AI Act – Artificial Intelligence Regulation establishes harmonised rules for the development, deployment and use of artificial intelligence systems in the European Union. It introduces a risk-based regulatory framework, transparency obligations and specific requirements for high-risk and general-purpose AI models.

How will artificial intelligence (AI) be regulated according to the AI Act? What solutions does the AI Act bring? And what can we expect from the future of artificial intelligence?

1. AI ACT is Here!

On March 13, 2024, the EU ADOPTED the AI Act (effective from May). This act is the first legal act in the world to regulate the field of artificial intelligence (hereinafter: AI) in a binding manner, with the aim of advancing society while respecting rights and ensuring individual safety.

With the AI Act, after taking a stance on the ethical principles guiding this technology, we have moved into the phase of regulation, transforming ethical principles into principles and creating concrete rules.

The AI Act is based on the digital space of the AI ​​ecosystem on three pillars:

1. Transparency and accountability;
2. Innovative development;
3. RISK LEVEL system.

The AI Act has decided to regulate the field of AI ​​by establishing a system of different RISK LEVELS for society and individual rights. Therefore, first, this act categorizes all AI applications according to the level of risk, and then classifies different manifestations of AI according to functionalities into given categories. The AI systems envisaged by the AI Act are as follows:

1. UNACCEPTABLE risk – These are AI practices considered too harmful to be allowed, such as those that manipulate people’s behavior to their detriment (deceptive techniques for distorting behavior and obstructing informed decision-making) or systems that unfairly categorize individuals (social scoring), and even real-time facial recognition software in public places – These are prohibited;
2. HIGH risk – This category is divided into two subcategories: Safety component systems (toys, medical devices) and systems for sensitive use (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, judiciary). Therefore, this category includes AI systems that could significantly impact people’s safety or fundamental rights. – Strict compliance and security assessment of these systems are required, along with monitoring, data management, record-keeping, cybersecurity, incident reporting systems, etc. (serious penalties will follow violations here);
3. LIMITED risk – AI systems that directly interact with users, such as chatbots. – They must be transparent about being operated by AI so that users are aware they are not communicating with humans.;
4. MINIMAL risk – Most AI applications fall into this category, where innovation freedom is maintained with minimal regulatory intervention. These are systems that represent a negligible risk to individuals’ rights or safety. – They can be used with minimal supervision.

2. Artificial Intelligence – DEMYSTIFICATION

Artificial intelligence is not intelligence because it lacks many components and characteristics possessed by human intelligence. One of the components that has been developed is memory, or storage, due to LLM technology and big data.

Actually, here’s the AI formula:

LLM + Big data + Probabilities = AI

The technology processes a large amount of data and then, through mathematical calculations, determines the highest probability of how to form a sentence to a specific question, or what the next word in the sequence is.

Due to the volume of data it is capable of processing, AI often has a deeper understanding of data than humans, and its responses appear very eloquent. However, when asked about a topic where there is not enough literature, it may start to “hallucinate”, i.e., add and invent data just to say something (lie).

However, AI is not just what we see, chatbots. AI is divided into two large groups, according to functionality:

1. Generative AI;
2. AI for process automation and decision making.

Although generative AI is more familiar to the average person, especially with the events from December 2022, regulation is more focused on AI for process automation and decision making. This second category is much more dangerous to our rights.

3. What Does This Change for the Individual?

The GOAL of every technology is to improve society, for individuals to feel the benefits of technology. However, it often happens that only large companies benefit. This act limits companies, setting some regulations for them to reduce the risk of violating individuals’ personal rights.

First and foremost, it will be transparent and clear for individuals when interacting with AI. Content called deepfake will have to be marked, and people will be informed when interacting with a chatbot or other AI system. Efforts are made to reduce the possibility of manipulation.

Addition: This is not part of the AI Act, but there are tendencies to reduce the workweek to four days, or 32 hours, as conglomerates have significantly benefited from productivity, while on the other hand, they are laying off employees. This would create a slightly better balance in industries where AI reduces the workload for people while multiplying productivity.

