Artificial intelligence (AI) is already part of our daily lives, making it essential to consider its legal implications.
legal implications.
Regulation (EU) 2024/1689, known as the Artificial Intelligence Act (AI Act), is no longer legislation for the future but a regulatory framework that businesses can no longer afford to overlook. It entered into force on 1 August 2024, with a phased implementation timetable. Since 2 February 2025, prohibitions on certain AI practices and requirements to promote appropriate AI literacy among staff using these tools have applied (for further information, see the European Parliament's press release aquhere)..
This timetable has recently been amended by Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, which entered into force on 27 July 2026. This simplification measure gives businesses additional time to adapt by postponing many of the obligations applicable to high-risk AI systems and introducing greater flexibility in other areas, including staff training.
El RIA, igual que va passar en el seu moment amb el RGPD i la LOPDGDD, no afecta únicament les grans companyies o les empreses tecnològiques. També s'aplica a organitzacions que, sense desenvolupar sistemes propis, ja utilitzen eines d'intel·ligència artificial en la seva activitat diària.
This is currently one of the main challenges facing many businesses, particularly SMEs: AI tools have already become part of their internal operations, but their use has not yet been properly addressed from a legal perspective.
What does the AI Act regulate, and what remains subject to the GDPR?
The AI Act regulates artificial intelligence systems according to their level of risk, establishing different obligations depending on the type of system, its intended purpose and its potential impact on individuals. Where the use of AI involves the processing of personal data—which is considerably more common than many businesses may realise—the GDPR will also apply. This is confirmed by the Digital Omnibus, which exceptionally allows providers of high-risk AI systems to process special categories of personal data to detect and correct bias, subject to additional safeguards beyond those already required under the GDPR.
Accordingly, reviewing an AI tool solely from the perspective of the AI Act, or merely updating the company's privacy policy, is insufficient. Where a business uses AI systems that process personal data, both regulatory frameworks must be assessed together. In certain circumstances, particularly where high-risk data processing, automated decision-making or extensive data processing activities are involved, it may also be necessary to determine whether a data protection impact assessment (DPIA) is required.
In this regard, the Spanish Data Protection Authority (AEPD) has clarified that AI systems are not automatically subject to the GDPR. However, the GDPR applies insofar as those systems involve the processing of personal data, profiling or decision-making concerning natural persons, which is frequently the case in practice (see the AEPD's guidance on adapting AI-based products to the GDPR).
What should businesses be reviewing now?
Although a risk assessment is the recommended starting point, for many businesses a practical initial approach involves examining three specific areas:
- AI tools in use: Identifying which AI tools are actually being used within the organisation, by which departments and for what purposes.
- Information being processed: Determining what types of information are entered into these tools, particularly whether they include personal data.
- AI providers and contractual arrangements: Identifying the provider behind each tool, the terms under which the service is supplied and how the provider actually handles the information it receives, including its role under data protection legislation and the conditions governing such processing.
Where a business already has an established internal control structure, this review can build on recognised information security and risk management frameworks, such as ISO 27001 or ISO 31000, without having to develop an entirely new system.
Conclusion: Key compliance considerations following the entry into force of the AI Act
Many businesses already use artificial intelligence tools in their daily activities. It is therefore essential to review how these tools are being used and establish appropriate internal rules on oversight, privacy and regulatory compliance.
Where their use also involves the processing of personal data, this review should address not only technological and operational efficiency considerations but also GDPR requirements and the organisation's internal control mechanisms.
Since 2 August 2026, the AI Act's transparency obligations have applied, while the requirements concerning high-risk AI systems have been postponed until 2 December 2027 and 2 August 2028, depending on the type of system. This timetable provides businesses with a reasonable opportunity to review their processes, identify existing AI uses and progressively adapt their internal procedures.
At Busquets Law & Finance, we support businesses throughout this process through a comprehensive legal approach that brings together data protection, regulatory compliance, technology contracts and risk management.