AI and the law: AI Act, AESIA and GDPR made simple

What you'll see in this lesson

1. The AI Act in one idea: more risk, more rules

   Regulation (EU) 2024/1689 sorts AI uses by risk level and splits obligations between those who build it and those who use it.

2. The real timeline, now with the digital omnibus

   The AI Act has been in force since August 1, 2024 and applies in phases; the 2026 digital omnibus postponed high risk.

3. AI literacy: train your team and keep a record

   Article 4 requires providers and deployers to take measures so their people know how to use AI.

4. Article 50: disclose and label what AI generates

   Since August 2, 2026, anyone talking to an AI must know it, and deepfakes have to be labeled.

5. What you can't do and what needs extra care

   Some practices have been prohibited since 2025, and others will be high risk, with strict obligations, from December 2027.

6. Spain: AESIA, a lapsed law and high fines

   AESIA, based in A Coruña, is the authority set to oversee the AI Act; the Spanish law lapsed when Parliament was dissolved.

7. GDPR: before putting client data into an AI

   If the AI processes personal data, you're still responsible: you need a legal basis, a contract with the provider and to inform those affected.

8. Plans, transfers and minimal data

   Personal plans aren't suitable for client data: use business plans or the API with a contract, or a model on your own machine.

9. Summary: comply without the headache

   With a usage policy, recorded training, proper notices and signed contracts, you cover the essentials for an agency.