GDPR Effective: May 2018

General Data Protection Regulation

📍 European Union

Comprehensive data protection law for EU citizens

AI Impact

Requires data minimization, purpose limitation, and data subject rights for AI training data

Key Requirements

  • Data must be processed lawfully and transparently
  • Right to explanation for automated decisions
  • Data Protection Impact Assessments for high-risk AI
  • Data residency requirements possible
AIA Effective: Aug 2024

EU AI Act

📍 European Union

World's first comprehensive AI regulation framework

AI Impact

Risk-based classification of AI systems with specific requirements per category

Key Requirements

  • High-risk AI requires conformity assessments
  • Transparency obligations for AI-generated content
  • Prohibited practices (social scoring, emotion recognition in workplaces)
  • Foundation model providers have specific obligations
DSA Effective: Feb 2024

Digital Services Act

📍 European Union

Rules for digital services and platform accountability

AI Impact

Algorithmic transparency and accountability for recommendation systems

Key Requirements

  • Transparency reports on content moderation algorithms
  • User opt-out from profiling-based recommendations
  • External audits for very large platforms
DGA Effective: Sept 2023

Data Governance Act

📍 European Union

Framework for data sharing and data intermediaries

AI Impact

Enables trusted data sharing for AI training while protecting rights

Key Requirements

  • Data intermediaries must be neutral
  • Public sector data reuse facilitated
  • Data altruism organizations recognized

✅ AI Deployment Checklist

Data Processing

☐ Documented lawful basis for processing
☐ Data minimization applied
☐ Purpose limitation documented
☐ Data retention policy in place

Transparency

☐ Users informed of AI processing
☐ Explanation available for automated decisions
☐ AI-generated content labeled (if applicable)

Risk Assessment

☐ AI risk category determined (per AI Act)
☐ DPIA completed for high-risk processing
☐ Human oversight mechanisms in place

Technical Measures

☐ Data residency requirements met
☐ Encryption in transit and at rest
☐ Access controls and audit logging
☐ Bias monitoring and mitigation

🔀 When to Choose Local Inference

Medical Records Processing Patient health data, diagnosis assistance
Local Required GDPR Art. 9 - Special category data
Legal Document Analysis Attorney-client privileged communications
Local Required Professional secrecy obligations
Customer Support Chatbot General inquiries, account information
Hybrid OK PII requires EU data residency
Content Generation Marketing copy, blog posts
Cloud OK No personal data processing
⚠️ Important Disclaimer

This guide provides general information only and does not constitute legal advice. Consult with qualified legal counsel for compliance decisions specific to your organization and use case. Regulations evolve frequently - verify current requirements before implementation.