4. What Does AI Act Change for Companies?

Companies developing AI systems must comply with rules, primarily transparency. A larger number of systems will not need to comply with the AI Act because they do not fall into risky groups. Still, all companies will have to meet minimum requirements. In moments of collision between the AI Act and GDPR, companies will have to be careful, as before, about personal data and comply with this regulation.

Companies developing AI-based systems must follow MIM5 (Minimal Interoperability Mechanisms 5 – Fair AI) as well as all technical cybersecurity measures of the NIS2 cybersecurity directive.

Companies face serious PENALTIES:

• €35 million or 7% of global annual turnover – For using prohibited systems;
• €15 million or 3% of global annual turnover – For failing to conduct adequate risk assessment.

In addition to all the above, companies’ awareness exists, and according to some research, 96% of organizations developing and using AI support some level of AI regulation. In contrast, only 2% of organizations develop and fully operationalize responsible AI. – RESPONSIBLE AI involves taking deliberate actions to design, deploy, and use AI to create value and build trust by protecting users, fellow citizens, society, from potential AI risks.

5. What Are the Next Steps?

It is necessary to establish REGULATORY BODIES, both at the EU level and in individual countries. These regulatory bodies would be obliged to provide assistance in the implementation of the AI Act and to supervise its application.

Companies will have a 36-month period to comply with the law. Different timeframes are provided for different risk categories, in fact (6 months for prohibited systems, 12 months, 24 months, and 36 months).

Fair AI is a concept that should encompass the idea that AI must be fair, responsible, inclusive, and respectful.

6. AI Act Contents:

1. Preamble (extensive);
2. CONTENTS: I General provisions; II Prohibited AI practices; III AI systems of high risk; IV Transparency obligations for AI system providers; VIIIa General-purpose AI models; V Measures to support innovation; VI Management; VII EU database for high-risk AI systems from Annex III; VIII Post-market monitoring, information sharing, and market surveillance; IX Code of conduct; X Confidentiality and penalties; XI Delegated powers and procedures of bodies; XII Final provisions.
3. Annexes.

7. Instead of Conclusion

As we enter a new era of AI governance, and the AI Act represents a crucial intersection of technology, law, and ethics. This act offers a blueprint for balancing innovation and accountability, setting a global standard for AI legislation. The role of data spaces in this new regulatory environment will be crucial in shaping the future of AI in Europe and beyond.

The AI Act is a legal act by which Europe first seriously regulates AI, as we said at the beginning. This has double implications. On the one hand, Europe is a leader in AI regulation and guarantees its citizens a high level of rights, while on the other hand, companies developing AI systems represent a multi-billion dollar business, and overregulation and strict rules can affect their development, competitiveness in the global market, or even company relocation. The AI Act hovers between free innovation and regulation of innovation.

We will see when Serbia will establish a working group to draft the Artificial Intelligence Act, but we know that due to business relations between our companies and companies in the EU, the law should be in line with this legal act. This is the main reason why we are interested in this legal act here.

Soon, we can expect the AI Convention of the Council of Europe, which legal act will address the relationship between human rights and technology, and within the Council of Europe, Serbia is a member, which additionally interests us.

NOTE: This text does not replace the engagement of a legal expert in the field of IT law or AI law for aligning your business, or a lawyer in case of a legal proceeding. This text is the author’s opinion on the given topic and an invitation to further elaboration of concepts from the AI Act and further discussion on this topic. The author is willing to accept any form of communication via any channel for better mutual understanding of this area.

Icoolaw

Text author: Denis Tul (lawit.rs)

<p>The post AI Act – Artificial Intelligence Regulation first appeared on .</p>

What is GDPR and why should you care? GDPR, or the General Data Protection Regulation, is the main European Union framework governing the protection and processing of personal data.

It became applicable on 25 May 2018 and strengthened the rights of individuals while introducing clear responsibilities for organisations that collect, use, store, share, or otherwise process personal data.

