Stakeholders who have had to get to grips with the GDPR will find many of the concepts in the Regulation familiar. From the risk-based approach, to the requirements around transparency and information provision as well as record-keeping, territorial scope and enforcement, cybersecurity and data governance, there are recognisable requirements. The Regulation defines an AI system as "software that is developed with one or more of the techniques and approaches listed in Annex I and can, for a given set of human-defined objectives, generate outputs such as content, predictions, recommendations or decisions influencing the environments they interact with". The Regulation takes a risk-based approach to AI systems. Some types of AI as set out in Title II, are considered to carry unacceptable risk and are prohibited.

International law firm Taylor Wessing is implementing artificial intelligence (AI) across the organisation and wants to ensure staff have the necessary skills to make the most of the technology. Businesses have identified a serious AI skills gap, which 69% of enterprises have described as "moderate, major or extreme" due to the difficulty involved in finding skilled people to staff their new AI-driven business models. According to Kevin Harris, IT director at Taylor Wessing, AI has the potential to greatly reduce the time lawyers spend reviewing documents, many of which can be hundreds of pages long and filled with technical legal jargon. "We are using [AI] quite extensively in looking at things like lease reviews. We've got large document stores where there's a myriad of quite complex legal terms and the AI is really helping us sort those legal terms out," he said.