Data and technology
The artificial intelligence you already use, and the data it processes
The EU Artificial Intelligence Act applies in stages and does not reach only those who develop the technology: it also binds the company that merely uses third-party tools, which is the position most are in. The obligations depend on the specific use made of each system, not on the sector you are in.
Underneath that sits something older and more common: contracts with technology suppliers that nobody read, personal data processed without a clear legal basis, and work generated with tools whose ownership has never been settled.
What we review
Inventory of systems
Which tools are actually used in the company, what for, and with what data —including those each department has brought in on its own. Without that inventory no risk can be classified.
Use of AI in decisions about people
Candidate screening, performance assessment, monitoring of work activity: this is where the obligations are most demanding and where conflict with the workforce arrives soonest.
Internal use policy
What an employee may do with these tools and what information they must not put into them, with the training and the records that evidence that the policy was communicated.
Supplier contracts
Software licences and cloud services, data processing agreements, service levels, use of your data to train the supplier’s models, and what happens to the information the day the contract ends.
Data protection
Record of processing activities, legal bases, information to data subjects, transfers outside the European Union, and response to a security breach, which has a short deadline.
Ownership of what is generated
Who owns the software, the database or the material produced with third-party tools, and what has to be agreed with employees and external suppliers for the company to be the actual owner.
When a consultation is worthwhile
Specific situations in which a short conversation before deciding avoids, in most cases, later proceedings.
- You are going to implement an artificial intelligence tool in some company process.
- You already use one to screen CVs or to assess staff.
- A supplier has access to your clients’ data and the contract does not say what they may do with it.
- You want to use the data you hold for a purpose other than the one it was collected for.
- You have suffered unauthorised access or a loss of information.
- You develop software or sell a digital product and it is not clear who owns it.
Fees and conduct of the matter
A fixed quote per piece of work, or a monthly retainer where the volume justifies it. The amount and its scope are settled in writing before each piece of work begins.
Conduct of the matter rests with Josep or María Doménech Aviñó, registration nos. 12.981 and 20.288 of the Valencia Bar Association (ICAV). You deal directly with the lawyer handling the file.
Everything you tell us is covered by the duty of legal professional privilege under article 542.3 of the Spanish Judiciary Act (Ley Orgánica del Poder Judicial), including at the first consultation and even if you do not go on to instruct us.
Let us talk about your specific case
Tell us your situation and we will explain how we would approach it and what documentation is required. We reply within 24 working hours.