GDPR matters because personal data is processed almost every day. It may include a person’s name, contact information, identification details, location data, online identifiers, financial information, health information, or other data that can identify an individual directly or indirectly.

The Regulation applies not only to many organisations established in the European Union but also, in certain circumstances, to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour. Data protection is recognised as a fundamental right under EU law.

Why is GDPR important for individuals?

GDPR gives individuals greater control over how organisations use their personal data. Organisations must process data lawfully, fairly, and transparently and should collect only the data necessary for a clearly defined purpose.

People also have the right to receive understandable information about the processing of their data. This includes information about why the data is collected, how it will be used, how long it may be kept, and with whom it may be shared.

Right of access

Individuals may ask an organisation whether their personal data is being processed and request access to that data together with relevant information about the processing.

Right to rectification

When personal data is inaccurate or incomplete, an individual may request that the organisation correct or complete it.

Right to erasure

The right to erasure is often called the “right to be forgotten.” Under certain conditions, individuals may request the deletion of their personal data.

This right is not absolute. An organisation may sometimes need to keep the data because of a legal obligation, public interest, or the establishment, exercise, or defence of legal claims.

Right to restriction of processing

Individuals may request that the use of their data be restricted in certain situations. The organisation may then retain the data but may be limited in how it can continue to process it.

Right to data portability

In applicable circumstances, individuals may receive personal data they provided in a structured, commonly used, and machine-readable format. They may also request that the data be transmitted to another organisation where technically feasible.

Right to object

An individual may object to certain processing, including processing based on legitimate interests and processing for direct marketing purposes.

GDPR also establishes protections relating to decisions based solely on automated processing when those decisions produce legal or similarly significant effects.

What obligations does GDPR impose on organisations?

Organisations must be able to demonstrate that their personal-data processing complies with GDPR. Compliance therefore involves more than simply publishing a privacy policy.

A lawful basis for processing

A common misconception is that companies always need consent to process personal data. Consent is only one possible lawful basis.

Depending on the circumstances, processing may also be based on:

• performance of a contract;
• compliance with a legal obligation;
• protection of vital interests;
• performance of a task in the public interest;
• legitimate interests pursued by the controller or a third party.

Where consent is used, it must meet GDPR requirements and must be freely given, specific, informed, and unambiguous.

Transparency and clear information

Organisations must explain their processing activities in a concise, accessible, and understandable manner. Privacy notices should clearly state the purpose of processing, the relevant lawful basis, retention periods, recipients of data, and the rights available to individuals.

Data minimisation and purpose limitation

An organisation should collect only the data that is relevant and necessary for its stated purpose. Personal data should not be gathered simply because it may become useful at some point in the future.

The data should also not be reused for an incompatible purpose without an appropriate legal basis.

Security measures

Controllers and processors must implement appropriate technical and organisational measures to protect personal data.

Depending on the risks, these measures may include:

• access controls;
• encryption;
• secure backups;
• staff training;
• internal policies;
• incident-response procedures;
• regular security testing;
• clear responsibilities for handling personal data.

The appropriate level of security depends on factors such as the type of data, the purpose of processing, the likelihood of misuse, and the possible consequences for individuals.

When must a Data Protection Officer be appointed?

Not every organisation is required to appoint a Data Protection Officer.

A DPO is required in certain circumstances, including where the core activities involve regular and systematic large-scale monitoring or large-scale processing of special categories of personal data. Public authorities and bodies are also generally required to appoint one, subject to the rules of the Regulation.

The DPO advises the organisation on compliance, monitors relevant practices, supports awareness and training, and cooperates with the supervisory authority.

What happens when a personal data breach occurs?

A personal data breach may involve accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

Where a breach is likely to result in a risk to individuals’ rights and freedoms, the controller must generally notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of it.

Where the breach is likely to result in a high risk to individuals, the affected people may also need to be informed without undue delay.

Not every security incident requires notification, but organisations should assess and document breaches carefully.

Why should businesses care about GDPR?

