Legal: the duties beyond the AI Act
Last updated: October 2026
The AI Act is rarely the only law in the room. The same workflow is usually also processing personal data under the GDPR, sometimes falls under NIS2, and, if you employ people, runs into labour law that differs by country. Greyrox's Legal page helps you see which of these reach you, what each asks of you, and which don't reach you at all.
Not yours to edit, and not ours either. You can't withdraw a Regulation, so the law itself is fixed. You say which bodies of law you've taken on; the duties follow from that and from what you run. Greyrox records what you did and when. It never marks a duty met, and nothing on the page is a legal opinion.
How it works
You say which law applies
You choose which bodies of law you have taken on, from a library of EU instruments, sector rules and national law.
Greyrox suggests what looks likely
A guided pass flags what looks like it reaches you, each with the reason: you employ people in a country, you are a financial entity, you put software on the market under your own name. Some of it is declared by you rather than guessed: Greyrox can't tell from a workflow whether NIS2 reaches you.
Every duty, including those that don't apply
See what each law asks of you and what reaches you now. A view that includes what does not apply lets an auditor see that you looked.
What's in the library
Each instrument is named by its actual number, because a library that can't cite itself is a list of words.
| Instrument | What it adds on top of the AI Act |
|---|---|
| EU AI Act | The starting point for anyone who builds or uses AI in the EU. |
| GDPRRegulation (EU) 2016/679 | The AI Act sits on top of it; it doesn't replace it. Most of what an Annex III system does is also processing. |
| NIS2Directive (EU) 2022/2555 | Reaches essential and important entities only, as implemented nationally. |
| Cyber Resilience ActRegulation (EU) 2024/2847 | Security requirements for products with digital elements, and a duty to report an actively exploited vulnerability. |
| Product Liability DirectiveDirective (EU) 2024/2853 | Software and AI systems are products; a substantial modification can make you the manufacturer. |
| Data ActRegulation (EU) 2023/2854 | Who may use data a connected product generates, and the switching and exit rules for cloud and processing services, which reach your model providers. |
| Platform Work DirectiveDirective (EU) 2024/2831 | Algorithmic management of people who work through a digital platform. |
| Digital Services ActRegulation (EU) 2022/2065 | Obligations on intermediaries and online platforms, including recommender systems and advertising. |
| Data Governance ActRegulation (EU) 2022/868 | Re-use of protected public-sector data, data intermediation and data altruism. |
| European Accessibility ActDirective (EU) 2019/882 | Accessibility requirements for consumer products and services, including the interfaces an AI system puts in front of people. |
| Copyright in the Digital Single MarketDirective (EU) 2019/790 | Text-and-data-mining exceptions and the rightsholder's opt-out: the question underneath every training set. |
| DORA SectorRegulation (EU) 2022/2554 | Digital operational resilience for financial entities, including the register of ICT third-party arrangements. |
| Medical Devices (MDR/IVDR) SectorRegulations (EU) 2017/745 and 2017/746 | Software intended for a medical purpose is a medical device; the AI Act layers on top. |
| Machinery Regulation SectorRegulation (EU) 2023/1230 | Safety of machinery, including safety functions that AI systems may now perform. |
National law: where you employ people
For a tool that processes employee data or changes working conditions, the route in is often national. Six countries are modelled today.
| Country | What's covered |
|---|---|
| Netherlands | The UAVG, the Wet op de ondernemingsraden, and the Autoriteit Persoonsgegevens as supervisor. |
| Germany | The BDSG and the Betriebsverfassungsgesetz, with supervision by the Land authorities rather than a federal one. |
| France | The Code du travail and the Loi Informatique et Libertés: the CSE must be consulted before such a tool is introduced, and the CNIL supervises. |
| Belgium | CCT 39 and CCT 81 on introducing new technology and monitoring electronic communications, with the APD/GBA as supervisor. |
| Spain | Estatuto de los Trabajadores art. 64.4(d): workers' representatives can be told the parameters and logic of any algorithm affecting working conditions. |
| Italy | Statuto dei Lavoratori art. 4 and D.lgs. 152/1997: remote monitoring needs a union agreement or authorisation, and automated decision-making in employment must be disclosed. |
The other 21 member states are named, not modelled. Austria, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, Greece, Hungary, Ireland, Latvia, Lithuania, Luxembourg, Malta, Poland, Portugal, Romania, Slovakia, Slovenia and Sweden are listed, so a buyer who asks "do you do Portugal?" gets a straight answer. Their GDPR implementing acts, labour-law routes and AI Act supervisory authorities are not written yet, and can't be switched on. Writing labour law that has not been checked would be the one failure a product like this does not survive.
When something goes wrong: the clocks
When a serious incident involves an AI system, more than one deadline starts at once, all from the moment you become aware. Greyrox records the incident and works out the deadlines beside each other:
- AI Act, Article 73: reporting windows of 15, 10 or 2 days, depending on what happened.
- GDPR, Article 33: 72 hours to the supervisory authority, if personal data was involved.
- NIS2, Article 23: an early warning within 24 hours and a fuller notification within 72, if you are an essential or important entity and the incident is significant.
Greyrox computes the clocks. It notifies nobody. Telling the provider and the authority is yours, and a product that claimed to have done it for you would be wrong about the one thing you can't afford it to be wrong about.
A record, not a verdict. Greyrox helps you see which duties exist and keeps a record of what you did and when. Whether a duty is met, and how a law applies to your facts, is for you and your legal adviser. Looking at how your records line up with standards instead? See Compliance.