Keep the GDPR and AI Act maps separate
| Map | Core fields | Decision boundary |
|---|---|---|
| GDPR | Actors, personal data, purpose, legal assessment, transparency, rights, retention, security and transfers | No lawful-basis or anonymity conclusion without the facts. |
| EU AI Act | AI system, provider/deployer/importer/distributor role, intended purpose, risk category and applicable dates | No role or conformity conclusion from procurement language alone. |
| Product contract | Seller, model provider, subprocessors, terms, DPA, features, region and changes | Public terms do not replace the executed chain. |
| Workflow | Users, input, sources, output, tools, human oversight and affected people | Vendor-level approval does not approve every use. |
What EDPB Opinion 28/2024 contributes
The EDPB opinion, adopted December 17, 2024 and checked September 3, 2026, addresses questions about anonymity, legitimate interests and the effect of unlawful personal-data processing during model development on later deployment. It repeatedly depends on the circumstances and competent supervisory authority's assessment.
Do not convert the opinion into “AI models are anonymous,” “legitimate interest always applies,” or “a buyer inherits the provider's lawful basis.” Record the data, purpose, necessity, balancing, safeguards and relationship between development and deployment for counsel to assess. If the provider withholds necessary evidence, mark the field Unknown and narrow the use.
Name the parties and roles for the purchased route
A legal product can include the firm, application vendor, model provider, cloud marketplace, retrieval service, connector and client. The controller/processor analysis depends on purposes and means, not marketing labels alone. Record the contract chain and actual data path, including support and security access.
The AI Act role map is different. A firm commonly buys and uses a system, but modification, branding, integration or placing a system on the market can change the analysis. Preserve the intended purpose, modifications and provider instructions before assigning a role.
Use the official AI Act timeline
Regulation (EU) 2024/1689 is the controlling official text. The Commission's GPAI obligations page says obligations for providers of general-purpose AI models became applicable on August 2, 2025. The Commission's current GPAI guidelines page, checked September 3, 2026, explains the framework and enforcement timing, including Commission enforcement from August 2, 2026 for relevant GPAI obligations.
Those provider duties do not answer every downstream law-firm obligation. Likewise, a provider's model documentation does not establish that the firm's workflow is outside a high-risk category or that human oversight is sufficient. Classify the intended use and actor role separately.
Attach product-specific terms
For the exact route, attach the order form, DPA, service terms, subprocessor list, retention and deletion rules, region, security evidence, feature documents and change notices. Anthropic, OpenAI and Google publish different contract structures. None of these pages proves the executed position for a marketplace or embedded legal product.
Separate training use from service retention, safety access, application state and downstream copies. Separate an EU storage option from remote access and international transfer. A strong answer in one row does not close the other rows.
Minimum workflow evidence
- Name the legal task, users, affected people and decision consequence.
- Classify inputs and personal-data categories.
- Record sources, retrieval and tool destinations.
- Define human review, override and stop conditions.
- Test access, logging, deletion and error correction.
- Link unresolved GDPR and AI Act questions to named owners.
- Reassess after a material model, term, feature or purpose change.
Build the personal-data inventory at field level
List the data subjects, categories, sources and special-category or criminal-offence data that can enter prompts, files, retrieval indexes, logs and feedback. Include names or identifiers in metadata, filenames, document properties and support tickets. A workflow described as document analysis may still process personal data across several technical fields.
Record whether the information is necessary for the task and whether it can be removed, pseudonymised or replaced by controlled references. Pseudonymisation can reduce exposure but does not automatically make data anonymous. Keep the re-identification context and access to additional information in the assessment.
Keep purpose and legal assessment attached to the workflow
State the purpose in operational terms: summarize a client-supplied contract for a named matter, classify public authorities for research, or draft an internal chronology. Avoid a generic purpose such as “improve legal services” that cannot define necessity or user expectations. Identify any secondary use for provider improvement, analytics, safety, support or customer feedback.
