Law and Regulation: GDPR, Copyright and the EU AI Act

Using AI is not only a technical choice; it also takes place within rules. In Europe, three bodies of law come up most often: data protection (the GDPR), copyright, and the new regulation on artificial intelligence (the EU AI Act). This lesson gives you the big picture in plain language, so you know the right questions to ask.

In the previous lesson you saw that personal data and confidentiality matter. Now we place these ideas within the European legal framework. The goal is not to turn you into a lawyer, but to give you reflexes and the vocabulary to find the right information.

Part 1: Personal data and the GDPR

The General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) is the main European law about personal data. It applies when personal data of people in the EU is processed, and it covers organizations of all sizes. As an individual using AI for purely personal activities, you are mostly outside its scope, but as soon as you use AI in a professional, association or school context, or you handle other people's data, its principles matter.

Key ideas, in plain words

• Personal data: any information relating to an identifiable person (see the previous lesson). Typing it into an AI tool is a form of processing.
• Controller and processor: the controller decides why and how data is used; a processor handles it on the controller's behalf. If you use an AI service for your organization's work, the provider may act as a processor, which normally requires a proper agreement.
• Lawfulness and purpose: you need a valid legal basis (for example consent, a contract, a legal obligation, or a legitimate interest) and a clear, specific purpose.
• Data minimization: use only the data that is really necessary. This is why anonymizing a prompt is such a good habit.
• Transparency: people should be told how their data is used.
• Security and retention: protect data, and do not keep it longer than needed.
• Individuals' rights: access, correction, erasure, objection and others, in the conditions set by the regulation.
• Transfers outside the EU: sending data to providers in other countries is subject to specific safeguards.
• Automated decisions: people have specific protections against decisions based solely on automated processing that significantly affect them.

What this means for everyday use

• Before pasting data about other people into an AI tool at work, ask: is there a legitimate reason? Is the tool approved? Could I do this with anonymized or invented data instead?
• Do not assume that a tool is "GDPR compliant" because it says so. Read what it says about storage, location, reuse and subcontractors, and ask your organization's data protection contact (often a DPO) if you are unsure.
• Be especially careful with sensitive data (health, beliefs, biometrics) and with data about children.
• If your organization uses AI on personal data in a new or large-scale way, an impact assessment may be necessary: that is for your organization's specialists to decide.

Part 2: Copyright and generated content

Copyright protects original works of authorship (texts, images, music, software). Generative AI raises two kinds of questions, and the answers are still developing in courts and legislatures. They also vary by country.

Question 1: What went into the model?

Models are trained on large collections of data, which may include protected works. Whether and under what conditions this is allowed is debated and is being examined in several jurisdictions. In the EU, there are rules on "text and data mining" that allow it under certain conditions and give rights holders a way to reserve their rights. For you as a user, the practical point is that this is an evolving area, and a provider's choices about training data differ from one to another.

Question 2: What comes out of the model?

• Who owns the output? In many legal systems, copyright protection depends on human creative input. Purely machine-generated content may not be protected in the same way as a human work, while content you shaped substantially might be. This is not settled everywhere, so avoid assuming that you hold exclusive rights.
• Could the output reproduce someone else's work? It is possible, though not typical, that a generated text or image closely resembles an existing work. Do not assume that "the AI wrote it" makes it free of third-party rights.
• The tool's terms of use often say what you may do with the output (including commercial use). Read them, especially before publishing or selling something.

Safe habits

• Do not paste protected texts, images or paid content into a tool in order to republish, imitate or rework them without permission.
• Do not ask a model to copy the exact style of a living creator for commercial use without checking the legal and ethical issues.
• Cite and credit sources you actually use; do not present generated text as fully free of rights.
• For commercial or public publication, check the tool's terms and your organization's policy, and take advice if the stakes are high.

Part 3: The EU AI Act in broad strokes

The EU AI Act (Regulation (EU) 2024/1689) is a European regulation establishing harmonized rules on artificial intelligence. Its core idea is a risk-based approach: the higher the risk an AI system poses to people's health, safety or fundamental rights, the stricter the rules. Its provisions apply progressively over several years, so check the official text and guidance for what applies and when.

The risk levels, simplified

Level	Idea	Examples of what is addressed
Unacceptable risk	Certain practices are prohibited	Manipulative techniques causing harm, some forms of social scoring, certain biometric practices
High risk	Allowed, with strict requirements	AI used in sensitive areas such as recruitment, education, access to essential services, or safety components
Transparency obligations	People must be informed in certain cases	Chatbots that interact with people, AI-generated or manipulated content such as deepfakes
Minimal risk	Few or no specific obligations	Many everyday applications, such as spam filters

The regulation also contains specific rules for providers of general-purpose AI models (the large models behind many assistants), such as documentation and information duties, with additional requirements for the most powerful ones.

Who is concerned?

The main obligations fall on providers (those who develop or place AI systems on the market) and deployers (organizations that use AI systems professionally). As an individual user, you are not the main target, but if you use AI in your job, a business or an association, your organization may be a deployer with duties such as human oversight, transparency to affected people and staff awareness of AI ("AI literacy").

What it means for you

• Transparency: expect to be told when you are talking to an AI and when content is AI-generated in certain contexts, and consider doing so yourself when it matters (see the next lesson).
• Sensitive uses need extra care: using AI to evaluate, rank or filter people (recruitment, grading, access to services) falls into the areas the regulation treats with particular attention. Keep humans in charge and follow your organization's rules.
• Deepfakes: creating realistic fake images, audio or video of real people raises legal and ethical issues beyond the AI Act (personality rights, defamation, data protection). Be very cautious.

Where to find reliable information

• Your national data protection authority, such as the CNIL in France, publishes guides and practical sheets on AI and personal data.
• EUR-Lex publishes the official texts of European legislation, including the GDPR and the AI Act, in all EU languages.
• Your school, employer or professional body may have specific policies and guidance.
• A qualified legal professional can advise on your particular situation.

Your turn: spot the legal questions

Exercise 1. For each situation, name the main legal issue(s) it raises (data protection, copyright, AI regulation or none) and a prudent next step: (a) pasting a client's complaint letter, with name and address, into a public chatbot; (b) asking an AI to write a blog post that you will publish under your own name; (c) using an AI tool to rank job applicants by their CVs.

Exercise 2 (project). Write a short "Legal and data check" box for your prompt library with five yes/no questions you will ask before using a prompt in a work or public context.

See a solution

• (a) Data protection: personal data of a third party, possibly sent to an external provider. Prudent step: anonymize the letter (remove name, address, identifiers) or use only an organization-approved tool; consult your data protection contact if needed.
• (b) Mostly copyright and transparency: check the tool's terms of use, make sure the text does not reproduce someone else's work, verify the facts, and consider mentioning AI assistance where expected.
• (c) Data protection and AI regulation: recruitment is a sensitive area, with risks of bias and automated decision-making. Prudent step: do not delegate the decision; follow your organization's policy, involve HR and the data protection specialists, and keep human review.

A possible check box: (1) Does the input contain personal data of others? (2) Is the tool approved for this? (3) Could the output reuse protected material? (4) Does the result affect a person's opportunities or rights? (5) Should I disclose that AI helped?