Building Digital Products for the EU: Lawful Data, Licensed Assets, Responsible AI

Compliance starts before the first deploy

When I build or integrate software for a product used in the European Union, I treat lawful use of digital resources as an engineering requirement. That means checking where images, fonts, datasets, code, and APIs come from, what their licences permit, and whether attribution or other conditions must be carried into the shipped product. A file being publicly accessible does not by itself grant permission to reuse it.

Personal data needs the same deliberate treatment. I design data flows around a defined purpose, a suitable legal basis, data minimisation, limited retention, access controls, and clear information for people. I also check which vendors receive data and whether an international transfer or additional safeguards need to be addressed. The exact responsibilities depend on the client’s role and the processing context; the European Commission’s GDPR guidance is a useful starting point, not a substitute for project-specific legal advice.

AI must be assessed by what it does and where it is used

For AI features, I start by identifying the system’s purpose, the people affected, the data involved, and the roles of the provider and deployer. Then I check which requirements apply, including the EU AI Act’s risk-based obligations and transparency duties where relevant. A support chatbot, a tool that ranks job applicants, and an AI component embedded in a regulated product do not raise the same questions. Human review, traceability, documentation, and clear user information should be built into the design when the use case calls for them.

My commitment is to develop AI solutions for products and projects operating in the EU with applicable EU and national rules in view, and to surface unresolved compliance questions early. No general statement can certify every deployment: classification, contracts, data practices, and sector-specific rules matter. Clients remain responsible for decisions assigned to them as controllers, providers, or deployers, with specialist legal counsel involved where appropriate.

For reference: the European Commission’s overview of EU copyright rules is at https://digital-strategy.ec.europa.eu/en/policies/copyright. These links are starting points; project obligations depend on the facts and applicable law.