📚 Course

Beginner–Intermediate

~2–3h

AI & The Law

EU AI Act · Copyright · GDPR & Automated Decisions

The EU AI Act entered into force in August 2024 and began prohibiting certain AI practices in February 2025. Courts have ruled on who owns AI-generated content. GDPR now applies to AI-based automated decisions about individuals. This course gives you a precise, primary-source grounding in what changed, what it means for you, and what you need to do.

Beginner–Intermediate

~2–3 hours

9 Modules

Primary Sources

TL;DR:

The EU AI Act creates a four-tier risk pyramid. Eight AI practices are completely banned since February 2025. High-risk AI systems face strict obligations before they can be deployed. US courts have held that a fully autonomous AI system cannot be the recognized copyright author; human creative contribution is required for protectable authorship. GDPR's Article 22 gives individuals the right to not be subject to purely automated decisions with legal effects. Penalties for violating the AI Act reach €35 million or 7% of global annual turnover — whichever is higher.

Guide by

Albert Schaper

Foundation · Updated July 2026

Law & compliance — mid-2026 checkpoint

EU AI Act obligations are phasing in through 2026; courts continue to hold that fully autonomous AI output is not copyrightable authorship without meaningful human creative control. Use this course for orientation — not legal advice.

What we updated for 2026

EU AI Act: prohibited practices already apply; GPAI and high-risk system duties roll out on staged deadlines — check your role (provider vs. deployer).
US: Thaler line holds — purely AI-generated works lack human-authorship protection; human-edited workflows matter for registration.
GDPR Art. 22: automated decisions with legal/significant effects still require safeguards and explanation rights.
Document human review steps in creative and code workflows for auditability.

Still true in 2026

Jurisdictions differ — multinational teams need counsel beyond this overview.
We cite primary sources in-course; verify dates when you implement policies.

Compare live tools anytime in our tool explorer.

Where this course fits

This guide: AI & the law

EU AI Act, copyright, GDPR — practical orientation for builders and operators.

Learn first (we do not repeat this here)

AI FundamentalsFoundationTechnical context for legal terms.

Go deeper after this course

AI Security & Privacy — Operational controls that support compliance.
AI Readiness Framework — Organizational maturity before scale.

Why law matters now — July 2026 depth note

EU AI Act and global enforcement turned “move fast” into “document and classify.”

Inventory AI use cases by risk tier.
Name a legal/compliance owner.
Pair with Security for data flows.

Why this matters now — not eventually

AI law is no longer a future concern. Key dates have already passed and obligations are live:

Aug 2024

Done

EU AI Act entered into force

The regulation became part of EU law, starting the compliance clock for all organizations.

Feb 2025

Active

8 prohibited AI practices banned

Social scoring, real-time biometric surveillance, manipulative AI, and 5 other practices became illegal across the EU.

Mar 2025

Law

Thaler v. Perlmutter ruling (D.C. Circuit)

US court confirmed: AI cannot be a copyright author. Only works with human creative input are protectable.

Aug 2025

Active

GPAI model rules + penalty regime active

Providers of general-purpose AI models (GPT, Claude, Gemini etc.) face new transparency and safety obligations. Fines now enforceable.

Mar 2026

Final

SCOTUS denies cert in Thaler v. Perlmutter

The US Supreme Court declined review, leaving the D.C. Circuit ruling in place: a fully autonomous AI system cannot be listed as the copyright author.

Aug 2026

Deadline

Full High-Risk AI compliance required

All high-risk AI systems must complete conformity assessments, CE marking, technical documentation, and EU database registration.

Aug 2027

Deadline

Extended deadline for embedded high-risk systems

AI embedded in regulated products (medical devices, machinery) gets an extra year to comply.

Risk tiers — July 2026 depth note

Not all AI is high-risk — misclassification wastes budget or creates liability.

Map features to Annex III categories.
Document why each system is minimal/limited/high.
Update when product scope changes.

