Artificial intelligence: European rules, security and data protection

The European Artificial Intelligence Regulation, known as the AI Act, sets rules for developing and using AI. Requirements depend on the purpose, risk and role of each business.

There are prohibited practices, high-risk systems and transparency requirements for certain uses. An assistant answering questions about opening hours is different from a system selecting job applicants. Being a small business does not remove applicable obligations. Read the AI Act.

The Regulation sits alongside existing rules on personal data, consumer protection, equality and safety. Using an AI tool does not replace those duties. Nor is every automatic program an AI system: sending a reminder at a fixed time can be conventional automation.

• Prohibited practices: certain particularly harmful uses, including harmful manipulation and some forms of social scoring. Article 5 prohibitions have applied since 2 February 2025, subject to the rules governing any later amendments.
• High risk: specified uses in areas such as employment, education or access to certain essential services, and some product safety components. Classification requires checking the purpose and legal conditions, not simply the product name.
• Transparency: certain assistants interacting with people and AI-generated or manipulated content require disclosure or marking, depending on the operator’s role and the legal situation.
• Other uses: everyday tasks outside these categories do not automatically inherit high-risk obligations. They must still comply with the GDPR and other applicable rules.

For example, booking a hair appointment through a connected calendar differs from automatically deciding whether someone may obtain credit. If the purpose changes, the classification must be reassessed. IA Gestiona initially focuses on routine administrative and customer-service tasks with a defined scope.

Regulation 2024/1689 entered into force on 1 August 2024. Its amendment, Regulation 2026/1744, has been in force since 27 July 2026.

Article 50 transparency requirements apply from 2 August 2026. The amendment postpones certain high-risk requirements until 2 December 2027 for Annex III uses and 2 August 2028 for systems linked to Annex I products.

The transition until 2 December 2026 for certain existing systems concerns technical marking under Article 50(2); it does not postpone telling people that an assistant is AI. Read the amendment and its deadlines.

Where Article 50(1) applies, the provider must design the system to disclose that interaction, unless it is obvious in the circumstances covered by the rule. Our approach is to explain it clearly from the start: “Hello, I’m this business’s AI assistant. I can help with questions and appointments.”

For a call, the notice should be heard at the beginning. If calls are also recorded or transcribed, appropriate privacy information and a valid legal basis are needed. European Commission guidance.

We can configure AI to complete everyday tasks from start to finish: check a connected calendar, offer available times, confirm an appointment and send a reminder. It needs permissions, reliable information and agreed rules.

If it cannot resolve a request, a connection fails or an action falls outside its permitted scope, it should stop that action, notify the business and tell the customer that a person will continue. Customers should also be able to request human help.

Oversight depends on risk. Legal safeguards for certain decisions about people still apply even when AI can carry them out. Those uses require an assessment of feasibility and the necessary controls before implementation.

The GDPR requires a valid purpose and legal basis, clear information, data limited to what is necessary and appropriate security measures. Access to information does not authorise every possible use.

Before connecting WhatsApp, email or business software, we need to establish access permissions, providers, processing locations and deletion periods. Any international transfers need the applicable safeguards. Consent is not the only legal basis and should not be requested for everything by default.

Solely automated decisions with legal or similarly significant effects require a specific assessment under Article 22. Read the GDPR · AEPD guidance on AI, in Spanish.

Your business supplies accurate information, sets prices and conditions, authorises access and decides why it uses personal data. IA Gestiona defines the technical scope, configures the agreed connections, tests the system and documents issues and human handover.

Legal roles depend on the actual work: integrating a tool, supplying your own system or using it to serve customers may create different obligations. A contract cannot transfer duties that the law assigns to each party. Where applicable, measures must also support staff learning about AI use.

Before real data is used, minimum permissions, authorised accounts, credential protection and the separation of testing from live operation are defined. Depending on the service, backups, activity logs, updates and recovery from failures are agreed. These measures must be checked in the actual installation; mentioning them in a contract does not implement them.

Retention periods and a process for revoking access, returning or deleting data at the end are also established. AI, email, messaging and hosting providers are reviewed according to their role, terms and processing locations. We do not assume all data stays in Europe or is excluded from model training: the chosen provider’s settings and contract must be checked.

After a personal data breach, each party has duties according to its role. A processor must notify the controller without undue delay. The controller assesses notification to the authority and, where required, affected people under GDPR Articles 33 and 34. Different incidents require different responses.

Article 4, amended in 2026, requires measures supporting AI literacy among staff and others operating systems on the business’s behalf. It does not require a guaranteed individual level or turn every course into a mandatory certificate.

For a small business, the practical aim is to understand what the assistant does, which data it may use, how to spot a wrong result and when to stop it or handle an exception. Instructions and training should reflect the use, knowledge and context of the team. The owner does not need to become a programmer.

An accepted quote and a contract with the necessary schedules can cover scope, access, testing, price, licences, support and termination. These topics do not need to be duplicated across numerous documents.

If we process personal data on behalf of your business, an agreement under Article 28 of the GDPR is required. It sets out instructions, confidentiality, security measures and subprocessors. Other documents or consents depend on the service; they are not all mandatory for every project.

Start with a specific task, limit access permissions, test ordinary and exceptional situations, maintain an alert channel and make it possible to stop an automation when needed. AI can make mistakes; these controls help reduce risk.

This website presents service possibilities and illustrative examples. Its buttons open contact channels: they do not themselves include an AI assistant or automatically confirm bookings.

This is general information. Each implementation needs its own assessment and, where appropriate, specialist legal advice. It is not a certification or a guarantee of absolute compliance.