Blog
Regulatory analysis of the AI Act and the GDPR for SMEs
A complete SME case: from the first AI inventoried to a reviewable decision (and one that does not apply)
Demonstration case with fictitious data: a dental clinic inventories its ten AI systems, reasons two classifications and records what does not apply.
A completed example file: vendor, decisions and evidence from a dental clinic
Three documents filled in with the fictitious data of the dental demo: the vendor questionnaire, the decision log and the evidence file.
Customer zero: how Alethexis applies to itself the method it sells
A record of four practices Alethexis applies to itself, with evidence: no visitor analytics, a no-card trial, data in Frankfurt with RLS, integrity hashes.
An employee pastes customer data into a chatbot: is it a personal data breach?
When it is a personal data breach, when it has to be notified and what to do in the first 24 hours, across three scenarios.
EN 18286:2026 exists. The first European standard for the AI Act gives you no presumption of conformity — and it is not yours
CEN-CENELEC has published EN 18286:2026, on the provider's quality management system. Without an Official Journal citation it does not trigger Article 40.
The GDPR already applies to your AI: five articles that don't wait for 2027
Five GDPR articles bind every company that uses AI with personal data, with no wait for the AI Act. What each one asks, and where we cover it.
Articles 87 to 91 LOPDGDD: AI in the Spanish workplace has its own national rules, and they do not wait for 2027
Productivity, disconnection, cameras, fleets: Articles 87 to 91 of Spain's LOPDGDD already set rules for AI at work; collective agreements can add more.
AI literacy: what Article 4 requires now that the Omnibus rewrote it
Article 4 required measures to ensure a sufficient level of literacy. The Digital Omnibus replaced it: now the measures must support its development, and the article itself rules out requiring a specific level from anyone.
Private healthcare: the sector where high risk really is in the core activity — and through two different routes
In most companies, high risk sits in Human Resources. Not in healthcare: there it sits in the consulting room. But it arrives by two paths that get confused — Annex I with its two conditions, and Annex III for emergency triage.
AI regulatory sandboxes slipped to 2027, and almost nobody has covered it
The AI Act requires every Member State to have an AI regulatory sandbox operational. The date was August 2026; the Digital Omnibus moved it to August 2027. It is an obligation of the States, not of companies.