AI, Data & Compliance

Most companies now use AI. Few have yet organised themselves for the law that governs it.

An AI model network inside a ring of twelve stars, connected to a compliance checklist and a security shield

AI law, EU AI Act compliance and data protection are now the most active area of the practice.

Language models embedded in products, credit scoring, recruitment tools, conversational assistants: these systems now sit within a legal framework that did not exist three years ago. Clients, investors and regulators increasingly ask how it is being met.

Addressed early, compliance becomes a commercial argument rather than a constraint. Larger compliance programmes are conducted with the team at Doudy, Law & Technology.

The AI Act will not be met by legal departments alone. It will be met by companies whose engineers and lawyers write the same backlog.

EU AI Act compliance

The AI Act applies to any provider placing an AI system on the European market, and to any system whose output is used in the Union. A company based in Tunis, Istanbul or Dubai serving European clients is within its scope. For companies outside Europe, the question is one of market access.

The prohibitions and the AI literacy duty have applied since 2025, the obligations on general-purpose models since August 2025 and the transparency duties since August 2026. Following the 2026 deferral, the obligations on stand-alone high-risk systems apply from December 2027. The additional time is best used now: bringing a high-risk system into line takes many months.

The work covers the inventory of AI systems, the qualification of the client's role along the value chain, the classification of each system, and, for high-risk systems, the quality management system, technical documentation, conformity assessment and fundamental rights impact assessment.

Compliance by design

Requirements are most effectively met when they are built into the product rather than documented after launch. I work with technical teams to translate risk management, data governance, logging, human oversight, robustness and post-market monitoring into the development cycle itself. Here my engineering background is directly useful: the legal requirement and its implementation are addressed together.

Data protection & GDPR

The AI Act adds to the GDPR rather than replacing it, while national data protection laws outside Europe are being rewritten. Data mapping and legal bases, impact assessments conducted alongside the AI fundamental rights assessment, profiling and automated decision-making, data relating to minors and vulnerable persons, international transfers and hosting choices.

Cybersecurity

Security obligations under the AI Act and sector regulation, incident response and notification duties, the contractual allocation of security risk, and trust services and electronic signatures.

AI contracts & governance

Procurement of AI systems and licensing of models, allocation of liability, ownership of outputs, audit rights and exit arrangements. On the governance side: AI policies, system inventories, staff and board training, and alignment with ISO/IEC 42001 and the NIST AI Risk Management Framework where clients require it. I also follow the frameworks emerging in Turkey, the Gulf and North Africa, so that one compliance effort can serve several markets.

Engagements range from an initial assessment of exposure, delivered as a written memorandum with a prioritised plan, to sustained work alongside product teams and ongoing counsel for companies deploying AI at scale.

Contact