AI & Data Regulations
An overview of the EU regulations most relevant to teams building and deploying AI and data-driven systems — what each one covers, who it applies to, and why it matters in practice.
EU AI Act
Regulation (EU) 2024/1689Directly regulates AI systems: risk classification, technical documentation, and transparency obligations.
GDPR
Regulation (EU) 2016/679Applies whenever training data contains personal data — which is almost always. Covers automated decision-making and data minimization.
Data Act
Regulation (EU) 2023/2854Applies when training data comes from IoT or connected devices — governs data sharing and access rights.
Cyber Resilience Act (CRA)
Regulation (EU) 2024/2847Applies once a model or AI system ships as a commercial digital product — sets cybersecurity requirements.