Inferential Capability Does Not Determine Legal Scope

The research highlights a critical divergence in how 'inference' is treated by two key EU digital regulations: the AI Act and GDPR. The AI Act uses inferential capability to define AI systems for regulation, while GDPR governs inference protectively based on its impact on individuals, regardless of the technology's classification as AI. This non-concentric regulatory approach creates complexity, particularly with the emergence of agentic architectures, suggesting that inferential capability alone is insufficient to determine legal scope.

Why it matters

This analysis reveals a fundamental ambiguity in the regulatory landscape concerning AI and data protection within the EU. Understanding the distinct yet overlapping interpretations of 'inference' is critical for developing compliant technologies and operational strategies, particularly as AI systems become more autonomous and integrated with personal data processing.

Key insights

• The EU AI Act defines AI systems based on their capability to infer, differentiating them from conventional software.
• The GDPR regulates the consequences of inference on individuals, stemming from personal data processing, irrespective of whether the technology is classified as an AI system.
• The regulatory perimeters of the AI Act and GDPR regarding inference are not aligned.
• The non-coincidence of these regulatory scopes becomes operationally acute with agentic architectures.
• Inferential capability is not presented as the sole determinant of legal scope within the context of EU digital law.

Source

arXiv — Computers and Society — https://arxiv.org/abs/2608.10601