AI Tracker
European Union

The European General Data Protection Regulation (GDPR) is the EU's framework governing the collection and processing of personal data in the EU. AI systems – whether deployed by an AI provider within or outside of the EU – must comply with the requirements set out in the GDPR if they fall within the scope of the scope of the legislation when collecting and processing the personal data of individuals.

The GDPR grants individuals several important rights, including rights of access, to be forgotten, to object, to rectification, to restrict processing, to data portability, and not to be subject to decisions based solely on automated processing. These ensure that data subjects have control and transparency over how their personal data is used.

The European Data Protection Board (EDPB) helps to ensure that the GDPR is applied consistently between Member States' Data Protection Authorities and facilitates cooperation in enforcement.

• On 17 July 2024, the EDPB issued a statement calling on Member States to designate Data Protection Authorities as Market Surveillance Authorities under Europe's AI Act, with a deadline of 2 August 2025.

• In 2024, the EDPB formed a task force to investigate data processing by OpenAI’s ChatGPT and, on 12 February 2025, expanded its scope to include the Chinese AI platform DeepSeek. A quick response team is being set up to guide and coordinate enforcement actions across different Data Protection Authorities whenever concerns arise related to AI data processing.

• In May 2025, the data privacy non-profit NOYB sent Meta a cease and desist over its plans to train AI systems with EU personal data and its reliance on an opt-out rather than opt-in mechanism, which NOYB argues breaches the GDPR.

The European Data Protection Supervisor (EDPS), established under the GDPR, is responsible for monitoring how institutions and bodies subject to the GDPR process personal data. 

Within the scope of the AI Act, the EDPS will serve as the competent authority, supervising institutions and bodies subject to the GDPR to ensure their AI activities align with data protection principles and rules.

• In November 2025, the EDPS published its Guidance for Risk Management of Artificial Intelligence Systems. 

In November 2025, the EC released its Data Union Strategy on unlocking data for AI which focused on three priority areas: scaling up access to data for AI, streamlining data rules and strengthening the EU's global position on international data flows.

• On 1 March 2024, the European Patent Office implemented updated "Guidelines for Examination" that introduce stricter disclosure requirements of sufficiency for AI-related inventions. The guidelines emphasise that AI models must be described in sufficient detail to enable a skilled person to reproduce the claimed invention's technical effect without undue burden. While there is no obligation to disclose the specific training dataset itself, its characteristics must be adequately described if they are necessary to achieve the claimed technical effect. Effective 1 April 2025, the updated Guidelines for Examination introduce a refined definition of patentable artificial intelligence (AI) and machine learning. The reference to the specific purpose of the algorithm has been removed. The updated text emphasizes examples of AI-related algorithms and clarifies that, to be patentable, such algorithms must contribute to the technical character of the invention. The European Council and the European Parliament have adopted their formal positions in relation to the proposed AI Digital Omnibus with both institutions aligned on the delay to high-risk requirements with a date of application 2 December 2027 rather than 2 August 2026.The Council has maintained its proposed six-month delay for watermarking requirements for generative AI placed on the marker before 2 August 2026, the European Parliament has proposed that it be cut to three-months. The Council has also maintained its proposal for removal of the AI literacy requirements, whereas the European Parliament has restated the obligation to "support the improvement of AI literacy."
• As of 1 July 2024, the European Union Intellectual Property Office (EUIPO) established an "Executive Advisory Committee" focused on AI, inclusivity, and sustainability. In alignment with the AI Act, the EUIPO is expected to issue specific guidelines addressing the implications of AI on intellectual property, which aim to ensure compliance with EU copyright laws by requiring AI companies to establish policies that respect intellectual property rights - including mechanisms for rights holders to opt out of text and data mining. On 12 May 2025, the EUIPO released a comprehensive study "to deepen the general understanding of GenAI's technical functioning, as well as existing and developing solutions underlying the application of EU rules on copyright and Artificial Intelligence".
• On 3 April 2025, the Budapest District Court referred the case, Like Company v Google C-250/25, to the Court of Justice of the European Union (CJEU). The Court sought clarity on whether an LLM based chatbot’s display or reproduction of press content infringes EU copyright under the DSM and InfoSoc Directives, including the applicability of the text and data mining exception.
• The European Commission is developing a Code of Practice on Transparency of AI-Generated Content to support compliance with transparency obligations under Article 50 of the EU AI Act. It aims to ensure clear labelling of AI-generated and manipulated content, including deepfakes, in order to prevent misinformation and strengthen public trust. The Second Draft was released in March 2026 and will remain open to stakeholder consultation until 30 March 2026. It is structured into two main sections:
  1. Section 1 concerns providers of generative AI systems and focuses on requirements related to machine‑readable identification and the detection of AI‑generated or manipulated content;
  2. Section 2 is addressed to deployers and establishes obligations to ensure that deepfakes and certain AI‑generated texts intended to inform the public are clearly and recognisably labelled.
• In GEMA v OpenAI (42 O 14139/24, 11 November 2025), the Munich Regional Court found that ChatGPT’s “memorisation” of training data and reproduction of song lyrics constitutes copyright infringement. The case was brought by GEMA, the German collecting society representing the rights of composers, lyricists and music publishers. The Munich Regional Court held that the "memorisation" of training data and reproduction of song lyrics in ChatGPT outputs infringe copyright, and that such actions do not fall within the "test and data mining" exception under section 44b of the German Copyright Act, which implements Article 4 of the DSM Directive. 