The four risk tiers

The EU AI Act uses a risk-proportionate approach. The higher the potential harm, the stricter the requirements. Source: European Commission, digital-strategy.ec.europa.eu

Unacceptable Risk

BANNED

Eight specific practices are completely prohibited. No exceptions. In force since February 2025.

Social scoring by public authorities

Real-time biometric surveillance in public

Manipulative subliminal AI systems

Predictive policing based on profiling

Untargeted facial recognition database scraping

High Risk

STRICT RULES

Must complete conformity assessment, maintain technical documentation, register in EU database, and implement human oversight. Deadline: August 2026.

CV-sorting and hiring tools

Credit scoring systems

Educational access and exam scoring AI

Law enforcement evidence evaluation

Critical infrastructure safety components

Biometric identification systems

Automated visa processing

Limited Risk

TRANSPARENCY

Must inform users they are interacting with AI. Applies primarily to chatbots and deepfakes.

Chatbots and virtual assistants

AI-generated content (deepfakes, synthetic voices)

Emotion recognition systems with low stakes

Minimal / No Risk

FREE TO USE

No specific obligations. This covers the vast majority of AI applications in use today.

AI-powered spam filters

Recommendation systems (Netflix, Spotify)

AI writing assistants for personal use

Image editing tools

AI in video games

Prohibited practices — July 2026 depth note

Some use cases are off limits in the EU — social scoring, manipulative dark patterns, etc.

Red-team marketing for manipulation claims.
Avoid biometric categorization pitfalls.
When unsure, escalate to counsel.

The 8 banned practices (in force since Feb 2025)

These are hard prohibitions under EU AI Act Article 5. Violating them carries the highest penalty tier. They became enforceable on 2 February 2025.

Manipulative AI systems

AI that uses subliminal techniques or exploits psychological weaknesses to manipulate behavior against someone's interests or to cause harm.

Exploitation of vulnerabilities

AI targeting people based on age, disability, or social/economic situation to distort their behavior in ways that cause harm.

Social scoring by public authorities

Classifying individuals based on social behavior or personal characteristics and using that score to restrict their rights or access to services.

Criminal risk prediction via profiling

Predicting that a person will commit a crime based solely on their profile or personality traits — not on objective, verifiable facts.

Untargeted facial recognition scraping

Mass scraping of the internet or CCTV footage to create or expand facial recognition databases without targeted, lawful purpose.

Emotion recognition in workplaces & education

Inferring the emotional states of workers or students from biometric data in professional or educational settings.

Biometric categorisation for protected characteristics

Deducing sensitive attributes (race, political opinions, religion, sexual orientation) from biometric data.

Real-time remote biometric ID in public (law enforcement)

Using real-time biometric identification systems in publicly accessible spaces for law enforcement, with very narrow exceptions (imminent threat, missing persons).

Penalties for prohibited practices

Up to €35 million or 7% of global annual turnover — whichever is higher. The penalty regime became enforceable on 2 August 2025. EU member states must designate national competent authorities with investigation and audit powers.

High-risk requirements — July 2026 depth note

Conformity, logging, and human oversight are contractual — not slide-deck promises.

Maintain technical documentation.
Enable human override where required.
Plan post-market monitoring.

High-risk AI: am I affected?

The Act distinguishes between providers (who build or deploy AI) and deployers (who use AI in their operations). Both have obligations. Here is how to know if you fall under high-risk rules:

You are a Provider if you…

• Build and sell or deploy an AI system

• Release an AI model for others to use (including open-source)

• Substantially modify an existing AI system

Your obligations: Conformity assessment, technical documentation, CE marking, EU database registration, post-market monitoring

You are a Deployer if you…

• Use an AI system in your business operations

• Use AI to make decisions about employees, customers, or citizens

• Integrate third-party AI into your products or workflows

Your obligations: Use only high-risk systems with declaration of conformity, implement human oversight, conduct fundamental rights impact assessments

Try it: Classify your AI use cases

1List 3 AI tools or systems currently used in your organization (or that you personally use professionally).
2For each one: does it make decisions that affect employment, credit, education access, or law enforcement? If yes → likely High-Risk.
3Check the provider's EU AI Act compliance page (most major vendors now have one). Is there a Declaration of Conformity?
4For any high-risk systems you use as a Deployer: is there a human review step before the AI decision is acted on?

