You’re shipping an AI product in the European Union. Data provenance, the claims you make and the contracts you sign this quarter set your exposure.
Information, not advice
This page is information, not legal advice about your matter. A retainer begins only when a lawyer confirms it.
Start here
Write down what your model is trained on, and what you say it can do
Those two facts decide where you sit under the EU AI Act and what GDPR requires of you. They are cheap to pin down now and expensive to reconstruct later.
What to work through, in order
Data provenance
GDPR governs any personal data in training material, and the AI Act adds training data governance duties for high-risk systems. The text and data mining exceptions in the DSM Directive are subject to rightsholder opt-out.
Claims about the system
The AI Act adds transparency duties including disclosure when users interact with an AI system, and unfair commercial practices rules reach capability claims.
Contracts and liability
The revised Product Liability Directive brings software and AI within its scope, and the unfair terms regime limits what can be excluded in consumer contracts.
Next steps
What happens if you go ahead
Scoping call
Written scope and fixed-fee quote
Engagement, once a lawyer confirms
Who would handle it
Offices
London
25 Southampton Buildings, London WC2A 1AL