EU Trends and Developments Contributed by: Charlotte Gerrish and Evane Alexandre, Gerrish Legal
AI Governance in 2026: Why the GDPR Remains at the Centre of Europe’s Expanding Digital Rulebook Regulatory layering, constitutional anchoring and procedural recalibration For US and other non-European SaaS and technol - ogy companies operating or expanding in Europe, the regulatory landscape has evolved from regulatory fragmentation into structured constitutional layering. In particular, the adoption of the Artificial Intelligence Act (Regulation (EU) 2024/1689) (AI Act) and the Data Act (Regulation (EU) 2023/2854) (Data Act) has signifi - cantly expanded the EU’s digital rulebook. Notwithstanding the breadth of these legislative developments, the General Data Protection Regula - tion (Regulation (EU) 2016/679) (GDPR) remains the central legal instrument governing AI systems when - ever personal data is involved. This centrality is neither accidental nor transitional. The AI Act expressly preserves European data pro - tection law. The Data Act operates alongside it. More fundamentally, the GDPR’s architecture is anchored in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, which the Court of Justice of the European Union (CJEU) has repeatedly inter - preted as requiring effective, not merely formal, pro - tection (see Schrems I , Case C-362/14; Schrems II , Case C-311/18). AI regulation in Europe therefore sits within an already constitutionalised data protection framework. That constitutional positioning has concrete juris - dictional consequences. The GDPR’s extraterritorial scope under Article 3 (2) ensures that non-EU con - trollers and processors offering goods or services to individuals in the EU, or monitoring their behaviour, fall within scope irrespective of establishment. For US and other non-European SaaS providers deploying AI- enabled analytics, behavioural optimisation tools, AI agents or foundation models into the European mar - ket, this threshold is routinely met in practice. In practice, regulatory scrutiny of AI systems continues to crystallise through core GDPR provisions: lawful basis (Article 6), purpose limitation and minimisation (Article 5), automated decision-making safeguards (Article 22), security obligations (Article 32) and inter -
national transfer restrictions (Articles 44–49). While the AI Act introduces system-level risk categorisation and conformity assessments, those mechanisms do not displace the GDPR’s operative requirements where personal data is processed. The assessment of law - fulness, proportionality and individual rights remains anchored in the GDPR. The European Commission’s publication of COM (2025) 837 final, referred to as the “Digital Omnibus”, marks the first substantive legislative proposal to revisit aspects of the GDPR since 2018. It reflects an institutional recognition that the cumulative expansion of the Union’s digital regulatory framework – includ - ing the AI Act, the Data Act, the DMA, the DSA and cybersecurity instruments – may generate procedural duplication and compliance friction. However, the proposal does not alter the substan - tive architecture of the GDPR, nor its rights-based core. Articles 5 (principles), 6 (lawfulness), 22 (auto - mated decision-making), 25 (protection by design), 32 (security) and Chapter V (international transfers) remain intact. Nor does it displace the jurisprudential trajectory established in Schrems II (Case C-311/18), Meta Platforms (Case C-252/21), or SCHUFA (Case C-634/21), each of which reinforces substantive fun - damental rights protection over formalistic compli - ance. For all technology companies operating or scaling in the EU, the practical conclusion is clear: Europe is refining procedural mechanics, not retreating from constitutional data governance. In 2026, the GDPR continues to constitute the primary normative and interpretative framework through which AI systems involving personal data are assessed. From generative AI to autonomous agents at enterprise level The technological evolution since 2023 has shifted enterprise deployment from generative output tools to agentic execution systems. AI agents increasingly perform operational functions: executing transactions, allocating resources, adjusting pricing, scoring per - formance, approving access and managing workflow orchestration across enterprise environments.
104 CHAMBERS.COM
Powered by FlippingBook