AI, Machine Learning & Big Data Laws and Regulations 2023, Greece – An ICLG publication contributed by Marios Sioufas

September 20, 2023

The team has also developed with the addition to its clientele of a major Technology Transfer Office of one of the biggest universities in Greece. The variety of the IP matters in this regard has expanded tremendously, including patents, trade secret protection, agreements with inventors and other institutions and companies with respect to research and development.

In this regard, the in-depth knowledge and expertise in the field of IP has set the practice apart from other firms.

To download this chapter FREE


Marios Sioufas

Sioufas & Associates Law Firm is one of the biggest Greek law firms, with a wide portfolio of clients. The law firm was founded in 1999 and operates in Greece, Romania. The offices are based in Athens, Thessaloniki, Patras, and Bucharest. The firm’s Intellectual Property practice has skyrocketed in the last few years, with trademarks, designs and patents at the core of both advising and litigation. Numerous trademarks and designs filings have taken place over the last few years, both on a national and European level. Advising on availability issues of IP rights and avoidance of possible conflicts with existing rights has become an integral part of the Intellectual Property Practice.

1. Trends

The Information and Communications Technology sector is one of the most promising in the Greek economy, driven mostly by the demand for automation and digitalisation in the Greek public and private sectors. During the last few years, Greece became the centre of several important investment initiatives announced by some of the largest companies in the global ICT industry such as Microsoft, Nokia-Siemens, Oracle ZTE, Samsung Huawei, SAP, Unisoft and others.

Greece is currently developing its national AI strategy. This strategy will be centred around the vision for Greece to become the world’s laboratory for democratising AI in a sustainable way. The Hellenic Ministry of Digital Governance is coordinating the development of the national AI strategy, involving major stakeholders in Greece, as well as experts from within the country and the EU. AI is recognised as one of the main strategic axes of the Digital Transformation Bible, the flagship policy report that drives the digital transformation in Greece. In one of its chapters, this flagship report highlights the scope and objective areas of the national AI strategy in Greece: determining the conditions for the development of AI, including the skills and trust framework, the data policy as well as the ethical principles for its safe development and use; describing national priorities and areas for maximising the benefits of AI to meet societal challenges and economic growth; and analysing the necessary actions related to the above priorities and proposing horizontal interventions, as well as at least one pilot application per policy area.

AI is developing fast, and the technique of Machine Learning (ML) is leading. There is a substantial increase in investments and in this regard, start-ups play an important role. The new legislation on spin-offs L.4864/2021 has contributed significantly to this end. Business is leading, while academia is following. There is a fast increase in jobs and education/training, especially for AI experts and consultants, ML and Deep Learning (DL) specialists and engineers, software engineers, as well as data analysists, engineers, architects and scientists.

The telecommunications sector is utilising AI technologies for many functions, such as customer service, network analytics, connections quality and service improvement. By the same token, the Banking and Insurance sector performs fraud detection optimisations and customer analysis based on financial status and commercial behaviour. In general, industries are also forecasting the demand for their products, optimising the production process, i.e. securing the quality of the production and performing proactive maintenance of the production as well. By the same token, the energy sector is using AI analytics, especially for fuels and forecasting the parameters that affect refining. Logistics and robotics are also on the rise through AI applications that affect the ordering procedures. Besides the health sector, which is leading with AI solutions (estimating risks for clinical trials and Internet of Things (IoT) devices), the use of chatbots is increasingly spreading, whereby companies are looking to advance their customer service. Greece has also recently enacted a legal framework for the testing of self-driving cars.

The proposed AI Act (COM (2021) 206 final) is intended to regulate the development and use of AI by providing a framework of requirements and obligations on its developers, deployers and users, together with regulatory oversight. The framework is structured by a risk-categorisation for AI (a sociological approach) with ‘high-risk’ systems subject to the most stringent obligations, and a ban on ‘unacceptable-use’ systems. Recent proposed changes of the EU Council include:

  • a narrower definition of AI systems to cover systems developed through ML approaches and logic, and knowledge-based approaches;
  • private sector use of AI for social scoring is prohibited, as are AI systems that exploit the vulnerabilities, not only for a specific group of persons, but also persons who are vulnerable due to their social or economic situation;
  • clarification of when real-time biometric identification systems can be used by law enforcement;
  • clarification of the requirements for high-risk AI systems;
  • new provisions relating to the general purpose of AI and where that is integrated into another high-risk system; and
  • increased emphasis on transparency, including a requirement to inform people exposed to emotion-recognition systems.

