For a long time, artificial intelligence was seen by the general public as a vision of a technology that would one day change the way we work and live, even though various forms of it were already in use. At the end of November 2022, however, a service called ChatGPT became publicly available and quickly became headline news in both technology and mainstream media. As early as March 2023, OpenAI introduced GPT-4, a new generation of the models on which the service was based. Further improvements followed, along with new capabilities for working with text, images and other types of content. ChatGPT as a service should be distinguished from the GPT models it uses.
We do not need to speculate about what future generations of these models will bring in order to recognise the importance of this technology and the need to consider the way forward. According to results published by OpenAI, GPT-4 already achieved a passing score on a simulated US bar exam. That, however, is not the same as formally passing the exam, nor does it confirm the reliability of its answers in legal practice. A model can give an incorrect answer, including invented facts and sources, even when the answer appears convincing.
This text does not deal with the technical analysis of artificial intelligence or ChatGPT, but with the risks this technology may carry and the regulatory framework intended to enable its beneficial use while protecting people’s safety and rights.
One of the early examples of regulatory intervention took place in Italy. In March 2023, the Italian data protection authority temporarily restricted OpenAI’s processing of data of users in Italy, after which the company disabled access to the service in that country. Questions were raised about the legal basis for processing, transparency, the exercise of data subjects’ rights and the protection of minors. After OpenAI introduced certain measures and changes, the service became available again on 28 April 2023. This did not amount to a general confirmation that all of its data processing was lawful.
ChatGPT and other generative AI systems also raise copyright issues, in particular regarding the use of protected works to train models and the content these systems generate. Some disputes are already before the courts, but the existence of a lawsuit does not mean that an infringement has been established. These issues require separate analysis.
The risk to people’s rights depends on the purpose of the system, the data processed, the way it is used and the consequences its outputs may have. For this reason, even a service such as ChatGPT cannot be considered safe in advance for every type of use.
Our legal support in the field of artificial intelligence covers advice on the application of the AI Act and data protection legislation, assessment of legal risks when introducing AI systems into business operations, drafting internal policies on the use of artificial intelligence, structuring contractual relationships with AI service providers, as well as issues of liability, confidentiality and the protection of intellectual property. We pay particular attention to rules on employees’ use of AI tools and to the protection of business and personal data entered into these systems. To discuss your situation, please contact us.
EU AI Act: Regulating Artificial Intelligence
Following the development of artificial intelligence, the European Union adopted Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence, known as the AI Act. The Regulation entered into force on 1 August 2024, and its provisions apply in stages. It is one of the most significant steps worldwide towards comprehensive regulation of the development and use of AI systems.
Although the AI Act primarily applies to the EU market, its provisions may also be relevant to companies established in Serbia. Under the prescribed conditions, the Regulation also applies to providers from third countries that place AI systems on the market or put them into service in the EU, and to providers and deployers of AI systems from third countries where the output of those systems is used in the European Union (Article 2(1)). It is therefore necessary to determine, for each company, whether a particular activity falls within the territorial scope of the Regulation.
The prohibitions of certain AI practices have applied since 2 February 2025, while the rules for general-purpose AI models have applied since 2 August 2025, with a transitional regime for models placed on the market earlier. The general date of application of the Regulation is 2 August 2026. However, amendments that entered into force in July 2026 postponed the application of the rules for high-risk systems listed in Annex III to 2 December 2027, and for high-risk systems related to products covered by Annex I to 2 August 2028. The applicable deadline should therefore be checked for each specific obligation.
At the outset, the Regulation provides a legal definition of an AI system. Under Article 3(1), an AI system is a machine-based system designed to operate with varying levels of autonomy, which may exhibit adaptiveness after deployment and which, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments.
One of the primary aims of the AI Act is to regulate the development and use of AI systems according to the risks they pose. The Regulation distinguishes between prohibited practices, high-risk systems and certain systems subject to specific transparency obligations. It does not impose the same scope of specific requirements on minimal-risk systems. It separately regulates general-purpose AI models, with additional obligations for models with systemic risk.
Prohibited practices include, under the conditions set out in the Regulation, certain forms of harmful manipulation of people, exploitation of their vulnerabilities, social scoring and the untargeted scraping of facial images from the internet or CCTV footage to create or expand facial recognition databases. Inferring emotions in the workplace and in education is also prohibited, except where the use is intended for medical or safety reasons. Real-time remote biometric identification in publicly accessible spaces for law enforcement purposes is prohibited in principle, with narrowly defined exceptions.
