EU AI Act · Copyright · GDPR & Automated Decisions
TL;DR:
The EU AI Act creates a four-tier risk pyramid. The original Article 5 prohibited practices have applied since February 2025, and the AI Omnibus added a new ban on nudification apps and CSAM-generating systems. The AI Omnibus shifted most high-risk deadlines: Annex III systems now start on 2 December 2027, while regulated product systems start on 2 August 2028. US courts have held that a fully autonomous AI system cannot be the recognized copyright author; human creative contribution is required for protectable authorship. GDPR's Article 22 gives individuals the right to not be subject to purely automated decisions with legal effects. Penalties for the most serious AI Act violations can reach €35 million or 7% of global annual turnover — whichever is higher.
EU AI Act obligations are phasing in through 2026; courts continue to hold that fully autonomous AI output is not copyrightable authorship without meaningful human creative control. Use this course for orientation — not legal advice.
What we updated for 2026
Still true in 2026
Compare live tools anytime in our tool explorer.
This guide: AI & the law
EU AI Act, copyright, GDPR — practical orientation for builders and operators.
Learn first (we do not repeat this here)
Go deeper after this course
October 2026 update: AI Omnibus moved the high-risk timeline
The AI Act still applies, but the 2026 AI Omnibus removed the old August 2026 cliff edge for most high-risk systems. The current EU timeline points to 2 December 2027 for Annex III high-risk systems and 2 August 2028 for high-risk systems embedded in regulated products. It also added a ban on nudification apps and simplified the company-level AI literacy obligation.
Primary sources: European Commission AI Act overview, AI Omnibus notice, AI Act Service Desk enforcement FAQ, and EUR-Lex Regulation (EU) 2024/1689.
Why law matters now — 2026 depth note
EU AI Act and global enforcement turned “move fast” into “document and classify.”
AI law is no longer a future concern. Some obligations are live, while the AI Omnibus moved the main high-risk deadlines:
Aug 2024
EU AI Act entered into force
The regulation became part of EU law, starting the compliance clock for all organizations.
Feb 2025
8 prohibited AI practices banned
Social scoring, real-time biometric surveillance, manipulative AI, and 5 other practices became illegal across the EU.
Mar 2025
Thaler v. Perlmutter ruling (D.C. Circuit)
US court confirmed: AI cannot be a copyright author. Only works with human creative input are protectable.
Aug 2025
GPAI model rules + penalty regime active
Providers of general-purpose AI models face transparency and safety obligations, with transition periods for older models. Fines are enforceable.
Mar 2026
SCOTUS denies cert in Thaler v. Perlmutter
The US Supreme Court declined review, leaving the D.C. Circuit ruling in place: a fully autonomous AI system cannot be listed as the copyright author.
Jul 2026
AI Omnibus enters into force
The EU simplification package moved high-risk deadlines, simplified AI literacy and database rules, and added a ban on nudification/CSAM-generating systems.
Aug 2026
AI Act enforcement and transparency duties broaden
The Commission and national authorities begin enforcing more AI Act rules; high-risk obligations are no longer the August 2026 cliff edge.
Dec 2027
High-risk Annex III rules apply
Stand-alone high-risk systems in areas such as biometrics, education, employment, essential services, law enforcement, migration, and justice enter the main compliance regime.
Aug 2028
Product-embedded high-risk rules apply
High-risk AI embedded in regulated products such as machinery, toys, lifts, and similar safety-regulated products enters the main compliance regime.
Risk tiers — 2026 depth note
Not all AI is high-risk — misclassification wastes budget or creates liability.
The EU AI Act uses a risk-proportionate approach. The higher the potential harm, the stricter the requirements. Source: European Commission, digital-strategy.ec.europa.eu
Eight specific practices are completely prohibited. No exceptions. In force since February 2025.
Must complete conformity assessment, maintain technical documentation, register in the EU database where required, and implement human oversight. Main deadlines: 2 December 2027 for Annex III systems and 2 August 2028 for regulated product systems.
Must inform users they are interacting with AI. Applies primarily to chatbots and deepfakes.
No specific obligations. This covers the vast majority of AI applications in use today.
Prohibited practices — 2026 depth note
Some use cases are off limits in the EU — social scoring, manipulative dark patterns, etc.
The original Article 5 prohibitions became enforceable on 2 February 2025. The 2026 AI Omnibus adds a further safety ban for nudification apps and systems that generate non-consensual sexually explicit intimate content or child sexual abuse material. Violating prohibited-use rules carries the highest penalty tier.
