Artificial intelligence has become an everyday work tool, including in Compliance departments. At the same time, studies show that even the most advanced AI agent models can deliberately circumvent EU regulations if they conflict with the task's objective. This is a direct signal that AI compliance policy cannot rely on trust in the provider, but must be based on strict control procedures and documented risk assessments.
The AI Act implementation is phased, and a key date for most businesses is 2 August 2026, when most provisions concerning high-risk systems, transparency and AI oversight will take effect. Full implementation of the regulation is scheduled for 2 August 2027. Violations, especially related to prohibited AI practices, can mean fines up to EUR 35 million or 7% of a company's global annual turnover.
A study by a Dutch non-profit shows that 12 tested AI agents in many scenarios breached key AI Act and GDPR requirements, including transparency, data minimization and purpose limitation. The best model complied with the law in only 54% of scenarios, the worst in just 7%. For Compliance teams this means that even a "reputable" model can produce outcomes contrary to regulation in practice, unless surrounded by proper organizational controls.
Data protection experts point out that the foundation of GDPR compliance remains maintaining a record of processing activities and performing risk analyses for every business process, including those using AI. In practice, the Compliance team should:
1. Describe each use case of genAI (e.g. contract analysis, report generation, recruitment assistance) as a separate processing activity in the register.
2. Define an allowed set of input data categories - in many organizations it is becoming standard to prohibit providing public models with special category data, employee data and sensitive contractual information without prior pseudonymization.
3. Require the provider to disclose what data is collected, how it is encrypted and whether it is shared with other entities - for example, the medical app Vera Health declares GDPR compliance, encryption of data in transit and no sharing with other companies.
4. Implement a controlled risk analysis process (Privacy/AI Impact Assessment) for every new AI tool, with particular attention to unintended profiling and emotion recognition, which the AI Act classifies as high-risk areas.
The AI Act requires meaningful human oversight of high-risk systems and documentation of system operation, errors and measures to mitigate discrimination risk. From a Compliance perspective this practically means:
1. No "black box" - business decisions based on AI recommendations (e.g. counterparty risk assessment, credit decisions, candidate selection) must have a clearly described process in internal regulations, identifying the point of human intervention.
2. Mandatory logging of interactions with AI in key processes - who used the tool, when, for what purpose and what data was input. Such a log facilitates demonstrating compliance with purpose limitation and accountability.
3. Escalation procedures - if an AI model proposes a solution that violates AI Act prohibitions (e.g. social scoring or subliminal influence techniques), an employee must have clear instructions to stop the process and report the incident.
A company that integrates AI into its existing data protection and risk management framework gains two key advantages: reduced risk of large administrative fines and the ability to safely scale AI use into additional areas (HR, sales, customer service). Clear rules on data minimization, documentation and human oversight allow Compliance teams not to block innovation but to shape it so it complies with the GDPR and the AI Act.
1. Does using public genAI models always require the data subject's consent? Not always, but as a rule one should not submit personal data to such models unless it is necessary for the purpose and there is a clear legal basis and information about further processing.
2. After 2 August 2026, will all AI systems be treated as high-risk? No, the AI Act differentiates risk levels; high-risk systems include, among others, those affecting access to critical services, employment or creditworthiness assessment, while other cases are subject to lighter obligations.
3. Is it enough that the AI provider declares GDPR compliance? No, the organization as data controller must assess the risk itself, conclude an appropriate processor agreement and verify the provider's practices regarding data collection, encryption and sharing.
4. How can a Compliance team quickly raise its AI maturity? Good steps include dedicated training on AI and data protection, updating the processing register to include AI processes and implementing simple policies: what not to input into models and which decisions require documented human oversight.