First a curiosity: The GDPR does not mention the word "AI" even once. No "artificial", no "intelligent", no "algorithm". And yet - as is so often the case with legal texts - it is precisely in the embrace of the unsaid that things get down to business.
Article 22 GDPR, also known as the right to human intervention intervention, already imposes considerable obligations on companies as soon as automated decisions are made that have legal effect.
Practical relevance: The BfDI already has a special questionnaire on AI use that helps companies to evaluate their systems. helps them. It provides specific information on how AI processes can be implemented in compliance with the GDPR - including including recommendations on documentation, transparency and technical safeguards.
It's worth taking a look at this list of questions - not just for data protection officers with with a coffee stain on their shirt, but for every specialist department with access to data.
Image source: K11 Consulting GmbH | Description: K11 Consulting AI governance expert analyzes data precision - from spice jars to AI-supported GDPR compliance.
Anyone who introduces AI systems not only gets free innovation, but also often unintentionally a kind of digital mole in the data protection habitat.
Image source: K11 Consulting GmbH | Description: K11 Consulting Team workshop - Strategies for AI integration and GDPR-compliant data processes.
The GDPR is not a brake on innovation - rather a brake parachute with a built-in airbag. airbag.
Internal reading tip: AI Officer as a service
Image source: K11 Consulting GmbH | Description: K11 Consulting Expert panel - Practical advice on AI strategies and GDPR compliance for companies.
The GDPR protects personal data. The EU AI Act, on the other hand, regulates the behavior of the AI itself...
To the official AI Act Overview
Image source: K11 Consulting GmbH | Description: K11 Consulting Training - Practical examples of secure AI use and GDPR-compliant data processing.
Image source: K11 Consulting GmbH | Description: K11 Consulting Presentation - Data protection and AI explained in an understandable way - for legally compliant business processes.
The good news first: there is no law that prohibits "AI in companies" per se. The bad news is that there is also no law that simply allows it. If you want to use AI in compliance with the GDPR you have to do the right thing - and be able to prove it. Not a gut feeling, not a a gut feeling or a statement of intent, but structured processes, responsibilities and transparency.
Or, to put it with a wink: trust is good, data protection is obligatory.