Competition

Technology and digital markets continue to be a strategic focus for the European Commission, which has reiterated its commitment to ensuring that these markets remain competitive and contestable. The Commission is using a range of tools, including antitrust enforcement, merger control, and the Digital Markets Act (DMA), to achieve this.

• Vertical agreements: The Commission is closely monitoring agreements between Original Equipment Manufacturers and AI developers concerning the pre-installation of AI models on mobile devices, as arrangements could hinder access for competing foundation models.
• Mergers and acquisitions. The Commission has examined transactions that do not meet the EU’s usual merger control thresholds but may still warrant review under Article 22 of the EU Merger Regulation. It has also scrutinised investments and partnerships between large digital companies and generative AI developers:
  • Microsoft/OpenAI. Although the Commission assessed whether Microsoft’s investment and subsequent events at OpenAI could be reviewed under the EU Merger Regulation, it concluded that Microsoft had not acquired lasting control and did not proceed with a formal merger review. Nonetheless, antitrust concerns, particularly around exclusivity arrangements, remain under consideration.
  • Microsoft/Inflection. Unlike in Microsoft/OpenAI, the Commission considered that that Microsoft’s acquisition of Inflection constituted a "concentration" under the EUMR, as it involved the transfer of all assets necessary for market participation in generative AI foundation models and chatbots. However, following the General Court’s judgment in Illumina/Grail, seven Member States withdrew their Article 22 referral, and the investigation did not proceed further.
  • NVIDIA / Run:ai. In December 2024, the Commission cleared NVIDIA’s acquisition of Run:ai, despite the transaction not meeting EU notification thresholds. The Italian Competition Authority had called in the deal and referred it to Brussels. Although NVIDIA is reportedly challenging the Commission’s jurisdiction, this case may set important precedent on AI-sector transactions.
• Algorithmic collusion. The Commission’s revised Guidelines on Horizontal Cooperation Agreements highlight two key principles for pricing algorithms: (1) if offline pricing practices are unlawful, they are likely unlawful online too; and (2) firms remain responsible for algorithm-driven pricing in the same way they are liable for employees or consultants.
• Digital Markets Act (DMA): While AI is not explicitly listed as a core platform service, the Commission clarified that the DMA applies to AI when embedded within designated services like search engines or social networks. EVP Margrethe Vestager emphasised this during the June 2024 workshop on "Competition in Virtual Worlds and Generative AI". In January 2025, the European Parliament raised concerns over the absence of cloud providers designated under the DMA, which it sees as critical for AI development, and the French Government called for an expansion of the DMA to cover the full AI value chain.
• In December 2025, the Commission opened an antitrust investigation into Meta's revised policy restricting third-party AI providers' ability to offer services through WhatsApp Business Solution. The EC claims that this policy could be in breach OF Article 102 of TFEU and Article 54 of the EEA Agreement. Similarly, the EC in December also opened a formal antitrust investigation to determine whether Google has breached competition rules by using the content of web publishers on YouTube for AI purposes without appropriate compensation and opt-outs.

Consumer protection

The EU has introduced new consumer protection measures addressing AI-related risks:

• Revised Product Liability Directive: This Directive imposes strict liability for defective products causing death, personal injury, or property damage. It covers AI systems, whether standalone or integrated into other products (e.g., self-driving cars). It introduces rebuttable presumptions to support claimants facing technical complexity and new evidence disclosure rules. The Directive entered into force on 8 December 2024, with Member States required to transpose it by 9 December 2026.
• General Product Safety Regulation: This Regulation, in force since 12 June 2023 (applicable from 13 December 2024), introduces a modernised framework for consumer product safety. The Commission’s November 2024 Q&A confirmed that it applies to "all types of products, including software", thereby capturing AI systems within its scope.

While the EC had initially proposed to facilitate claims related to AI systems under fault-based regimes under the proposed AI Liability Directive (particularly regarding disclosure of evidence and causation presumptions), this proposal was withdrawn by the Commission in February 2025 after legislative deadlock. The Commission indicated that future proposals may be considered.