Inferential Capability Does Not Determine Legal Scope

Recent research from arXiv highlights a critical divergence in how 'inference' is defined and applied within EU digital law, specifically between the AI Act and the GDPR. The AI Act uses inferential capability to define regulated AI systems, while the GDPR governs inference protectively based on its impact on individuals, regardless of whether the technology is classified as AI. This creates non-concentric regulatory perimeters, which become operationally acute with agentic architectures, suggesting that mere inferential capability does not solely determine legal scope.

Why it matters

The divergence in legal definitions and regulatory approaches to 'inference' across critical digital laws creates significant operational and compliance complexities for organisations developing and deploying advanced technologies. Understanding these differing regulatory perimeters is essential for strategic planning, risk management, and ensuring legal compliance in the evolving landscape of AI and data protection.

Key insights

• The EU AI Act uses 'inferential capability' as a foundational criterion to distinguish regulated AI systems from conventional software.
• The GDPR, while not defining 'inference', regulates its outcomes protectively, focusing on the processing of personal data and its effects on individuals, irrespective of AI classification.
• The regulatory scopes of the AI Act and the GDPR concerning inference are not aligned or concentric.
• This non-alignment was less apparent in single-shot systems but becomes operationally critical with the rise of agentic architectures.
• The core thesis is that inferential capability itself does not determine the full legal scope of a technology or system.

Source

arXiv — Computers and Society — https://arxiv.org/abs/2608.10601