Legal prism — 2026-08-26

Under GDPR Article 83(5), infringements of specified GDPR provisions may be subject to fines of up to EUR 20,000,000 or 4% of worldwide annual turnover.

For prohibited AI practices, the cited compliance summaries identify maximum fines of EUR 35,000,000 or 7% of worldwide annual turnover.

Core issue

The immediate legal position is one of operational uncertainty: a company cannot determine its obligations under the AI Act until every deployed tool has been inventoried and classified.

• Because Article 50 transparency obligations are already in force, an undocumented vendor feature or business-unit tool may already constitute a compliance failure.
• The precise legal question is whether the business acts as a provider, deployer, importer, or distributor of an AI system placed on the EU market or used in the EU.
• The determinative rules are the AI Act classification categories: prohibited, high-risk, limited-risk, and minimal-risk applications.
• Article 50 determines immediate transparency obligations for certain AI interactions and for AI-generated or manipulated audio, images, video, and text.
• The evidence also links AI governance to data protection where automated processing affects individuals.
• Under GDPR Article 35(3)(a), a data protection impact assessment is required for systematic and extensive automated evaluation that produces legal or similarly significant effects.

Legal assessment

The AI Act is described as applying to companies that develop, purchase, or deploy AI systems in the European Union.

• It may also apply to non-EU companies where their systems are placed on the EU market or used within the EU.
• As an EU regulation, the AI Act is directly applicable in every Member State.
• The first practical obligation is visibility: identifying AI systems, including vendor features and shadow deployments.
• The second obligation is classification: determining whether each system is prohibited, high-risk, limited-risk, or minimal-risk.
• The high-risk areas identified in the evidence include employment, credit assessment, biometric identification, critical infrastructure, education, law enforcement, and migration.
• For higher-risk systems, the evidence supports technical documentation, controls, ownership records, monitoring, and periodic review.
• Article 50 creates current transparency obligations where users interact with AI or receive certain AI-generated or manipulated content.
• Employers and other users may also need to notify individuals about certain emotion-recognition and biometric-categorization systems.
• Other infringements may result in additional penalties, including failures relating to high-risk systems and the provision of false or misleading information to regulators.
• No case law is included in the evidence, so no precedent can be applied to this situation.

Consequences

The lowest-risk scenario is administrative: the company establishes an inventory, assigns owners, classifies systems, and integrates review into procurement and operations.

• The higher-risk scenario is an active breach: an undisclosed AI interaction or use of manipulated content already falls within Article 50.
• The most severe scenario concerns prohibited practices, for which the evidence indicates fines of up to EUR 35,000,000 or 7% of worldwide annual turnover.
• A company with EUR 600,000,000 in worldwide annual turnover would face a maximum percentage-based amount of EUR 42,000,000, exceeding the fixed EUR 35,000,000 amount.
• This has practical significance for EU businesses and for non-EU providers, deployers, importers, and distributors whose systems reach the EU market.
• Procurement teams also become part of compliance, because vendor AI features may determine classification and disclosure obligations.
• The evidence points to classification, risk mapping, documentation, and ownership assignment.

Because the Grand Chamber ordered release and quashing of the conviction, Türkiye now has a compliance obligation covering both custody and conviction.

Core issue

Osman Kavala’s position is no longer merely a detention dispute; the evidence indicates that his conviction itself is legally unsustainable.

• The evidence identifies the applicable rule as Türkiye’s obligation, as a Council of Europe member and party to the Convention, to implement binding judgments of the Court.
• The evidence also identifies the supervisory framework: the Committee of Ministers supervises the execution of, and compliance with, Court judgments. The cited EU instruments do not provide the operative enforcement route for this criminal human-rights judgment against Türkiye. Those provisions apply directly in every EU Member State, but the evidence does not link them to Kavala’s release.

Legal assessment

The Grand Chamber’s finding changes the practical legal burden on the Turkish authorities. The evidence states that the Court examined the indictment, charges, evidence, trial, appeals, and conviction, and then found a “flagrant denial of justice.”

• Türkiye’s required steps are immediate release, quashing of the conviction, and measures to remedy structural judicial shortcomings.
• Kavala’s right is not limited to a fresh review; the evidence states that the Court ordered his release at the earliest possible date and the quashing of his conviction.
• Judicial and prosecutorial authorities are expressly identified as authorities required to act.

