Artificial Intelligence (AI) is rapidly transforming processes, products, and decision-making structures — including those related to data protection. Businesses and organizations face a dual challenge: on one hand, they need to develop AI applications that are efficient and innovative; on the other hand, they must comply with the requirements of the General Data Protection Regulation (GDPR) and other national and European data protection laws.

• One of the most critical aspects is the handling of personal data. Many AI systems — especially in the area of machine learning — require large datasets to be trained and used effectively. In practice, this often means using data from customers, users, or employees in training sets where it is analyzed, processed, and sometimes even altered or recombined. This introduces legal risks — for example, in meeting transparency requirements, purpose limitation, or fulfilling data subject rights such as access, erasure, or objection.
• Additionally, AI systems often make autonomous decisions or significantly influence them — such as in credit scoring, recruitment, or marketing. In many such cases, Article 22 of the GDPR applies, which governs automated decision-making in individual cases. Businesses must ensure that individuals can understand how decisions are made — and that they have the ability to contest them. This is especially challenging with modern AI models, particularly generative systems or deep neural networks, which are often difficult to interpret and legally contentious.
• Data protection-compliant AI, therefore, does not only require technically secure systems — it also demands a fundamental understanding of how data is used, processed, and explained. Only then can risks be minimized and trust established among users, customers, and supervisory authorities.