Lastly, it must be pinpointed that according to the draft EU AI Act, the providers of ‘foundation models’ will need to abide to specific rules, including declaring that an output is AI generated, checking for foreseeable risks and biases, implementing data governance measures and providing specific documentation, etc. Importantly, and with respect to Intellectual Property (IP) and trade secrets, they will also be required to make a summary of the use of training data protected under copyright law publicly available. Furthermore, open-source is now explicitly mentioned in the newly amended proposal. While the requirements related to foundation model providers are also applicable to open-source models, the current proposal now states that the regulation does not apply to open-source AI components (except if put on the market as part of a high-risk system).

2 Ownership/protection

An algorithm can be regarded as consisting of a logic component, which specifies the knowledge to be used in solving problems, and a control component, which determines the problem-solving strategies by means of which that knowledge is used. The logic component determines the meaning of the algorithm, whereas the control component only affects its efficiency. (Kowalski, R. (1979). Algorithm = Logic + Control. Communications of the ACM, 22(7), 424–436).

The first choice of protection for algorithms, AI technologies and applications is trade secret protection, although such a choice is risky. Trade secrets are protected according to Art. 22 of L.1733/1987, which implemented Directive (EU) 2016/943 on the protection of undisclosed know-how and business information. For protection to subsist, the information must be secret, have a commercial value and, more importantly, the owner must have taken certain organisational and technical measures for the protection of the trade secret. The use of the generic label of ‘information’ does not impose any restriction on the nature of the object to be protected: data, data structures and certain aspects of DL applications may therefore fall within the scope of protection of the law. Also, the information associated with large-scale models is of indisputable commercial value and the specific set of parameters obtained after training is not generally known. According to a 2018 report by the European Union Intellectual Property Office, ‘Where innovation does not fulfil the requirements of patentability, trade secrets become a pivotal tool for companies to protect their business knowledge’. Still, trade secrecy does not create an exclusive right and issues of reverse engineering may limit the deployment of such models. In particular, as stated in point 16 of the preamble of the Trade Secret Directive: ‘Reverse engineering of a lawfully acquired product should be considered as a lawful means of acquiring information, except when otherwise contractually agreed’.

Secondly, according to the Software Directive 2009/24/EC, a computer program shall be protected if it is original in the sense that it is the author’s own intellectual creation. No other criteria shall be applied to determine its eligibility for protection. In addition, preamble 7 of the Directive states that the term ‘computer program’ shall include programs in any form, including those which are incorporated into hardware. This term also includes preparatory design work leading to the development of a computer program provided that the nature of the preparatory work is such that a computer program can result from it at a later stage. The same provisions apply in Greece, by virtue of L.2121/1993 (Art. 2 par. 3).

In this regard, protection applies to all forms of expression of a computer program, but the ideas and principles underlying any element of a computer program, including those underlying its interface systems, shall not be protected by copyright under the Directive. According to this principle of IP, to the extent that logic, algorithms and programming languages contain ideas and principles, those ideas and principles are not protected.

The architecture and the training process of the AI application, with its components, are expressed in a programmable form. Input, training and output data are coded functions and this architecture is usually a set of instructions. Therefore, such a set of functions could be considered as a ‘computer program’. However, there can be no ‘intellectual input’ or ‘free creative choices’ if these choices are strictly algorithmic and are dictated by the functional constraints to be met during an optimisation process (Jean-Marc Deltorn – The elusive intellectual property protection of trained machine learning models: a European perspective). As stated in the Football Dataco decision, since ‘[the] author expresses his creative ability in an original manner by making free and creative choices’, the criterion of originality is not satisfied where the production of the work is only ‘dictated by technical considerations, rules or constraints which leave no room for creative freedom’.

Thirdly, according to Art. 7(1) of Directive 96/9/EC, the producer of a database ‘which shows that there has been qualitatively and/or quantitatively a substantial investment in either the obtaining, verification or presentation of the contents’ has the right to prohibit the extraction or re-utilisation of a substantial part of the contents of that database. The sui generis right (SGR) was transposed into Greek Law, by virtue of Arts 3 and 45 A of L.2121/1993. However, in the European Court of Justice case C-203/02 (British Horseracing) it was held that ‘the expression ‘investment in […] the obtaining […] of the contents’ of a database as defined in Art. 7(1) of the directive must be understood to refer to the resources used to seek out existing independent materials and collect them in the database. It does not cover the resources used for the creation of materials which make up the contents of a database’. With regard to AI systems, weights selection and related data, the distinction between ‘creation’ and ‘obtention’ is obscure and therefore protection would not be justified. In addition, according to CJEU decisions, the elements of a database (works, data or other materials) must be ‘independent’, and it is not clear how an AI model would satisfy this condition as well.

With regard to patents, they are protected by virtue of L.1733/1987, as amended, provided that they are new, involve an inventive step and are capable of industrial application. If a computer program produces an additional technical result, it is protected as a patent (Art. 52(2) of the European Patent Convention (EPC)). Mathematical methods are excluded from patentability (Art. 52(2)(a) of the EPC) if no technical result/effect is produced/valued. AI and ML are based on computational models and algorithms for classification, clustering, etc. These models and algorithms, being mathematical in nature, can be ‘trained’ on the basis of specific data. On a case-by-case basis, therefore, if the claimed subject matter is technical (Art. 52 of the EPC), it can be protected as a patent.

