Compliant by construction.
GDPR and EU AI Act requirements engineered into your AI systems from the first commit: data residency, personal-data handling, logging, human oversight and the documents your DPO needs.
Not a checkbox at the end.
Most teams add compliance last: consent flows retrofitted, pipelines anonymised in a hurry, documents written the week before a deadline. It is expensive, fragile and rarely complete.
We treat regulatory requirements as inputs to the design. Data flows are classified before the first line of code, residency is set at the infrastructure layer, and every pipeline writes an audit trail. Whether it is a chatbot that must say it is AI, a document pipeline handling personal data or a high-risk system heading for conformity assessment, the controls are part of the architecture, so they cannot be bypassed by accident.
HASORIX provides engineering, not legal advice. For legal opinions, DPO services or certification, work with qualified counsel in your jurisdiction. We are glad to work alongside them.
What applies, and when.
Prohibitions, general-purpose AI rules and Article 50 transparency already apply. Two further prohibitions apply from 2 December 2026, and high-risk obligations from 2 December 2027 and 2 August 2028.
- Prohibited AI practices banned
- General-purpose AI model obligations
- Transparency: chatbots, synthetic content, deepfakes
- New prohibitions: non-consensual intimate deepfakes and child sexual abuse material
- Content marking for systems already on the market
- High-risk systems: HR, credit, insurance, education and more
- High-risk AI in regulated products
Source: Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.
The rules, in engineering terms.
GDPR and AI systems
GDPR has applied since 2018. For AI it becomes a set of engineering constraints. Only the personal data you need enters the pipeline. Data collected for one purpose is not reused to train a model without its own lawful basis. Erasure has to reach every copy, including vector databases, embeddings and fine-tuned models.
A compliant system is not one with the right policies on paper. It is one whose architecture prevents non-compliant data flows: personal data removed before LLM calls, EU hosting, encryption at every layer and an audit log of every access.
The EU AI Act today
Regulation (EU) 2024/1689 sorts AI systems by risk. Prohibited practices have been banned since 2 February 2025, and obligations for general-purpose AI models have applied since 2 August 2025. Two further prohibitions, on non-consensual intimate deepfakes and on child sexual abuse material, apply from 2 December 2026.
Article 50 transparency has applied since 2 August 2026. People must be told when they are dealing with an AI system, and synthetic content must be marked in a machine-readable way. For systems already on the market before that date, the Article 50(2) marking duty applies from 2 December 2026.
The Digital Omnibus on AI, Regulation (EU) 2026/1744, set the high-risk dates: 2 December 2027 for the Annex III areas, such as employment, credit scoring and life and health insurance pricing, and 2 August 2028 for AI in products covered by Annex I, such as medical devices and machinery. High-risk systems need risk management, data governance, technical documentation, automatic logging, human oversight and a conformity assessment. Our AI Act checklist breaks this down for developers.
Penalties
| Infringement | Maximum fine |
|---|---|
| Prohibited AI practices | €35 million or 7% of worldwide annual turnover |
| Most other obligations, including high-risk requirements and Article 50 transparency | €15 million or 3% |
| Supplying incorrect, incomplete or misleading information to authorities | €7.5 million or 1% |
The higher amount applies; for SMEs, including start-ups, the lower one does. Source: Article 99, Regulation (EU) 2024/1689.
Why engineering-led compliance works
A consultant can tell you what the law requires. Meeting it takes engineering: anonymisation before data reaches a model, infrastructure locked to EU regions with AWS Service Control Policies or Azure Policy, an audit record of every AI decision, and C2PA metadata on generated content.
These are architectural decisions that shape every layer. Added later, they cost more and leave a more fragile system. So every system we build starts with data-flow classification, an AI Act risk assessment and infrastructure that makes the non-compliant path hard to take.
Six parts of a compliant AI system.
GDPR by design
Data minimisation, purpose limitation, consent and erasure built into the data model, not added on top.
AI Act readiness
Risk classification, Article 50 disclosure and content marking, human oversight and logging, mapped to the dates that apply to you.
Data residency
EU cloud regions such as AWS Frankfurt, Azure West Europe or Google Cloud in Belgium, locked by policy so data stays where you decide.
Access and encryption
Encryption at rest and in transit, role-based access, and an audit record for every access to personal data.
Audit and documentation
DPIAs, data-flow diagrams, records of processing and AI system cards: the documents your DPO and auditors ask for.
Compliant AI pipelines
Personal data removed before it reaches a model, zero-retention API settings, self-hosted models where needed, and prompt-injection safeguards.
Four steps, in order.
Classify
Map every data flow and category of personal data, settle the lawful basis, and classify each AI system under the AI Act.
Architect
Design with the constraints first: residency, consent, retention, logging and human oversight.
Build and verify
Automated checks in CI for data flows, encryption, access control and consent handling.
Document and hand over
DPIA, data-flow diagrams, AI system cards and processing records, ready for your DPO.
Go deeper.
- The EU AI Act compliance checklist for development teamsRisk classification, Article 50 and the documentation high-risk systems need.
- How to integrate GenAI while staying GDPR compliantArchitecture patterns for AI systems that process personal data.
- Data residency requirements for AI systems in EuropeCloud regions, Schrems II and keeping EU data in the EU.
- GDPR-compliant AI pipelines on AWS in EuropeA technical guide to LLM pipelines in Frankfurt with encryption and audit trails.
Common questions.
How do you build GDPR compliance into an AI system?
From the infrastructure up: data minimisation and purpose limitation in the data model, personal data removed or pseudonymised before it reaches a language model, hosting in the EU region you choose, encryption at rest and in transit, role-based access and audit logging.
What is the EU AI Act and when does it apply?
Regulation (EU) 2024/1689 is the EU law on artificial intelligence, amended by the Digital Omnibus, Regulation (EU) 2026/1744. Prohibited practices have been banned since 2 February 2025, and two more (non-consensual intimate deepfakes and child sexual abuse material) are banned from 2 December 2026. General-purpose AI obligations have applied since 2 August 2025. Article 50 transparency obligations have applied since 2 August 2026; high-risk obligations apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Fines reach €35 million or 7% of worldwide annual turnover.
Can you deploy on EU-hosted infrastructure?
Yes. We build on EU cloud regions such as AWS Frankfurt (eu-central-1), Azure West Europe (Netherlands) or Google Cloud europe-west1 (Belgium), in your own accounts where possible, so personal data stays in the jurisdictions you specify.
Do you give legal advice on GDPR or the AI Act?
No. We build compliant software. For legal opinions, data protection officer services or certification, work with qualified counsel in your jurisdiction. We are glad to work alongside them.
What does compliance engineering cost?
It depends on the system and its risk classification. Every engagement starts with a one-week discovery that ends in a written plan and a quote.
Build it compliant from the start.
Tell us about the system and the rules it falls under. We reply within 24 hours on working days.