Blog
Regulatory analysis of the AI Act and the GDPR for SMEs
ISO/IEC 42001 and the EU AI Act: what it is, what it does not require and how it fits an SME
ISO/IEC 42001 is the international standard for AI management systems. It is voluntary, it gives no presumption of conformity with the AI Act and the Regulation does not require it. When it pays off for an SME, and how to start without it.
AI medical devices: what changes on 2 August 2028 for manufacturers and for the clinics that use them
From 2 August 2028, the AI Act's high-risk rules reach AI medical devices that need a notified body. For the manufacturer it is one procedure, not two; for the clinic, Article 26, and not the FRIA.
From 5 October, your staff have the right to know which systems decide about their work
Spain's RD 723/2026 requires written information to every worker about the algorithmic systems that decide about their work. What it demands, of whom, and how to prepare.
The AEPD's Article 35(4) list: when your AI requires a DPIA even if it is not high-risk under the AI Act
Article 35 GDPR requires a DPIA where risk is high; the AEPD list (Article 35(4)) considers one necessary where two or more criteria are met, even if not high-risk under the AI Act.
What an AI use policy should say
Eight clauses for a company AI use policy: what each one says, which law it rests on and sample wording. The template can be downloaded from Resources.
Your AI vendor is almost always a processor: what the Article 28 contract has to say
If an AI vendor processes personal data on your company's behalf, it is a processor, and Article 28 GDPR sets out what the contract must cover.
Article 22 GDPR: the right not to be subject to an automated decision — and the three exceptions that allow one
Article 22 GDPR gives the right not to be subject to a decision based solely on automated processing with significant effects, except in three cases.
Article 26, paragraph by paragraph: what binds the deployer of high-risk AI, and which post covers each
The twelve paragraphs of Article 26 in one table: who each one binds and which post explains it. Two do not concern a private company.
Article 50 on one page: the four paragraphs, who each one binds, and the eight posts that unpack them
Article 50 of the AI Act in one table: what each of its four paragraphs requires, who it binds, from when, and what the deployer checks.
Article 64.4(d) of Spain's Workers' Statute: your works council already has the right to know which algorithms you use, and AI Act Article 26(7) will extend it in 2027
Works councils in Spain are entitled to the parameters, rules and instructions of algorithms that decide about staff. What that covers and how to inform.