The AI Act does not prohibit every deepfake. For such content, it requires disclosure that the content has been artificially generated or manipulated, subject to prescribed exceptions and adjustments. The 2026 amendments also introduced specific prohibitions of certain AI practices that generate or manipulate intimate and sexually explicit content depicting identifiable natural persons without their consent, as well as child sexual abuse material, applicable from 2 December 2026.
Under the prescribed conditions, the Regulation permits high-risk AI systems whose use may affect health, safety and fundamental rights. These include certain applications in healthcare, employment and workforce management, education, critical infrastructure, biometrics, law enforcement, the administration of justice and border management. The mere use of AI in a particular sector, however, does not automatically make every such system high-risk: its intended purpose and the criteria set out in the Regulation are decisive.
High-risk systems are subject to requirements covering risk management, data quality and governance, technical documentation, record-keeping, human oversight, accuracy and cybersecurity. Technical documentation must be prepared before the system is placed on the market or put into service and kept up to date. The specific obligations differ according to the role of the entity, in particular whether it develops and places the system on the market or uses it in the course of its business.
A fundamental rights impact assessment is not a general obligation of every deployer of every high-risk system, but is carried out in the cases specified in Article 27 of the Regulation. It should be distinguished from a data protection impact assessment, which is required under data protection legislation. The two assessments may be linked, but one does not automatically replace the other.
The specific transparency obligations under Article 50 of the Regulation differ depending on whether the entity is a provider of an AI system or uses it in the course of its business. They include, among other things, informing natural persons that they are interacting with an AI system, unless this is obvious from the circumstances, as well as certain obligations to mark and disclose artificially generated or manipulated content. Special rules also apply to the permitted use of emotion recognition and biometric categorisation systems. Providing information alone, however, does not make processing lawful: the other conditions for using the system and processing the data must also be met.
In any case, the AI Act is a complex regulatory framework that requires, for each specific use, determining the purpose of the system, its level of risk, the roles of the entities involved and the obligations that follow. Its practical application is further developed through standards, guidelines and other instruments.
Artificial Intelligence and Personal Data Protection
The relationship between artificial intelligence and personal data protection is very important. Data protection rules are relevant both to the development of models and to their use, where these activities involve the processing of personal data. The fact that data is publicly available does not in itself mean that it can be used without limitation to train AI models. The European Data Protection Board has also addressed certain questions of data processing in this context in its Opinion 28/2024.
Security and privacy:
Large amounts of data are often used to train AI models, which may include personal data, including special categories of data. Risks also arise when users enter data into an AI service. Data protection therefore requires limiting processing to what is necessary, access control and appropriate measures against unauthorised use and disclosure.
Compliance with applicable law:
Data protection legislation, such as the GDPR in the European Union and the Personal Data Protection Law in Serbia, sets binding rules for the processing of personal data. Using AI systems requires determining the legal basis and purpose of processing, respecting the principles of processing, informing individuals and enabling them to exercise their rights. Depending on the processing, a data protection impact assessment, transfers of data to other countries and the rules on automated decision-making must also be considered. Compliance with the AI Act does not in itself replace compliance with these obligations.
Gaining and maintaining user trust:
When users trust that their data is processed lawfully, transparently and with an appropriate level of security, this contributes to a positive attitude towards AI technologies. Failure to respect privacy can result in a loss of user trust and a negative perception of individual AI systems, and of artificial intelligence in general.
Ethical aspect:
The development and use of AI often raise ethical challenges related to the use of data. It is therefore important to establish ethical guidelines and apply them in the development and use of AI systems. They contribute to responsible conduct, but do not replace legal obligations.
Preventing discrimination:
AI systems can create new or reinforce existing social inequalities if they are based on biased or unrepresentative data, are inappropriately designed or are used improperly. Careful data management, verification of outputs and appropriate human oversight help reduce the risk of discrimination.
An appropriate relationship between artificial intelligence and data protection contributes to the protection of people’s rights, data security and the responsible use of this technology.
EDUCATION ON ARTIFICIAL INTELLIGENCE
To promote a better understanding of the legal approach to AI technology, lawyers from our office created a seminar on this topic, first as a one-day event, which, due to strong interest, grew into a two-day seminar, Legal Aspects of Artificial Intelligence, held in Serbian.
This educational programme is intended primarily for lawyers, but also for those from other professions.