Reflect: Did any of your current AI uses fall into the high-risk category? What would meaningful human oversight look like in that context?

Training and output rights remain unsettled — contracts beat assumptions.

Clarify IP in client MSAs.
Keep human creative steps on record.
Use licensed models for commercial art.

AI & copyright: who owns AI-generated content?

For fully autonomous AI authorship claims, US law now has a clear appellate rule. AI-assisted human works still require a fact-specific authorship analysis. Here is the current legal position, based on primary court decisions:

Thaler v. Perlmutter — the definitive US ruling

D.C. Circuit Court of Appeals, March 2025 · SCOTUS cert denied March 2026

Dr. Stephen Thaler created an AI system called the “Creativity Machine” which autonomously generated an image titled “A Recent Entrance to Paradise.” He applied for copyright registration, listing the AI as the author.

The D.C. Circuit ruled: the Copyright Act of 1976 requires all copyrightable works to be authored in the first instance by a human being.An AI system cannot be a recognized author for a fully autonomous work. The US Supreme Court declined to hear the case in March 2026, leaving that appellate ruling in place.

Key implication

Content generated entirely by AI — with no meaningful human creative input — cannot be copyrighted in the US.Anyone can copy, reproduce, or distribute it freely.

What this means practically:

Pure AI output (no creative human input)

→ No copyright protection

Low — it's in the public domain. But your competitor can also use it.

AI-assisted work (human edits, selects, arranges)

→ Human-authored portions may be protected

Medium — you must be able to identify and separate the human creative contribution.

AI as a tool (human provides substantial creative direction)

→ Likely protectable — courts look at human creative control

The more creative control you exercise over the output, the stronger your claim. Document your process.

Training AI on copyrighted works

→ Legally contested worldwide

Multiple ongoing cases (Getty Images v. Stability AI, New York Times v. OpenAI). No settled law yet in most jurisdictions.

US Copyright Office position (January 2025 report): “Prompts essentially function as instructions that convey unprotectable ideas.” Prompts alone — even very detailed ones — are not sufficient to establish copyright in AI output. The more a human shapes and selects from AI output with genuine creative judgment, the stronger a copyright claim becomes.

Use this to document your creative process when using AI for commercial work:

Project: [Project name]
Date: [Date]
AI tool used: [Tool name and version]
Human creative contributions:
- Initial concept/direction: [Describe your original idea]
- Prompts and iterations: [How many, what decisions you made]
- Selection and curation: [How you chose from AI outputs]
- Human edits and additions: [What you changed or added]
- Final human judgment calls: [Key decisions that shaped the work]

Note: This document supports demonstrating human authorship in the event of a copyright dispute.

Compliance checklist — July 2026 depth note

Operationalize law: policies, registers, and vendor DPAs in one place.

Run checklist per new AI feature.
Store vendor AI addenda.
Schedule annual policy refresh.

Practical compliance checklist

Use this checklist as a starting point for your organization's AI governance posture. Not legal advice — for specific situations, consult a qualified legal professional.

For all AI users (individuals)

Disclose AI involvement in work products where your employer, client, or platform requires it

Don't enter personal data, health records, or confidential client information into public AI tools

Verify AI-generated facts before publishing or presenting them

Document your creative process when using AI for commercial content

Know your rights: if an AI decision significantly affects you, you can request human review (GDPR Art. 22)

For organizations deploying AI

Inventory all AI systems in use — classify each against the EU AI Act risk tiers

For high-risk systems: verify provider has EU Declaration of Conformity

For any automated decisions about people: implement genuine human oversight

Conduct DPIA for AI systems processing personal data or making significant automated decisions

Ensure employees using AI tools have adequate AI literacy (EU AI Act Art. 4 requirement)

Review vendor contracts: who is the data controller, who is the processor?

