EU AI Act
-
In the previous chapter we treated the right to explanation as the tool that opens the black box. But once the box is opened, the next question is usually not technical. It is moral and legal: who is being harmed, and along what lines? That is where algorithmic discrimination enters. Artificial intelligence does not invent…
-
Start with the most practical question a lawyer in this field faces. Your client has received a decision — a visa denial, a detention order, a rejected job application, a loan refusal. An algorithm was involved. You know it was involved because someone told you, or because you found evidence of it, or because the…
-
There is a question that comes up every time a lawyer working in AI governance explains the field to a colleague who has not yet encountered it: if European law and American law are so structurally different in how they regulate AI, why do the arguments look so similar in court? The AI Act and…
-
Every major regulatory shift in American law has a geography. Environmental regulation found its early laboratory in California. Consumer financial protection found it in the state attorneys general offices before Congress acted. Data privacy is finding it again in California — and now, for artificial intelligence, the leading jurisdiction is New York. This is not…
-
In the previous chapters we built the operational and regulatory layers of European AI governance. The GDPR protects the individual’s data rights. The AI Act regulates the system itself. ISO 42001 translates those legal obligations into the management processes that organizations can implement, audit, and prove. Together they form a coherent compliance architecture — but…
-
In the previous chapter we established the compliance architecture of the EU AI Act — the risk pyramid, the prohibited practices, the mandatory obligations for high-risk systems, the transparency and human oversight requirements. We ended with a new standard of care: lawyers advising on AI systems must now understand not just the outcome of a…
-
In the previous chapter we established that the GDPR is the constitutional shield of the European digital order — the law that protects individuals against algorithmic decisions before any AI-specific regulation existed. The AI Act builds on top of that shield. It does not replace it, and it was never designed to. What it does…
-
In the previous chapter we ended with a mention of GDPR Article 22 — the right not to be subject to solely automated decisions — as a law that existed before the AI Act but primarily empowered individuals after harm had already occurred. That observation was deliberate. Because before we can understand what the AI…
-
Every major technological revolution follows the same legal trajectory. First comes innovation. Then mass adoption. Then harm. Only after the harm becomes undeniable does regulation arrive. Artificial intelligence followed that pattern with precision. Before the EU AI Act entered into force — and before governance frameworks such as the NIST AI Risk Management Framework were…
-
In the previous chapter we built the vocabulary. We defined algorithms, machine learning, and the blackbox. We established something uncomfortable but unavoidable: opacity is not a defect in many AI systems. It is how they work. Modern machine learning models operate through statistical correlations across enormous datasets. Their outputs can be measured. Their performance can…