AI: A handful of options, another full of limits

[muskanislam99]

Artificial Intelligence (AI) is transforming the way we create, decide and work.

But with the AI ​​Act (EU Regulation 2024/1689) , the European Union's message is clear: innovate, yes, but safely and with respect for fundamental rights .
Ignorance of the law is no excuse – and the fines can be brutal.

It's simple: just as we don't drive without knowing that a STOP sign requires stopping, we shouldn't use AI without knowing the minimum of the rules that are now law.

AI can be risky – and that has consequences
The AI ​​Act adopted a risk-based approach . Not everything is telegram data forbidden, but the more impact AI has on people's lives, the more requirements there are :

Unacceptable risk: AIs that manipulate behavior, mass surveillance, or social scoring systems are prohibited.
High risk: AIs used in recruitment, credit, healthcare or justice are allowed, but only with serious safeguards:
Mandatory human supervision.
Risk assessment and mitigation.
Transparency and documentation of the system.
Limited risk: Chatbots or generative AI tools need transparency. For example, informing the user that they are interacting with an AI.
Minimal risk: Spam filters or product recommendation systems require fewer rules.
Practical example:

Are you using AI to help you select candidates for a job opening? This is a high-risk system . You need human oversight and to ensure that you are not excluding profiles based on discriminatory criteria.
Do you use a chatbot for customer service? Limited risk . Just make it clear that it is a virtual assistant.
The price of error is high
Companies that fail to comply with the AI ​​Act risk fines of up to €40 million or 7% of global annual turnover – a higher amount than under the GDPR.

Practical example:
A company that uses AI in a credit assessment system, but fails to explain how the decision is made or does not allow the customer to request a review by a human , may be sanctioned.
And the “I didn’t know” argument doesn’t work. Anyone using AI is responsible for ensuring that it complies with the law.

Personal data and AI: less is more
If your AI works with personal data, the GDPR still applies – and there is one principle you should always keep in mind: data minimization (Article 5, paragraph 1, letter c)).

It means that you should only collect and process the data that is strictly necessary for the purpose you want.
AI may give the impression that “the more data, the better,” but this is legally dangerous .

Practical example:

You are training an algorithm to personalize offers to customers and collect addresses, CNPJ, gender, health data and even information about religion.
Problem: Much of this data is not necessary to personalize offers and some is sensitive data (religion, health) that requires very specific legal bases.