used, and of assessing whether the use falls within the limits of the law.
HR departments using AI in recruitment or evaluation, and companies that have camera footage analyzed by software, would be wise to now inventory which tools these are exactly and what they do with the data. This is the same inventory that the GDPR already requires for the processing register, and these two lines — GDPR and AI Regulation — often run in parallel in practice.
What this means in addition to the GDPR
The AI Regulation does not replace the GDPR and does not make it unnecessary. If an AI tool processes personal data, the GDPR continues to apply to that processing, including the requirement for a lawful basis, the information obligation to data subjects and, where relevant, a data processing agreement with the tool vendor. The AI Regulation comes on top of that in certain cases, with its own requirements that specifically concern the AI system, regardless of whether personal data is involved.
If something goes wrong with personal data when using an AI tool — a chatbot that accidentally shares customer data with the wrong person, or a system that stores data insecurely — the notification obligation under the GDPR remains fully in force. If you are unsure whether an incident with an AI tool falls under that notification obligation, you can Show in a few questions whether a data breach is subject to reporting obligations.
What you can do now
Without waiting for every deadline, you can already map which AI tools are being used within your company, for what purposes, and whether personal data is being processed in connection with them. This inventory is also the basis of the processing register that GDPR already requires, and you can accomplish both objectives — GDPR register and AI overview — in one go. Gdpria.eu maintains in the knowledge base by topic what is happening around AI and privacy, with references to the official text included, so you can verify what applies to your situation.
If you have questions about how AI use relates to your existing GDPR obligations, you will find a number of answers at the frequently asked questions. For the question of how we obtain our information and why we deliberately keep it linked to the source, you can read that on the page where the information comes from.
Whether and how these rules apply precisely to your company is something you would be best advised to have assessed by a lawyer or, if in doubt about the GDPR aspect, you can inquire with the Dutch Data Protection Authority. If you want to first get a picture of where you stand, you can do the free quick-scan without obligation or go through the topics in the knowledge base.