Manipulative AI systems
AI that uses subliminal techniques or exploits psychological weaknesses to manipulate behavior against someone's interests or to cause harm.
Exploitation of vulnerabilities
AI targeting people based on age, disability, or social/economic situation to distort their behavior in ways that cause harm.
Social scoring by public authorities
Classifying individuals based on social behavior or personal characteristics and using that score to restrict their rights or access to services.
Criminal risk prediction via profiling
Predicting that a person will commit a crime based solely on their profile or personality traits — not on objective, verifiable facts.
Untargeted facial recognition scraping
Mass scraping of the internet or CCTV footage to create or expand facial recognition databases without targeted, lawful purpose.
Emotion recognition in workplaces & education
Inferring the emotional states of workers or students from biometric data in professional or educational settings.
Biometric categorisation for protected characteristics
Deducing sensitive attributes (race, political opinions, religion, sexual orientation) from biometric data.
Real-time remote biometric ID in public (law enforcement)
Using real-time biometric identification systems in publicly accessible spaces for law enforcement, with very narrow exceptions (imminent threat, missing persons).
Nudification and CSAM-generating systems
AI systems that generate non-consensual sexually explicit intimate content or child sexual abuse material, added by the AI Omnibus safety update.
Penalties for prohibited practices
High-risk requirements — 2026 depth note
Conformity, logging, and human oversight are contractual — not slide-deck promises.
The Act distinguishes between providers (who build or deploy AI) and deployers (who use AI in their operations). Both have obligations. Here is how to know if you fall under high-risk rules:
• Build and sell or deploy an AI system
• Release an AI model for others to use (including open-source)
• Substantially modify an existing AI system
Your obligations: Conformity assessment, technical documentation, CE marking, EU database registration, post-market monitoring
• Use an AI system in your business operations
• Use AI to make decisions about employees, customers, or citizens
• Integrate third-party AI into your products or workflows
Your obligations: Use only high-risk systems with declaration of conformity, implement human oversight, conduct fundamental rights impact assessments
Copyright — 2026 depth note
Training and output rights remain unsettled — contracts beat assumptions.
For fully autonomous AI authorship claims, US law now has a clear appellate rule. AI-assisted human works still require a fact-specific authorship analysis. Here is the current legal position, based on primary court decisions:
Thaler v. Perlmutter — the definitive US ruling
D.C. Circuit Court of Appeals, March 2025 · SCOTUS cert denied March 2026
Dr. Stephen Thaler created an AI system called the “Creativity Machine” which autonomously generated an image titled “A Recent Entrance to Paradise.” He applied for copyright registration, listing the AI as the author.
The D.C. Circuit ruled: the Copyright Act of 1976 requires all copyrightable works to be authored in the first instance by a human being.An AI system cannot be a recognized author for a fully autonomous work. The US Supreme Court declined to hear the case in March 2026, leaving that appellate ruling in place.
Key implication
Content generated entirely by AI — with no meaningful human creative input — cannot be copyrighted in the US.Anyone can copy, reproduce, or distribute it freely.
Pure AI output (no creative human input)
→ No copyright protection
Low — it's in the public domain. But your competitor can also use it.
AI-assisted work (human edits, selects, arranges)
→ Human-authored portions may be protected
Medium — you must be able to identify and separate the human creative contribution.
AI as a tool (human provides substantial creative direction)
→ Likely protectable — courts look at human creative control
The more creative control you exercise over the output, the stronger your claim. Document your process.
Training AI on copyrighted works
→ Legally contested worldwide
Multiple ongoing cases (Getty Images v. Stability AI, New York Times v. OpenAI). No settled law yet in most jurisdictions.
Use this to document your creative process when using AI for commercial work:
Project: [Project name]
Date: [Date]
AI tool used: [Tool name and version]
Human creative contributions:
- Initial concept/direction: [Describe your original idea]
- Prompts and iterations: [How many, what decisions you made]
- Selection and curation: [How you chose from AI outputs]
- Human edits and additions: [What you changed or added]
- Final human judgment calls: [Key decisions that shaped the work]
Note: This document supports demonstrating human authorship in the event of a copyright dispute.GDPR & automated decisions — 2026 depth note
Article 22 and DPIAs bite when AI decides about people at scale.
GDPR Article 22 predates the AI Act but is now directly relevant to AI deployments. It gives individuals the right not to be subject to a decision based solely on automated processing when that decision has legal or similarly significant effects.
What counts as a “solely automated” decision with significant effect?
