Skip to main content

European Artificial Intelligence Act (AI Act)

Jump straight to Avatar compliance regarding the AI Act

The Artificial Intelligence Act (AI Act) is the world's first comprehensive legislation on AI. Entering into force in August 2024, it aims to ensure that AI systems used in the EU are safe, transparent, traceable, non-discriminatory, and environmentally friendly, while encouraging innovation.

Risk-Based Approach​

The AI Act classifies AI systems according to the level of risk they pose to individuals' rights and safety:

  • Unacceptable Risk: Prohibited systems (e.g., social scoring, cognitive manipulation).
  • High Risk: Systems used in critical infrastructure, education, employment, essential services, or law enforcement.
  • Limited Risk: Transparency obligations (e.g., chatbots).
  • Minimal Risk: The vast majority of systems (e.g., video games, spam filters).

Data Governance for High-Risk Systems​

This is the core regulation for model developers. According to Article 10 of the AI Act, high-risk AI systems trained on data must comply with strict data governance and management requirements.

“Training, validation and testing data sets shall be subject to appropriate data governance and management practices.”

These practices must ensure that data sets are:

  • Relevant, representative, free of errors and complete (Art. 10, paragraph 3).
  • Examined to detect possible biases (Art. 10, paragraph 2, f).

The Challenge of Using Personal Data (GDPR vs AI Act)​

Training models on real data poses a double legal challenge:

  1. GDPR Compliance: Processing personal data for training requires a solid legal basis and compliance with the minimization principle.
  2. AI Act Compliance: Article 10 requires high-quality and representative data sets, which often necessitates large volumes of varied data.

Article 4a sets out a notable exception regarding sensitive data (special categories of personal data). It was introduced by Regulation (EU) 2026/1744 (Digital Omnibus on AI), in force since 27 July 2026, which deleted the former Article 10(5):

“To the extent strictly necessary to ensure bias detection and correction in relation to high-risk AI systems [...], providers of such systems may exceptionally process special categories of personal data, subject to appropriate safeguards for the fundamental rights and freedoms of natural persons.”

This exception is subject to cumulative conditions. The first one is that “the bias detection and correction cannot be effectively fulfilled by processing other data, including synthetic or anonymised data” (Art. 4a(1)(a)). The records of processing activities must also explain “why that objective could not be achieved by processing other data” (Art. 4a(1)(f)). Article 4a(2) extends these conditions to providers and deployers of other AI systems and models, and to deployers of high-risk AI systems.

The text therefore explicitly requires synthetic or anonymised data to be considered first. Using raw personal data remains a high risk factor for non-compliance.

This also constitutes a major security risk identified by ANSSI (French National Cybersecurity Agency). In its security recommendations for generative AI systems, the agency highlights that trained models can memorize and regurgitate sensitive data in the event of an attack. To reduce these risks, ANSSI explicitly mentions the use of synthetic data as a relevant protective measure, recommending that models be trained only with data whose sensitivity is consistent with the access rights of end-users (Recommendation R18).

Training high-risk models therefore raises a business challenge: how to freely exploit the full potential of data without exposing the company to legal or security risks.

Regulatory Sandboxes​

Article 53 and following establish regulatory sandboxes for AI. These are controlled environments that facilitate the development and testing of innovative AI systems under the supervision of competent authorities before they are placed on the market.

The goal is to enable innovation while ensuring compliance with the GDPR and the AI Act. Access to quality data in these environments is crucial. The provision of anonymous data facilitates the implementation of these sandboxes.

The Avatar method reconciles the quality requirements of the AI Act with privacy imperatives (GDPR). The method is therefore perfectly suited for training high-risk systems.

Octopize's synthetic data generation method positions itself as a strategic compliance lever for AI providers. It allows meeting the requirements of Article 10 while activating the value of personal data. The anonymous nature of the generated data unlocks the full business potential of the original data by removing barriers related to personal data processing.

1. Compliance through Anonymity (Exiting GDPR)​

Since the avatar method allows to generate anonymous data (non-personal), the generated data sets are no longer subject to the GDPR. This allows Data Scientists to use this data for training, validation, and testing without requiring the consent of the original individuals, thus lifting legal barriers and speeding up innovation.

2. Quality and Representativeness (Art. 10 §3)​

The AI Act requires data to be "relevant, representative, and complete." Unlike classic anonymization techniques (such as masking or strong generalization) which destroy data utility, the Avatar method preserves original statistical properties. Models trained on our synthetic data perform equivalently to those trained on real data, guaranteeing the technical compliance required by Europe.

3. Bias Correction (Art. 10 §2)​

Synthetic data generation allows for rebalancing data sets (e.g., increasing the representation of a minority class) to mitigate algorithmic biases. This directly addresses the obligation to detect and correct biases imposed by the AI Act, while protecting the privacy of the individuals concerned.

In summary, using the Avatar method for the AI Act allows you to:

  • Eliminate legal risks related to the use of personal data (GDPR).
  • Guarantee model performance thanks to statistical preservation.
  • Demonstrate responsible data governance, a key criterion for CE certification of high-risk AI systems.
  • Accelerate Time to Market by reducing the R&D cycle by 50% (access to data often takes 6 to 18 months).
  • Increase AI Performance. The Avatar method allows for the generation of augmented and balanced datasets, improving model robustness and accuracy.
  • Reduce Operational Costs. Using anonymous synthetic data lowers cybersecurity costs and secure storage expenses.