Data governance has become a key concern for companies, especially when the EU AI Act and General Data Protection Regulation (GDPR) have put a premium on handling data responsibly and ensuring that artificial intelligence does not cause harm.

Both pieces of legislation spell out what companies need to do to comply with responsible AI use–but not necessarily how to do it. And while some activities may be deemed “high risk,” they are not banned.

Cross-border legislation, the potential for regulatory cross-over, and differences in enforcement approaches both inside and outside the EU also pose concerns about how “safe” or “risky” companies can be with their use of data and AI, while a lack of case law is an incentive for more aggressive companies to dive in.