The rise of generative AI in the business environment
The emergence of generative AI in the business environment has undoubtedly been one of the most significant developments in recent years. Tools such as ChatGPT, Copilot and similar solutions have rapidly become part of the daily operations of many organisations, delivering improvements in efficiency, productivity and analytical capabilities.
However, this rapid adoption raises a key legal question: is generative AI being used within an appropriate data protection compliance framework?
In many cases, the adoption of these tools has outpaced the development of internal AI usage policies and control mechanisms. Their use has become commonplace in everyday tasks, making it necessary to address this reality from a more structured perspective, focused on regulatory compliance and risk management.
Data protection risks associated with generative AI
The use of generative AI tools may, in certain circumstances, involve the processing of personal data, even when this is not immediately apparent.
Entering information into prompts may involve client data, internal information relating to individuals or documents containing identifiable information, creating significant risks regarding information control.
There is also the potential loss of control over such data once it has been entered into the tool, particularly when external providers are involved and their infrastructure and data processing conditions are not always fully understood.
Additional implications may arise in relation to third-party access, the potential reuse of information for model training or international data transfers.
Consequently, the use of these tools cannot be considered neutral from a data protection perspective and must instead be assessed as potential data processing activities with significant legal implications.
Application of the GDPR to the use of artificial intelligence
From a legal perspective, these uses must be assessed in light of the General Data Protection Regulation (GDPR), which is fully applicable in these contexts.
The first step is to determine whether personal data is being processed and, if so, to identify the appropriate lawful basis for processing, which is not always straightforward in seemingly harmless or indirect uses.
The fundamental principles of the GDPR are particularly relevant to this assessment:
- Data minimisation principle, which requires that the information processed be adequate, relevant and limited to what is necessary.
- Purpose limitation, which requires ensuring that the use of data is compatible with the purpose for which it was collected.
- Security of processing, in accordance with Article 32 of the GDPR, which requires the implementation of technical and organisational measures appropriate to the level of risk.
Another particularly relevant aspect is the correct classification of the AI tool provider, which may act as a data processor or an independent data controller depending on the circumstances, with direct implications for contractual arrangements and the allocation of responsibilities.
The potential existence of international data transfers must also be assessed, particularly when providers are located outside the European Economic Area.
AI Act and AI governance in organisations
This regulatory framework is complemented by the recent Artificial Intelligence Act (AI Act), which introduces new obligations depending on the risk level of the systems used.
Although this legislation does not replace the GDPR, it reinforces the need for organisations to adopt a more structured approach to AI use, incorporating principles of control, traceability and risk management.
Both regulations should be understood as complementary, establishing a more demanding regulatory environment that requires greater maturity in data governance.
How to integrate generative AI securely and in compliance with regulations
In this context, the main challenge for companies is not so much to restrict the use of generative AI as to integrate it appropriately into their existing control frameworks.
The speed of adoption has meant that, in many cases, these tools have been used in a decentralised manner, without consistent criteria or sufficient oversight from compliance departments.
The natural next step is to move towards a model in which the organisation clearly defines which tools may be used, under what conditions and according to which criteria.
This shift in approach must translate into specific measures that provide legal certainty when using these technologies:
- Establishing an internal AI usage policy that sets clear and consistent criteria across the organisation.
- Prior assessment and approval of tools, involving legal, compliance and technology departments.
- Employee training and awareness as a key element in mitigating operational risks.
- Risk assessments, including data protection impact assessments where appropriate.
Data protection and artificial intelligence advisory services
Generative AI represents an undeniable opportunity for organisations, but its adoption cannot be separated from existing data protection obligations.
The real differentiating factor lies not simply in using these tools, but in doing so in a controlled, secure and legally compliant manner.
In this context, access to specialist data protection advice is essential to adequately address the challenges arising from the use of artificial intelligence.
At Baker Tilly, our specialised data protection team supports organisations in defining and implementing AI usage frameworks that comply with Regulation (EU) 2016/679 and the wider applicable regulatory framework.
Related content
