The AI Act and GDPR: Why Most Startups Are Already Non-Compliant

The article discusses how the EU's AI Act is merging with GDPR, creating a new regulatory reality that fundamentally changes how AI products must be built. Most current AI systems fail to meet the new compliance requirements around data lineage, explainability, consent, risk documentation, and continuous monitoring.

Details

The article explains that the EU's AI Act is no longer a future concern, but is now merging with GDPR in ways that fundamentally change how AI products must be built. Where GDPR focused on data protection, the AI Act governs how AI systems behave, decide, and impact people. Together, they create a powerful framework covering data collection, model training, decision-making transparency, risk classification, user rights, and accountability across the AI lifecycle. This means compliance is now a product design problem, not just a legal checkbox. Startups building AI-powered products like copilots, recommendation engines, automated decision systems, and generative AI may fall into high-risk categories regardless of company size, and face serious obligations around explainability, consent, risk documentation, and continuous monitoring. The article cites analysis showing that most current AI systems are already non-compliant with these new regulations.