The AI Act is a regulation that applies horizontally across all sectors without prejudice to other Union legislation, in particular on the protection of fundamental rights, consumer protection, employment, the protection of workers, and product safety.37 The AI Act complements such legislation through its preventative and safety logic (AI systems may not be placed on the market or used in a certain way ) and provides additional protection by addressing specific harmful AI practices which may not be prohibited by other laws . Furthermore, by addressing the earlier stages of the AI systems’ lifecycle(i.e. the placing on the market and putting into service) and deployment (i.e. the use), the AI Act’s prohibitions enable action to be taken against harmful practices involving AI at various points in the AI value chain.
At the same time, the AI Act does not affect prohibitions that apply where an AI practice falls within other Union law.38 Thus, even where an AI system is not prohibited by the AI Act, its use could still be prohibited or unlawful based on other primary or secondary Union law (e.g., because of the failure to respect fundamental rights in a given case , such as the lack of a legal basis for the processing of personal data required under data protection law , discrimination prohibited by Union law , etc.). The respect of the prohibitions in the AI Act are therefore not a sufficient condition for compliance with other Union legislation that remains applicable to providers and deployers of AI systems. For example, AI-enabled emotion recognition systems used in the workplace that are exempted from the prohibition in Article 5(1)(f) AI Act, because they are used for medical or safety reasons, remain subject to data protection law and Union and national law on employment and working conditions, including health and safety at work, which may foresee other restrictions and safeguards in relation to the use of such systems.39
When specific activities related to the placing on the market or use of AI systems are also covered under other Union legislation, the AI Act aims to ensure the consistent implementation of the different provisions. Moreover, it enables effective cooperation between the competent authorities responsible for the enforcement of the AI Act and the authorities protecting fundamental rights pursuant to Article 77 AI Act and other provisions of the AI Act. More generally, in accordance with Article 4(3) TEU, the various authorities concerned are bound to cooperate sincerely when giving effect to their respective tasks under Union law.
In the context of the prohibitions , the interplay between the AI Act and Union data protection law is particularly relevant , since AI systems often process information relating to identified or identifiable natural persons (‘personal data’)40 Depending on . the prohibition and the context, the most relevant legal acts in relation to such systems are Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, hereinafter ‘GDPR’), Directive (EU) 2016/680 on the protection of natural persons with regard to the pro cessing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data (Law Enforcement Directive, hereinafter ‘ LED’), and Regulation (EU) 2018/1725 which lays down data protection rules for the EU Institutions, bodies, offices and agencies (hereinafter ‘EUDPR’) . In accordance with Article 2(7) AI Act, these acts remain unaffected and will continue to apply alongside the AI Act, which is consistent and complementary to the EU data protection acquis. Several aspects of these EU data protection rules have been clarified by the CJEU and the European Data Protection Board has adopted a series o f guidelines (e.g. on the noti on of ‘profiling’,41 which is particularly relevant for the prohibition in Article 5(1)(d) AI Act, since it uses the same notion).
Concerning the prohibitions/restrictions on the use of biometric categorisation systems and real-time RBI systems for law enforcement purposes, the AI Act applies as lex specialis to Article 10 LED, thus regulating such use and the processing of biometric data involved in an exhaustive manner.42 In that context, the AI Act is not intended to provide the legal basis for the processing of personal data under Article 8 of Directive (EU) 2016/680. All other provisions of that Directive apply in addition to the conditions set out in the AI Act , in particular for the use of real-time (RBI) systems for law enforcement purposes when permitted , subject to the limited exceptions in Article 5(1)(h) AI Act. More generally, the LED must also be complied with for any processing of personal data by competent law enforcement authorities (i.e. competent authorities under Article 3(7) LED) when they process the data for law enforcement purposes.
In accordance with Article 2(9) AI Act, EU consumer protection and safety legislation also remain fully applicable to AI systems falling within scope of those acts. For example,
- Social scoring practices by traders (including natural persons acting in a professional capacity in business-to-consumer relations), subject to case-by-case assessment, may also be considered ‘unfair’ and therefore in breach of consumer law ( i.e. Directive 2005/29/EC);
- The use of an AI system to infer emotions may also have to comply with Regulation (EU) 2017/745 (Medical Device Regulation ) if the AI system is used for medical diagnosis or medical treatment purposes.
Furthermore, the AI Act applies in conjunction with relevant obligations for providers of intermediary services that embed AI systems or models into their services regulated by Regulation (EU) 2022/2065 ( ‘the Digital Services Act ’). Specifically, Article 2(5) AI Act indicates that the AI Act does not affect the application of the provisions on the liability of such providers as set out in Chapter II of the Digital Services Act.
In addition, the prohibitions in the AI Act are without prejudice to any liability that the provider or deployer might incur for the harm caused according to applicable Union or national liability laws.43
Finally, the prohibitions in Article 5 AI Act and the explicit exceptions to those prohibitions may not be used to circumvent or as a justification to infringe obligations under other Union legislation.
As secondary Union legislation, the AI Act must be interpreted in the light of the fundamental rights and freedomsguaranteed by the EU Treaties and the Charter, as well as those protected by international conventions to which the Union is a party.44
Additional clarifications on the interplay of specific prohibitions with other Union law are provided under the relevant sections below.