AI and the law: the EU AI Act, copyright and data protection in plain English

The EU AI Act in a nutshell

The EU has passed its own law on artificial intelligence, known as the AI Act. It's one of the world's first comprehensive AI laws and applies to anyone offering or using AI in the EU. The rules are coming into force in stages: some already apply, and others take effect over the next few years. The EU has also discussed postponing some deadlines, so check the current timetable with an up-to-date source.

The core idea is that the law is risk-based: the greater the potential for harm, the stricter the rules.

• Banned uses. For example, "social scoring" of people, manipulating vulnerable people, and emotion recognition in workplaces and schools (with narrow exceptions) are prohibited.
• High-risk uses. AI used in hiring, education, lending or healthcare must come with careful documentation, human oversight and quality checks.
• Transparency duties. People must be told when they're talking to a machine, and AI-generated deepfakes must be labelled.
• Minimal-risk uses. Most everyday use – drafting emails, coming up with recipes – falls here, with no special obligations.

The heaviest obligations fall on those who develop and provide AI – mainly the big technology companies. As a consumer, you don't need to do anything new. A business that uses AI in its work does have a few things to think about. One of them is making sure staff have adequate AI literacy: in practice, that people know how to use the tools sensibly and understand the risks.

In Finland, enforcement is coordinated by Traficom together with other sector authorities; other EU countries have their own designated bodies.

Who owns an image or text made by AI?

This is one of the most common questions, and the answer is still partly open. The basic principles, though, are clear.

Copyright in Finland and across the EU protects human creative work. A work has to be the author's own original creation. If an AI produces an image or text almost entirely by itself from a short prompt, the result is unlikely to be protected by copyright. In practice, that means you may use the image, but you may not be able to stop others from copying it.

If, on the other hand, you significantly edit, combine and refine the AI's output with your own creative input, your contribution may be protected. The line is blurry, and more case law is expected in the coming years.

Most services' terms of use say you may use the outputs freely, including commercially. Terms differ, though, so read them before using images on, say, product packaging or in a logo.

Respecting other people's rights

• Don't ask for copies. Requesting a famous cartoon character or a well-known company's logo can easily infringe someone else's rights, even if a machine drew it.
• Check for resemblance. AI can sometimes produce something that looks like an existing work. If the result looks familiar, don't use it.
• Real people. Using an identifiable person's image in advertising requires their permission. A fake image or video of someone may breach their privacy or amount to defamation.
• Logos and trademarks. If you need a logo you want to protect, have a human designer make it, or rework the AI draft substantially.

Some image services, such as /en/tools/firefly/, say their models were trained on licensed material and market them for commercial use. More on creating images in /en/guides/creating-images-with-ai/.

Data protection: the GDPR

The EU's General Data Protection Regulation (GDPR) covers all processing of personal data, including processing done with AI. Personal data is any information that can identify a person: a name, phone number, photo, customer number, or even a description that makes it possible to work out who someone is.

For a business owner this means, in practice:

1. Use a service with a data processing agreement if you're entering customer or employee data. Usually that's the business version, such as /en/tools/m365-copilot/ with a work account.
2. Find out where data is processed. Transfers outside the EU need a legal basis. Reputable services explain this in their terms.
3. Tell your customers in your privacy notice if you use AI to process their data.
4. A human decides. People have the right not to be subject to purely automated decisions that significantly affect them – rejecting a job application, for instance.
5. Minimise. Give the AI only the information the task really needs.

In Finland, data protection is supervised by the Office of the Data Protection Ombudsman (Tietosuojavaltuutettu), whose website has clear guidance for small businesses and associations too. For practical tips, see /en/guides/ai-privacy-and-security/.

Using AI at work responsibly

Many people already use AI at work, but not everyone knows what their employer thinks about it. A few clear principles help employees and business owners alike.

• Find out your workplace's rules. Ask which tools are allowed and what information may go into them. If there are no rules, suggest creating some.
• The responsibility stays with you. If you send a customer an AI-written quote with a mistake in it, the mistake is yours. Always read and check.
• Keep confidential material out of consumer versions. Contracts, salaries, customer records and trade secrets belong only in approved tools.
• Tell customers when they're talking to a bot. If your website has an AI assistant, make that clear.
• Be open. If AI did a substantial part of a piece of work, such as a report or translation, mention it where relevant.
• Involve your staff. In larger companies, changes to ways of working are discussed with employees under employee-consultation rules.

Draft a one-page AI policy for your business

For a small business, a short, clear policy is enough. You can draft it with AI and finish it yourself. The prompt below gives you a good starting point.

Review the draft yourself and make sure it fits your business. More tips for business owners in /en/guides/ai-for-small-business/.

Common situations

• Can I use an AI-made image in my company's Facebook ad? Usually yes, if the service's terms allow commercial use and the image doesn't imitate someone else's work, trademark or an identifiable person. Advertising rules on social media are covered in /en/guides/ai-marketing-and-social-media/.
• Can I give the AI someone else's article to summarise? For your own understanding, that's generally fine. Publishing the summary or sharing the article onwards is a different matter and needs permission.
• Can an AI be the author of a work? Not under current Finnish law. The author is always a human being.

The golden rule is simple: act as you would without AI. Respect other people's rights, protect people's data, and take responsibility for what you publish.