The answer to what is GDPR and why should you care is not limited to the risk of regulatory sanctions. Effective compliance can improve the way an organisation manages information and communicates with clients, employees, and business partners.

Greater customer trust

People are more likely to trust an organisation that clearly explains how it uses their data and responds properly to privacy requests.

Improved data security

GDPR compliance encourages organisations to identify what data they hold, who can access it, why it is retained, and how it is protected.

This can reduce the likelihood and impact of data loss, unauthorised access, and misuse.

Better internal organisation

Maintaining records of processing activities and assigning responsibilities can help organisations remove unnecessary information, improve procedures, and react more efficiently to incidents.

Reduced legal and financial risk

Non-compliance may lead to investigations, corrective measures, reputational damage, compensation claims, and administrative fines.

A structured compliance programme can reduce these risks and help an organisation demonstrate accountability.

Competitive advantage

Organisations that treat privacy as part of their service quality may distinguish themselves from competitors, especially when working with clients and partners that require strong data-protection standards.

Does GDPR apply only to large companies?

GDPR does not apply only to multinational corporations. Small and medium-sized businesses, associations, professional practices, online services, public bodies, and other organisations may also fall within its scope.

The exact obligations depend on the processing activities and risks involved. A small organisation may not need the same compliance structure as a large technology company, but it must still understand what personal data it processes and comply with the relevant rules.

The European Data Protection Board provides practical GDPR guidance designed specifically for small and medium-sized organisations.

Why GDPR knowledge matters for legal professionals

Lawyers increasingly advise clients on privacy notices, employment data, marketing activities, contracts with processors, international data transfers, cybersecurity incidents, and the use of artificial intelligence.

Understanding GDPR is therefore important not only for data-protection specialists but also for lawyers working in corporate law, employment law, litigation, technology, compliance, banking, healthcare, and public administration.

Knowing how to identify lawful bases, allocate controller and processor responsibilities, respond to individual requests, and assess potential breaches is becoming an essential part of modern legal practice.

GDPR and the International Congress of Lawyers

The International Congress of Lawyers will address data protection, artificial intelligence, cybersecurity, and other legal challenges connected with modern technology.

Through lectures, panels, discussions, and professional networking, participants will have an opportunity to examine how GDPR operates in practice and how legal professionals and organisations can respond to regulatory and technological developments.

Understanding what is GDPR and why should you care is the first step. The next step is learning how its principles and obligations apply to real situations involving employees, clients, online platforms, business partners, and new technologies.iding you with detailed knowledge and tools needed for compliance with these regulations.

<p>The post What is GDPR and Why Should You Care? first appeared on .</p>

There comes a point in every lawyer’s professional development when formal education, knowledge of legal amendments, and familiarity with legal interpretations are no longer enough.

Changes in society, technology, and the legal services market require lawyers to continuously improve their knowledge, understand emerging trends, and adapt their professional practice. At the same time, legal professionals need to build relationships with colleagues, companies, institutions, and potential clients.

This is why many lawyers ask an important question: how to achieve business collaboration at a conference?

The answer lies in active participation, professional networking, direct communication, and the ability to recognize opportunities for long-term cooperation.

Books, professional articles, and online resources remain important sources of knowledge. However, they cannot fully replace personal contact, direct exchange of experience, and conversations with people who face similar professional challenges.

Why are conferences important for business collaboration?

Professional conferences bring together people from different legal fields, institutions, companies, and countries. Participants have an opportunity to exchange experiences, discuss current legal issues, and establish contacts that may later develop into concrete business relationships.

For lawyers, conferences can provide much more than education. They can help them:

• meet potential collaborators;
• connect with lawyers from other jurisdictions;
• establish contact with company representatives;
• exchange referrals;
• present their areas of expertise;
• discuss possible joint projects;
• expand their professional network;
• gain new clients or business partners.

A single conversation may lead to a future referral, joint representation, professional cooperation, participation in a project, or long-term business collaboration.

