AI Value Chain Actors and Roles

Legal Framework

The AI Act distributes compliance obligations across distinct actors in the AI value chain, principally providers and deployers. Recital 21 establishes that these obligations apply in a non-discriminatory manner to providers regardless of whether they are established within the Union or in a third country, and to deployers established within the Union. This extraterritorial reach mirrors the GDPR's approach and ensures that regulatory arbitrage through offshore establishment does not undermine the level playing field.

Article 50 of the AI Act imposes specific transparency obligations on both providers and deployers of certain AI systems. These obligations operate alongside, not in substitution of, GDPR transparency requirements under Article 13 GDPR, which require controllers to inform data subjects about processing activities including the legal basis, purposes, and retention periods. Where AI systems process special categories of personal data within the meaning of Article 22 GDPR, the default prohibition applies unless a specific exception can be invoked. Several exceptions under Article 22 GDPR have direct effect — namely subparagraphs a, c, d, e, and f — while others require a basis in national or Union law. Consent under Article 22 GDPR must manifest through a clear affirmative act, whether written, oral, or electronic, demonstrating freely given, specific, informed, and unambiguous agreement.

Article 62 of the AI Act introduces supportive measures for providers and deployers, with particular attention to SMEs and start-ups, acknowledging that compliance burdens must be calibrated to organizational capacity without diluting substantive protections.

Key Developments

The Italian Data Protection Authority's enforcement action against Luka Inc. illustrates the practical convergence of AI Act and GDPR obligations. The €5,000,000 fine imposed on the company for its Replika chatbot demonstrates that authorities will scrutinize both the provider's design choices and the deployer's operational use of AI systems, particularly where vulnerable users and special category data are implicated.

The Dutch Data Protection Authority has signaled that AI regulatory sandboxes will become mandatory from August 2026, providing a structured environment for providers and deployers to test compliance assumptions under supervisory guidance. Transparency obligations under the AI Act take effect from 2 August 2025, and the Dutch regulator has advised organizations to adopt a voluntary code of practice in the interim, signaling that proactive engagement will be viewed favorably in enforcement contexts.

Practical Guidance

• Map your role precisely. Determine whether your organization qualifies as a provider, deployer, or both under the AI Act, as this classification determines which obligations attach. A single entity may occupy different roles across different AI systems or use cases.

• Audit special category data flows. Where AI systems process data covered by Article 22 GDPR, identify the applicable exception before deployment. Relying on consent requires demonstrable, affirmative action by the data subject — passive acceptance or pre-ticked boxes are insufficient.

• Implement layered transparency. Satisfy both AI Act Article 50 and GDPR Article 13 through coordinated notices that distinguish AI-specific disclosures from general data protection information, avoiding contradictory or duplicative statements.

• Document cross-border transfers. Where processing involves actors outside the Union, record the transfer mechanism relied upon and evidence serious efforts to identify an adequate basis under GDPR Articles 45, 46, or 49 before invoking residual exceptions.

• Engage with sandbox frameworks. For SMEs and start-ups, Article 62 measures and national sandbox programs offer a pathway to test compliance under supervisory oversight, reducing enforcement risk for novel applications.