August 2026 deadline: complete conformity assessments for any in-house high-risk AI systems

AI use policy template (internal starting point):

AI Use Policy — [Organization Name]
Last updated: [Date]

1. APPROVED USES
   - AI writing assistance for non-confidential content
   - AI coding assistance (no proprietary code in public tools)
   - AI research and summarization of non-sensitive information

2. RESTRICTED USES (require DPO review)
   - Any AI system making or informing decisions about employees or customers
   - Processing personal, health, or financial data through AI tools
   - AI-generated content for regulatory filings or legal documents

3. PROHIBITED USES
   - Entering client personal data, passwords, or source code into public AI tools
   - Using AI for real-time biometric identification of individuals
   - AI-generated content presented as human-authored without disclosure

4. DISCLOSURE REQUIREMENTS
   - Disclose AI involvement in external content where required by client contract
   - Label AI-generated images and deepfakes as required by EU AI Act Art. 50
   - Document creative process for commercially published AI-assisted work

5. HUMAN OVERSIGHT
   - All AI-informed decisions about individuals require meaningful human review
   - Automated scores or rankings must be reviewed before being acted upon

Risks & Responsible Use

Know these before you go further.

"I didn't know" is not a defence

The EU AI Act applies to any organization offering AI systems or services in the EU market — regardless of where the organization is based. A US startup deploying an AI hiring tool used by EU employees is subject to the Act.

What this means for you

If your product or service uses AI and any users or affected individuals are in the EU, assess your obligations under the Act. The compliance clock is already running.

AI literacy is now a legal obligation

EU AI Act Article 4 requires providers and deployers to ensure that their staff have an adequate level of AI literacy. This is not aspirational — it is an enforceable requirement.

What this means for you

Document your team's AI literacy training. Completing courses like this one is a concrete, documentable step toward Article 4 compliance.

Copyright in training data is still being litigated

Fully autonomous AI authorship is not registrable under current US Thaler precedent; AI-assisted works still turn on human creative contribution. The legality of training AI on copyrighted works is still being decided in courts worldwide. Getty Images v. Stability AI (UK) and New York Times v. OpenAI (US) are ongoing.

What this means for you

For AI tools used commercially, check whether your vendor has a licensing program or indemnification against copyright claims from training data. Some (Adobe Firefly, Getty AI) only train on licensed content.

The AI Act does not replace GDPR — both apply

Many organizations assume EU AI Act compliance covers their data protection obligations. It does not. GDPR applies independently to any personal data processed during AI system operation.

What this means for you

Treat EU AI Act compliance and GDPR compliance as parallel tracks, not sequential ones. Involve your Data Protection Officer from the start of any AI project.

Loading quiz...

Key Insights: What You've Learned

The EU AI Act uses a four-tier risk pyramid (Unacceptable / High / Limited / Minimal). Eight practices have been banned since February 2025 — including social scoring, predictive policing by profiling, and real-time biometric surveillance in public. Penalties for the most serious violations reach €35 million or 7% of global annual turnover.

US courts have confirmed that a fully autonomous AI system cannot be recognized as the copyright author: human creative contribution is required for protectable authorship. The D.C. Circuit ruled this in Thaler v. Perlmutter (March 2025), and the US Supreme Court declined review (March 2026), leaving the ruling in place.

GDPR Article 22 gives individuals the right to challenge purely automated decisions with legal or significant effects — confirmed in the CJEU's SCHUFA ruling (C-634/21). Organizations must classify their AI systems and complete conformity assessments for high-risk uses before August 2026.

Legal specifics change; the principles do not

The EU AI Act, GDPR, and copyright rulings are snapshots of 2025–2026 law. The durable principles are: classify risk, disclose automation, keep humans in consequential decisions, and respect that legal accountability cannot be outsourced to a model. Re-check the exact deadlines and thresholds with a lawyer, but the governance logic stays the same.

Completed

You've completed AI & The Law!