The case law in the evidence is the Kavala line of European Court judgments. In December 2019, the Court found unlawful detention and an ulterior purpose of silencing him as a human-rights defender. In July 2022, the Court found that Türkiye had breached its obligation to abide by the 2019 judgment. The latest Grand Chamber judgment goes further because it covers the entire Gezi proceedings and the conviction. It also finds violations of the right to a fair trial, freedom of expression and association, and the prohibition of inhuman and degrading treatment arising from the aggravated life sentence. The cited EU rules show how different legal instruments address enforcement, but they do not displace the Convention mechanism described in the news report. Those Regulations apply directly in every Member State, yet the evidence provides no basis for treating them as governing this ECHR compliance dispute.

Consequences

For Kavala, the direct practical consequence is release without making it conditional on ordinary domestic criminal finality. For his conviction, the practical consequence is that the state must set it aside, not merely reconsider detention.

• For Türkiye, continued non-compliance would deepen an already established breach following the 2019 and 2022 judgments.
• For the Council of Europe, the next institutional pressure point is supervision and the use of available tools to secure implementation.
• For member states, the evidence supports concrete diplomatic demands for immediate release in dealings with Turkish authorities.

The broader legal significance is institutional rather than financial. The supported consequences are release, quashing of the conviction, remedial measures for judicial shortcomings, and intensified Council of Europe supervision. The next expected step is action by the Turkish authorities to release Kavala and set aside the conviction.

Article 35(3)(a) GDPR requires an impact assessment for systematic automated evaluation that produces legal or similarly significant effects.

Under Article 7, that authority may issue binding technical recommendations on the risk levels of AI systems.

Core issue

Colombian deployers would be in the most difficult position because the bill regulates the use of AI, even where control rests with foreign developers. Although Bill 025 of 2026 is currently only before the Colombian House of Representatives, it would make AI adoption a compliance exercise. The legal issue is whether Colombia can allocate AI-related duties on a risk-based basis without overburdening actors that lack technical control. The decisive provisions are Articles 5 and 7 of Bill 025 of 2026, together with the impact-assessment model reflected in Article 35 GDPR.

• Article 5 establishes the categories and general criteria for risk classification.
• Article 7 designates the Ministry of Science, Technology and Innovation as the national AI authority.

Legal assessment

The bill’s structure assigns duties to developers, providers and deployers according to the role they perform in relation to an AI system. Those duties include risk and impact assessments, transparency, human oversight and monitoring for systems affecting fundamental rights or protected interests.

• Providers are comparable to their counterparts under the EU model because they control documentation, risk management and proof of compliance.
• Deployers are comparable to their counterparts under the EU model because they control use, human oversight and monitoring.
• Colombian deployers may lack access to training data, architecture, evaluation procedures and internal safeguards for foreign closed models.

The GDPR is a Regulation and therefore applies directly in every Member State. Article 35(7) GDPR indicates what an assessment must contain: a description of the processing, necessity, proportionality, risks, safeguards and compliance mechanisms. Article 35(9) GDPR also supports obtaining input from affected persons where appropriate. The Colombian bill would centralise risk-classification authority in an executive body. Under Article 5, it may update high-risk uses by reasoned administrative act following public consultation. That design raises a due-process concern because risk classification triggers enhanced legal obligations and may affect deployment. The evidence indicates that final intervention measures remain with the authorities that hold the relevant legal powers. Even so, classification must remain linked to clear legislative criteria and effective review. The Inter-American Court’s judgment in Velásquez Rodríguez v. Honduras is relevant because formal rights require enforceable state conditions. Suárez Peralta v. Ecuador points in the same direction for duties that require monitoring, investigation and enforcement capacity. Applied here, impact assessments and audits have limited legal force without technical expertise, infrastructure, information and budget.

Consequences

The practical effect is not immediate sanctioning, because the bill is still pending before the Colombian House of Representatives. The market consequence is planning pressure for companies using AI in health, justice, security, surveillance and public services.

• Local deployers should expect scrutiny of human oversight, monitoring and impact assessment.
• Foreign providers are less clearly covered because the bill lacks the same clear extraterritorial reach as the EU AI Act.
• Public bodies would need technical staff, inspection mechanisms and cooperation channels before obligations become enforceable.

If enacted as described, the first disputes are likely to concern who controls the AI system and who can provide compliance evidence. A small Colombian company using a closed foreign model could be required to explain a system it cannot inspect. That mismatch is the bill’s central enforcement risk.