Blog
Regulatory analysis of the AI Act and the GDPR for SMEs
Biometrics at work: verification isn't identification, and the difference changes everything
Clocking in with a fingerprint, opening doors with your face: workplace biometrics is best analysed through one distinction that orders everything else — one-to-one verification versus one-to-many identification — and the necessity and proportionality test that the impact assessment requires.
AI agents: what to log, and why Article 22 GDPR almost never applies
An agent that carries out actions leaves a different trail from a system that only suggests. Record-keeping under Article 26(6) of the AI Act and the right under Article 22 of the GDPR are two different things, and the second has a threshold that most actions never reach.
The AI inventory in a spreadsheet: why it stops working, and it's not about the number of rows
A spreadsheet works for making the list. The problem isn't making it: it's keeping it up to date. And the way it fails gives no warning — an outdated row looks exactly like a correct one.
High risk: what the Commission's classification guidelines aim to clarify
The question every company using AI in HR, credit or education asks itself — is my system high-risk? — will get official classification guidelines. The draft went to public consultation, and the final version is still pending.
Do you have to label all AI-written text? The editorial review route
No, you won't have to flag every paragraph an assistant has touched. The Article 50 obligation for text has a specific scope and a route designed for those who publish with human review and editorial responsibility. The key is being able to demonstrate it.
The EU's official icons for labelling AI content: how to use them and what they don't prove
The EU has published a free, downloadable set of icons for labelling AI-generated or AI-modified content. A practical guide for SMEs: when they make sense, where to place them, and the two nuances that keep you from using them wrong.
The code of practice on AI content transparency gets the green light: what it is and what it isn't
The Commission and the AI Board have confirmed the code of practice on AI-generated content as an adequate tool for demonstrating the transparency obligations. What signatories gain, and the nuance no signatory should forget.
AI agents and data protection: what the AEPD says
An agent isn't a chatbot: it reasons in chains, remembers, acts on its own and connects to your systems. The AEPD has published guidance on what changes under the GDPR when AI stops responding and starts acting.
You're fine-tuning an open model: have you become a provider?
Using an AI model isn't the same as modifying it, and modifying it enough moves you into a different box under the AI Act. The Commission's guidelines put a concrete threshold on that line. What it means for a company fine-tuning Llama or Mistral with its own data.
Who must warn that your chatbot is an AI? The nuance in Article 50(1) that almost everyone gets wrong
The duty for a chatbot to disclose that it's an AI falls on whoever designs it, not on whoever uses it. What the deploying company owes is something else: checking it works and not breaking it. The difference matters more than it seems.