EU high-risk AI rules, postponed deadlines
The European Commission has published draft guidance on the classification of high-risk AI systems and is seeking public comments. The guide aims to support providers and deployers of AI systems, as well as competent market surveillance authorities, in assessing whether an AI system should be classified as high-risk, thereby facilitating the uniform application and effective enforcement of Art. 6 AI Act. The examples listed in the document strive to cover all areas and use cases, but they are not to be considered exhaustive and may be updated over time.
Stay up to date! Sign up to receive our fortnightly digest via email.
In mid-May, the EU negotiators reached a provisional agreement to streamline certain rules regarding AI. It introduces a fixed timeline for the delayed application of high-risk rules: the new application dates will be 2 December 2027 for stand-alone high-risk AI systems and 2 August 2028 for high-risk AI systems embedded in products. It also proposes certain regulatory exemptions granted to SMEs and small mid-caps (SMCs), and extends the possibility to process sensitive personal data for AI bias detection and mitigation.
Cloud computing technology and the GDPR
The French CNIL’s new guide helps actors in the cloud computing sector identify their responsibilities for personal data with concrete examples. The qualification of the actors within the meaning of the GDPR (data controller, joint controller or processor) has a significant impact on the distribution of responsibilities of each party, particularly in terms of contractualisation, data security and the exercise of rights by data subjects. In the cloud computing ecosystem, qualifying the parties can be complex.
Clouds offer various services including infrastructure (IaaS), platform (PaaS) and software (SaaS) packages with a distribution of responsibilities that can vary depending on the level of control of the provider and the customer’s configuration possibilities. Additionally the division of responsibilities can change with the progress of a given project or changes in customer needs.
UK introduces new ‘right to complain’
By 19 June, all UK organisations must have a clear process for handling data protection complaints under the 2025 Data Use and Access Act. Opening a complaint can now come directly from anyone who believes their personal information hasn’t been handled properly, easing the burden on the overstretched Information Commissioner’s Office. Ahead of the application date, organisations must take one of the following actions:
- provide a complaint form that people can submit to you either electronically or in writing (by email or post);
- provide an email address for people to submit complaints to;
- allow people to make complaints over the phone;
- provide an online complaints portal;
- have a live chat function with the option to escalate to a human if needed; or
- give people a way to make complaints to you in person (if you don’t have an online presence).
Organisations are not required to set up a separate tool for receiving complaints, as long as they can still meet their obligations. An existing complaint tool may not be data protection specific, but it can be adapted to include data protection complaints. What to do upon receiving a complaint, keep reading here.
AI chatbots, points of vigilance for data controllers
The Belgian Data Protection Authority recently investigated a conversational smartphone application using artificial intelligence and language models. The regulator notes that organisations developing or operating such applications sometimes focus heavily on product development, user experience and scalability, while formal data protection obligations are only fulfilled in a structured way at a later stage. Recurring points of attention are:
- Retention periods. Conversational applications or chat histories, unless properly anonymised, can contain large amounts of personal data, sometimes of great sensitivity.
- Transparency. Users are often unaware of exactly how their conversations are handled internally.
- The distribution of roles within complex AI ecosystems is not always obvious.
- Technical and organisational measures, such as automatic filtering of harmful interactions or the application of strict access control over chat data.
- A prior Data Protection Impact Assessment (DPIA), and
- Compliance from the design phase, rather than being added later in a hurry.
More official guidance
EDPB short guides: The Danish regulator published a series of short and animated GDPR guides (in English) on its website, produced by the European Data Protection Board. The aim is to make the data protection rules more understandable and easier to use for both organisations and citizens, including areas such as consent, pseudonymisation, blockchain, connected vehicles, interaction between the DSA and GDPR, and many more.
AI assistant privacy warning: The Spanish Data Protection Agency AEPD has sent an information note to the EDPB regarding a preliminary study called ‘Your AI assistant is leaking your conversations’, published by the Imdea Networks research institute. The study analyses whether some of the most popular AI systems employ trackers that would allow third parties, including analytics and advertising providers such as Google, Meta, TikTok, and others, to access information about user conversations and activity. The report identifies three main problems:
- the exposure of permanent links of conversation sessions to third-party trackers;
- the ability to link these interactions to user identities through tracking mechanisms; and
- existing privacy controls and policies may not accurately reflect actual data flows.