How to prepare for networking at a conference

Business cooperation rarely happens by chance. Participants who prepare in advance usually have a greater chance of creating meaningful professional relationships.

Before attending a conference, it is useful to review the programme, speakers, sponsors, participating organisations, and networking opportunities. This makes it easier to identify the people with whom a conversation could be professionally relevant.

It is also important to prepare a brief and clear introduction. A lawyer should be able to explain:

• who they are;
• which legal field they work in;
• what type of clients they represent;
• which professional services they provide;
• what kind of cooperation they are looking for.

The purpose is not to deliver a sales presentation. The goal is to start a natural and professional conversation that can continue after the event.

The importance of B2B meetings

One of the most effective answers to the question of how to achieve business collaboration at a conference is through organised B2B meetings.

B2B meetings enable participants to communicate directly with lawyers, company representatives, institutional leaders, and potential business partners. These are people who may be difficult to reach through traditional communication channels such as emails, telephone calls, or formal letters.

A structured meeting creates space for participants to:

• introduce their work;
• discuss shared professional interests;
• identify possible areas of cooperation;
• exchange contact information;
• agree on the next steps after the conference.

The organisational team of the International Congress of Lawyers recognises the importance of these meetings and creates opportunities for participants to communicate in a professional but relaxed environment.

Why direct communication creates better opportunities

Emails are often unanswered, telephone calls may be postponed, and formal proposals may not reach the right person. A face-to-face meeting can create trust much faster.

Direct communication allows both parties to understand each other’s professional background, expectations, and potential contribution to future cooperation.

During a conference, conversations are also more natural because participants are already gathered around common topics and professional interests. This creates a better environment for discussing collaboration than an unsolicited business message sent without previous contact.

From conference contact to business cooperation

Meeting someone at a conference is only the first step. The relationship must be maintained after the event.

A follow-up message should be sent shortly after the conference. It can include a reminder of the conversation, a short proposal for further communication, or relevant information connected with the topic discussed during the meeting.

The message should be personal and specific. Generic messages sent to a large number of participants are less effective than a direct reference to the conversation.

Professional cooperation often develops gradually. A contact made at a conference may lead to a meeting several weeks later and to concrete cooperation several months after the event.

A participant’s experience with B2B meetings

One participant of a previous International Congress of Lawyers met the director of a company’s legal department during an organised B2B meeting. Several months later, that first conversation developed into an official business collaboration.

The participant explained that the opportunity was especially important because they were at the beginning of their professional career. The meeting gave them access to a potential collaborator they would probably not have reached through ordinary communication channels.

This experience shows that conferences can create real and measurable professional opportunities when participants actively use the networking formats available to them.

How to achieve business collaboration at a conference successfully

To improve the chances of establishing cooperation, it is important to approach networking professionally and naturally.

Participants should focus on creating genuine relationships instead of immediately asking for work. A good conversation begins with shared interests, legal topics, professional experiences, and possible common challenges.

It is also important to listen. Successful networking does not consist only of presenting your own services. It requires understanding the other person’s needs and recognising whether there is a realistic basis for cooperation.

After the event, professional consistency is essential. Sending a message, arranging a follow-up meeting, and maintaining occasional communication can turn an initial contact into a long-term professional relationship.

International Congress of Lawyers 2027

The International Congress of Lawyers combines education, professional development, networking, cultural activities, and opportunities for business cooperation.

Through lectures, panels, informal gatherings, and organised B2B meetings, participants can meet lawyers, institutional representatives, company leaders, experts, and potential collaborators from different countries.

The next International Congress of Lawyers will take place in 2027. More information about the programme, registration, speakers, and business networking opportunities will be published on the official congress channels.

Every professional opportunity can create valuable results. The most important step is to recognise the opportunity and use it actively.

For lawyers who want to expand their professional network, meet potential collaborators, and develop international business relationships, the International Congress of Lawyers provides an environment in which meaningful cooperation can begin.

<p>The post How to Achieve Business Collaboration at a Conference? first appeared on .</p>