Ethics and law: the AI Act, GDPR and copyright

Three ideas at a meeting

The school parents' association met and three ideas came out:

1. Use an AI to choose the students who get the association's scholarship.
2. Put an assistant on the website that answers families in the president's voice, imitated by the AI.
3. Sell t-shirts with a design made by AI at the end-of-year party.

All of them sound good. All of them touch the law. In this lesson you see the essentials of the three laws and when to stop and ask.

This is not legal advice. For a specific case, talk to a lawyer.

The AI Act: the European law on AI

Regulation (EU) 2024/1689, known as the AI Act, is the European Union's law for artificial intelligence (official text on EUR-Lex). It applies in phases and organises the rules by risk: the more an AI can harm people, the more rules. It does not apply to someone who uses AI in a purely personal activity, outside work.

Prohibited practices. Since 2 February 2025 some uses are banned in the European Union. Among them:

• manipulating people with hidden techniques, in a way that causes them serious harm;
• taking advantage of someone's vulnerability because of their age, a disability or their economic situation;
• giving people a "social score" for their behaviour, with unfair consequences;
• recognising the emotions of workers or students, at work or at school, except for medical or safety reasons.

High risk. In areas such as employment, education, credit, access to benefits and essential public services, or justice, AI can change someone's life. There, the obligations are heavy; all you need to know is that they exist. If your idea falls in one of these areas, stop and ask before going ahead.

Transparency. Article 50 requires telling people that they are talking to an AI, when that is not obvious, and marking deepfakes: images, sounds or videos that imitate real people or events. These rules have applied since 2 August 2026. Regulation (EU) 2026/1744 did not change this date; it only gave systems placed on the market before 2 August 2026 until 2 December 2026 to meet the automatic marking of paragraph 2, and postponed nothing else. Paragraphs 1 and 2 (saying it is an AI, marking generated content) fall on whoever provides the system; paragraphs 3 and 4 (flagging deepfakes and AI-generated text on matters of public interest) fall on whoever uses it. If you are the one putting an assistant in front of customers, confirm with the provider who meets what.

Official sources: Regulation (EU) 2024/1689, on EUR-Lex, Regulation (EU) 2026/1744, on EUR-Lex Article 50 on the European Commission's AI Act service desk and the Commission's FAQ on Article 50.

Literacy. Article 4, as worded by Regulation (EU) 2026/1744 (in force since 27 July 2026), asks companies and organisations to take measures to promote AI literacy. You saw this in lesson 2.

The GDPR: people's data

Regulation (EU) 2016/679, the GDPR, has applied since 25 May 2018. With AI, remember four things:

• Legal basis. To process personal data you need a reason set out in Article 6: the person's consent, a contract with them, a legal obligation, among others. "It would be handy" is not one of them.
• Other people's data. When you paste a customer's email or a student's record into the AI, you hand someone else's data to one more service. Remove names, contacts and numbers whenever the task allows it.
• Decisions by the machine alone. Article 22 gives people, as a rule, the right not to be subject to decisions taken only by automated means that significantly affect them.
• People's rights. Anyone can ask for access to the data you hold about them (Article 15) and ask you to erase it (Article 17). As a rule, you have one month to reply.

In Portugal, the body that supervises and receives complaints is the CNPD, the Comissão Nacional de Protecção de Dados (cnpd.pt). That is if you are in Portugal; elsewhere use your country's equivalent.

And with your own data? Many AI assistants have, in the settings, options to export your data and to delete the account. This is how it looks on 6 October 2026; your screen may differ. Look for the button with the same name.

Copyright

• As a rule, what the AI produces on its own is not a protected work of yours: the law protects human creations. There is no automatic proportion: what counts is the existence of an original, creative human contribution, decided case by case (the Court of Justice of the EU set this criterion in the Infopaq judgment, C‑5/08). Keeping what you asked for, chose and rewrote helps you show it.
• The use of books, news, music and images to train models is being argued in court, in Europe and in the United States. Not all cases have been decided.
• The AI Act requires those who provide the big general-purpose models to have a policy of respect for copyright and to publish a summary of the content used in training.

In practice: use what the AI makes as a draft and review it. Before printing a design on a t-shirt, check that it does not look like a character, a logo or the work of a well-known artist. If the value at stake is high, talk to a professional.

Bias: the AI repeats the world it read

Ask an image generator for a "portrait of a person who works in medicine" and then a "portrait of a person who works in nursing". It is common to get a man in the first and a woman in the second. The AI learned from images and texts of the world and repeats the imbalances it found there. In Portuguese, "um médico" and "uma enfermeira" already carry the gender in the request; to test this, use neutral words.

Exercise: the three ideas

I am on the board of a parents' association in Portugal. We have this idea: [describe the idea]. Make a list of the questions we must answer before going ahead, in the light of the AI Act (Regulation (EU) 2024/1689), the GDPR and copyright law. For each question, give the rule or article concerned; if you are not sure of the article, say you are not. Do not say whether it is legal or illegal: I want questions to take to a lawyer.