Health data guidance: In recent years, the health research sector has undergone major changes: increasing dematerialisation and decentralisation of research, social and environmental aspects, and strengthening of testing requirements on health products before they are placed on the market. To meet the needs expressed by those involved in this sector and to take into account personal data protection risks, the CNIL has updated its reference methodologies (MR-001 and MR-003, both available in English). They are also supplemented by an annex on safety measures for health research and another on quality control.
Football, safety and AI
The Czech data protection authority has expressed its views on the processing of biometric data via camera systems to prevent unwanted persons from entering football stadiums. In principle, a camera recording made in the usual manner does not constitute processing of special category personal data. The legal basis in this case is most often the protection of the legitimate interests of the controller or a third party.
If biometric characteristics of data subjects are processed together with image recordings or transmissions for identification purposes, such processing constitutes a fundamental interference with the privacy. Derogations from the general prohibition on processing such data can be found in Art. 9 of the GDPR. In the public interest context of the envisaged use for identifying persons in football stadiums for security reasons, this can be considered. Nonetheless, the possible combinations of purposes and technologies and processing personal data with remote AI-assisted real-time biometric identification of natural persons represents an exceptionally high combination of risk factors.
For comparison, the AI Act prohibits similar processing of personal data for the purpose of detecting crime, allowing only strict exceptions if permitted by the law of an EU member state.
In other news
Insurance data fine: The UK Information Commissioner secured a 355,880 pound confiscation order against a former Manchester motor insurance worker, who was previously found guilty of securing unauthorised access to personal information on his work computer systems for his own financial gain. Payment must be made within three months, or there will be an additional default prison sentence of three years and six months.
The order was granted at a Proceeds of Crime Act hearing at Manchester Crown Court in May 2026. This followed a 2024 guilty plea to the offence under the Computer Misuse Act 1990 of causing a computer to perform a function with the intent to secure unauthorised access to personal information.
Think tank fine: Italy’s Garante has imposed an 85,000 euro fine on The European House – Ambrosetti SpA, a strategic consulting firm and think tank, for deficiencies in its security measures. Critical issues emerged following a data breach that affected 61,670 people, including employees of client companies and internal staff using online services. The cyber attack, attributed to unauthorised access to systems through a technical vulnerability, resulted in the exfiltration of names, surnames, email addresses, usernames, and passwords.
The company stored some passwords in clear text and others using encryption techniques that did not comply with the most advanced security standards. It also stored credentials for systems no longer in use, in violation of the principles of data storage limitation and data security. Despite having notified the data breach within the 72 hours required by law, the organisation failed to promptly inform the data subjects. Users were notified approximately two months after the incident was discovered, only after a corrective measure was taken by the regulator.
Receive our digest by email
Sign up to receive our digest by email every 2 weeks
Medical data anonymity fine
IQVIA Operations France was fined 5 million euros for non-compliance with safeguards aimed at limiting the risks to individuals in the management of health data warehouses. The company provides consulting and conducts studies on its own behalf or on behalf of pharmaceutical laboratories (studies on certain diseases or treatments administered). To carry out these studies, it relies on two health data warehouses that the CNIL authorised it to set up. IQVIA argued that the patient data in the LRX and EMR warehouses were anonymous and that, therefore, the data protection rules were not applicable.
The investigation considered that these data were not anonymous, but only pseudonymous, as re-identification of the persons concerned was possible. The analysis took into account:
- the existence of a unique identifier;
- the depth of data collected by the company;
- the ability to identify individuals by combining data held by IQVIA with publicly available data;
- absence of measures to analyse the connection logs regularly, and
- absence of multi-factor authentication to access the data for one of the warehouses.
Finally, the company had never disputed that it was processing personal data, and that it had, in this regard, requested and obtained authorisations from the CNIL, which it had to respect.
And Finally
AI and workplace stress levels: Garante has issued a warning to an Italian startup that developed a plug-in for the corporate messaging platforms Slack and Teams. The plug-in uses artificial intelligence and semantic analysis of chats to detect the psychological stress levels of workers who voluntarily choose to use it to receive personalised suggestions. The investigation, initiated following press reports, revealed that the startup processes the data of service users as the data controller.
The employer purchasing the service cannot access the content of the analysed communications or the individual results processed by the system. However, given the particularly sensitive nature of the data processed, as well as the possibility of providing employers with aggregate reports on employee stress levels, the regulator has urged the company to adopt, from the very design stage of the service, adequate measures to prevent any risk of access, even indirect, to information relating to workers’ emotional well-being.