Assign the lawful-basis and legitimate-interest analysis to qualified counsel. EDPB Opinion 28/2024 discusses a three-step legitimate-interest assessment and safeguards, but it does not select the basis for the buyer. Preserve the facts and rejected alternatives so the reasoning can be reviewed when the use or provider changes.
Design for transparency and rights before scale
Identify which notice reaches employees, clients, counterparties or other affected people and what it can accurately say about the service. Determine how the organisation can locate, correct, restrict, delete or export personal data across the application, provider, retrieval store and final record. Test the path with a non-sensitive canary.
A provider API may not expose a data-subject workflow for the customer’s own database. The customer must connect its record systems and identifiers to the request. Conversely, deleting the customer copy may not prove deletion of provider logs or legally preserved records. Record each system’s response and remaining Unknowns.
Map transfers by recipient and copy
For each recipient, record location, role, data categories, purpose, mechanism, supplementary measures and onward-transfer path. Check remote support and security access separately from primary storage. A selected EU region may constrain one processing component while a connector or customer export follows another route.
Use the executed DPA and current subprocessor list for the product, not the provider name alone. Preserve change-notice and objection rights. If the route cannot disclose enough information for the assigned assessment, restrict the data or feature rather than converting missing evidence into an assurance.
Classify the AI Act use case from intended purpose
Describe what the system does, who uses it, who is affected, what decision or action follows, and whether the output is merely preparatory or materially determines an outcome. Record the provider’s instructions and any customer modification. The model’s general-purpose label does not classify the complete downstream system.
Maintain a separate applicability and timing field for each obligation. Some AI Act provisions already apply while others follow the regulation’s staged dates and may be affected by later official guidance. Use EUR-Lex and the Commission’s current pages, record the checked date and avoid future-tense certainty where implementation detail remains open.
Request evidence the operating team can maintain
Ask for the current model and system documentation, instructions, evaluation limits, logging and incident contacts, security evidence, DPA, subprocessors, retention, data locations, change notices and exit support. Map each document to an owner and review trigger. A large policy packet without product and version identifiers is not maintainable evidence.
Close procurement with an approved-workflow card and a deeper specialist file. The route card tells users the account, permitted data, features, reviewer and stop conditions. The specialist file preserves the GDPR and AI Act reasoning, contract chain and Unknowns. This keeps day-to-day use simple without erasing the legal distinctions.
Close without a compliance shortcut
The evidence file can support counsel's assessment, vendor negotiation and a bounded approval. It cannot declare the workflow GDPR-compliant, select a lawful basis, classify every AI Act role or guarantee rights outcomes. State Observed facts, Supported inferences and Unknowns separately.
FAQ
Does a vendor DPA make a legal AI workflow GDPR compliant?
No. A DPA is one contract record. The buyer still needs roles, purpose, personal-data flow, legal assessment, transparency, rights, security, retention and transfer evidence. Official source · checked 2026-09-03
Does EDPB Opinion 28/2024 say AI models are anonymous?
No universal conclusion. The opinion describes a case-by-case assessment based on whether individuals are reasonably likely to be identified from the model. Official source · checked 2026-09-03
Are law firms always deployers under the EU AI Act?
Do not assume one role for every route. Intended purpose, modification, branding, integration and market activity can affect the role analysis. Official source · checked 2026-09-03
When did GPAI provider obligations begin to apply?
The Commission states that GPAI provider obligations became applicable on August 2, 2025; current enforcement timing should be checked against the official pages. Official source · checked 2026-09-03
Sources checked
- Opinion 28/2024 on AI models, checked 2026-09-03.
- Regulation (EU) 2024/1689, checked 2026-09-03.
- GPAI provider guidelines, checked 2026-09-03.
- General-purpose AI obligations, checked 2026-09-03.
- Commercial Terms, checked 2026-09-03.
- Services Agreement, checked 2026-09-03.
- Gemini API Terms, checked 2026-09-03.
Operational information, not legal advice. Verify current terms, account configuration and applicable professional duties before use.