✓ AI automatically rejects a loan application with no human review
✓ An algorithm screens out a CV before a human ever sees it
✓ Insurance pricing set entirely by algorithm with significant financial impact
✓ Credit scores automatically determining credit access (CJEU SCHUFA ruling, Case C-634/21)
✗ Hiring manager uses AI scoring as one input, makes final decision themselves
✗ Spam filter automatically sorts email (minimal legal effect)
• Right to obtain human review of the automated decision
• Right to express your point of view
• Right to contest the decision
• Right to meaningful information about the logic used (Articles 13–15)
• Conduct a Data Protection Impact Assessment (DPIA) before deploying
• Implement meaningful human oversight (not rubber-stamping)
• Provide transparent explanations of how the AI decides
• Create a clear process for individuals to challenge decisions
SCHUFA Ruling: credit scores are Article 22 decisions
Compliance checklist — 2026 depth note
Operationalize law: policies, registers, and vendor DPAs in one place.
Use this checklist as a starting point for your organization's AI governance posture. Not legal advice — for specific situations, consult a qualified legal professional.
AI Use Policy — [Organization Name]
Last updated: [Date]
1. APPROVED USES
- AI writing assistance for non-confidential content
- AI coding assistance (no proprietary code in public tools)
- AI research and summarization of non-sensitive information
2. RESTRICTED USES (require DPO review)
- Any AI system making or informing decisions about employees or customers
- Processing personal, health, or financial data through AI tools
- AI-generated content for regulatory filings or legal documents
3. PROHIBITED USES
- Entering client personal data, passwords, or source code into public AI tools
- Using AI for real-time biometric identification of individuals
- AI-generated content presented as human-authored without disclosure
4. DISCLOSURE REQUIREMENTS
- Disclose AI involvement in external content where required by client contract
- Label AI-generated images and deepfakes as required by EU AI Act Art. 50
- Document creative process for commercially published AI-assisted work
5. HUMAN OVERSIGHT
- All AI-informed decisions about individuals require meaningful human review
- Automated scores or rankings must be reviewed before being acted uponKnow these before you go further.
The EU AI Act applies to any organization offering AI systems or services in the EU market — regardless of where the organization is based. A US startup deploying an AI hiring tool used by EU employees is subject to the Act.
What this means for you
If your product or service uses AI and any users or affected individuals are in the EU, assess your obligations under the Act. The compliance clock is already running, even where the high-risk deadline moved.
The AI Omnibus simplified the previous company-level AI literacy requirement and gives the Commission and Member States a stronger role in promoting literacy. Teams still need practical training to classify risk, use AI safely, and document governance decisions.
What this means for you
Keep lightweight AI literacy records for staff who select, configure, or deploy AI systems. Completing courses like this one remains useful governance evidence.
Fully autonomous AI authorship is not registrable under current US Thaler precedent; AI-assisted works still turn on human creative contribution. The legality of training AI on copyrighted works is still being decided in courts worldwide. Getty Images v. Stability AI (UK) and New York Times v. OpenAI (US) are ongoing.
What this means for you
For AI tools used commercially, check whether your vendor has a licensing program or indemnification against copyright claims from training data. Some (Adobe Firefly, Getty AI) only train on licensed content.
Many organizations assume EU AI Act compliance covers their data protection obligations. It does not. GDPR applies independently to any personal data processed during AI system operation.
What this means for you
Treat EU AI Act compliance and GDPR compliance as parallel tracks, not sequential ones. Involve your Data Protection Officer from the start of any AI project.
Loading quiz...
The EU AI Act uses a four-tier risk pyramid (Unacceptable / High / Limited / Minimal). The original prohibited practices have applied since February 2025, and the 2026 AI Omnibus added a ban on nudification apps and CSAM-generating systems. Penalties for the most serious violations can reach €35 million or 7% of global annual turnover.
US courts have confirmed that a fully autonomous AI system cannot be recognized as the copyright author: human creative contribution is required for protectable authorship. The D.C. Circuit ruled this in Thaler v. Perlmutter (March 2025), and the US Supreme Court declined review (March 2026), leaving the ruling in place.
GDPR Article 22 gives individuals the right to challenge purely automated decisions with legal or significant effects — confirmed in the CJEU's SCHUFA ruling (C-634/21). Organizations must classify their AI systems now and plan high-risk conformity work around the AI Omnibus deadlines: 2 December 2027 and 2 August 2028.
Legal specifics change; the principles do not
Build organizational readiness across 7 dimensions including governance
Start Learning