What the EU AI Act Means for Data Protection: Immediate Compliance Steps for General-Purpose AI Models (GPAI) as of August 2025

What the EU AI Act Means for Data Protection: Immediate Compliance Steps for General-Purpose AI Models (GPAI) as of August 2025

The European Commission has set a significant milestone for organizations deploying or integrating general-purpose AI models (GPAI). As of August 2, 2025, these organizations must adhere to new obligations under the EU AI Act. This development is crucial for data protection officers, privacy professionals, and any entity involved with AI technologies.

Overview of the EU AI Act’s Requirements for GPAI Models

The EU AI Act introduces a comprehensive framework aimed at ensuring the safe and transparent use of AI technologies. For GPAI models, “prompt compliance” means adhering to specific guidelines that emphasize transparency, safety, and copyright. Organizations must ensure that their AI systems are designed and implemented in a manner that is consistent with these principles.

Highlights from the New GPAI Code of Practice

The EU AI Office has released the final version of the GPAI Code of Practice, which serves as a structured guide for compliance. Key highlights include:

  • Transparency: Organizations must provide clear information about how AI models function and make decisions.
  • Safety: AI systems should be robust and secure, minimizing risks to users and stakeholders.
  • Copyright: Proper management of intellectual property rights is essential to avoid legal pitfalls.

Immediate Steps for Compliance

To ensure compliance with the EU AI Act, organizations should take the following immediate steps:

  1. Conduct Risk Assessments: Evaluate the potential risks associated with AI models and implement measures to mitigate them.
  2. Documentation: Maintain detailed records of AI system operations and decision-making processes.
  3. Update Privacy Notices: Ensure that privacy notices reflect the new requirements and inform users about AI data processing activities.

Potential Challenges and Open Questions

Data protection officers face several challenges, including how the EU AI Act’s requirements interact with existing GDPR obligations. Questions remain about the harmonization of these regulations and the practical implications for organizations.

Practical Advice for Organizations

Organizations using or developing AI should align their practices with both the EU AI Act and national data protection laws. This includes:

  • Regularly reviewing and updating AI systems to comply with evolving regulations.
  • Engaging with legal experts to navigate complex compliance landscapes.
  • Implementing privacy-by-design principles to ensure data protection is integrated into AI development from the outset.

For further insights and resources, consider exploring the following links: