Blog
Regulatory analysis of the AI Act and the GDPR for SMEs
Facilita RGPD and Gestiona RGPD: what they solve well — and where the coverage ends
The AEPD's free tools are an excellent starting point for an SME's basic GDPR compliance. The Agency itself warns of their limit: obtaining the documents doesn't mean you comply. And AI, by design, falls outside their scope.
Harmonised standards under the AI Act: why the presumption of conformity still doesn't exist
The technical standards that will make high-risk obligations operable under the AI Act are not yet published, let alone cited in the Official Journal. What that means for anyone buying or deploying high-risk systems, and why certain marketing claims deserve scepticism.
The AEPD already supervises AI that processes personal data: oversight that doesn't wait for the AI Act
While many companies watch the AI Act calendar, they forget that the GDPR already applies to AI today. Four GDPR failures can involve AI, and they all point to the same thing: missing assessment and missing evidence.
The article that didn't move: why 2 August is still a real date
While everyone celebrates the postponement of high-risk obligations, the transparency duty under Article 50 still applies from 2 August 2026. It's the date many SMEs aren't watching.
Article 4 AI Literacy after the Omnibus: the obligation softens, the diligence doesn't
The Digital Omnibus rewrites Article 4 in a less demanding tone. That doesn't mean AI literacy stops mattering. It means exactly the opposite of what alarmist messaging sells.
FRIA and DPIA are not the same thing: why one does not replace the other
They look alike, they overlap, and they get confused more often than they should. But the AI Act's FRIA and the GDPR's DPIA are structurally different instruments. Treating one as the other is a mistake with consequences.
AI in the dental clinic: where the real risk sits and what to document now
AI-assisted image diagnosis is already routine in many clinics. Understanding why it's classified the way it is — and which obligation lands first — avoids both panic and carelessness.
AI in recruitment: the high-risk zone arriving in December 2027
Filtering candidates with AI is one of the uses the AI Act classifies as high-risk. The Omnibus grants leeway until the end of 2027, but the documentation is worth starting sooner.
The AI you're already using without knowing it: why the inventory is the foundation of everything
The first step in AI governance isn't buying software. It's knowing what AI you're already using. And the answer is almost always longer than the organisation thinks.
Who enforces the AI Act in Spain: AESIA and what a market surveillance action looks like
The AI Act isn't overseen only from Brussels. In Spain, AESIA is the central piece, and it isn't alone. Understanding the map of authorities helps you prepare without panicking.