3 Antitrust/competition laws

Data is considered as the new oil of the 21st century. The role of data in the building, extension and consolidation of digital ecosystems is major. On the other hand, there are risks associated to the Big Tech entries in banking, insurance and health markets.

Certain use of AI systems and AI algorithms could pose a risk and violate Greek antitrust Laws. An example could be the use of AI to directly or indirectly fix pricing among competitors, with the combination of ML and Big Data without obvious collusion. The use of new technologies in digital markets may raise abuse of dominance issues, as there are potential theories of harm covering a range of exploitative and exclusionary abuses. AI technologies can have a great impact on consumer welfare and liberty of choice through personalisation, exploitative strategies, choice manipulation and exclusion from the market. The competitive risks are dominant position entrenchment (reduced contestability) and an unlevel playing field (distortions).

On an EU level, the following cases are noted:

  • A case related to asymmetrical access to data between keystones and complementors (see the EU Commission/Amazon case settled through a commitment procedure).
  • An exclusionary case related to algorithms manipulations (see the Google Shopping demoting case).
  • Exploitative abuses through contractual architecture (see the Amazon case: data analytics services, pay for prominence in rankings proposals, Buy Box eligibility conditions).

4 Board of directors/governance

No specific provisions apply with regard to the application of AI into corporate governance.

5 Regulations/government intervention

Greece recently enacted L.4961/2022 with regard to emerging technologies, whereby many relevant topics are covered such as 3D printing and copyright, smart contracts and Distributed Ledger Technology. On the forefront of this new legal framework is AI.

Firstly, it is highlighted that the processing of personal data when using an AI system is in no way affected by this new legislation. Indeed, the regulation and protection of personal data is still governed by the relevant existing framework, that is the GDPR and L.4624/2019.

Secondly, it is expressly stated that the entities of the public domain are expressly permitted, during the exercise of their duties, to use AI systems that affect the rights of natural or legal persons, either for the procedure of decision-making or for the support of the procedure of decision-making, or for issuing relevant acts. Such specific use, however, must previously be expressly foreseen by a special provision of Law that contains sufficient safeguards for the protection of respective rights.

Thirdly, the above-mentioned entities must perform an algorithmic impact assessment before the deployment of the AI system. It is pinpointed that this assessment does not overlap with the obligation to perform a data protection impact assessment, according to Art. 35 of the GDPR. The algorithmic impact assessment must take into account the following information: (a) the purpose pursued, including the public interest served by the use of the system; (b) the capabilities, technical characteristics and operating parameters of the system; (c) the type and categories of decisions taken or the acts adopted involving, or supported by, the system; (d) the categories of data collected, processed or entered into or generated by the system; (e) the risks that may arise for the rights, freedoms and interests of the natural or legal persons concerned or affected by the decision-making; and (f) the expected benefit to society as a whole in relation to the potential risks and impacts that the use of the system may entail, in particular for racial, ethnic, social or age groups and categories of the population such as people with disabilities or chronic diseases.

In addition, the notion of transparency is further enhanced (i.e. apart from the application of Arts 12–14 of the GDPR), since the following information must be publicly provided: (a) the time when the system becomes operational; (b) the operational parameters, capabilities and technical characteristics of the system; (c) the categories of decisions taken or acts adopted involving or supported by the system; and (d) the performance of an algorithmic impact assessment.

The entities of the public domain must ensure in this regard that every natural or legal entity affected by the decision or the act is aware of the parameters on which the decision was based in an understandable (principle of explainability) and easily accessible form.

The National Authority for Transparency (ΕΑΔ) is appointed thereof as the responsible entity for receiving, handling and evaluating any relevant complaint for the transparency of the AI system.

Moreover, the following three authorities are being set up by the new legislation: (a) the Co-ordinating Committee for AI, the mission of which is to co-ordinate the application of the National Strategy for the development of AI; (b) the Observatory Committee of the National Strategy for the development of AI, which is an executive body of the Co-ordinating Committee for AI, one of its roles is to record the implementation of the national strategy; and (c) the Observatory of AI, the mission of which is to collect data on the application of the National Strategy for the development of AI. It is also responsible for the submission and updating of respective Key Performance Indicators.

Finally, the entities of the public domain are burdened with the obligation to keep an updated registry of the AI systems they use. This registry must be notified to the ΕΑΔ, if so requested.

The registry must contain the following information: (a) the purpose to be achieved, along with the public interest sought to be served with the use of AI system; (b) the time of deployment; (c) the operational parameters, capabilities and technical characteristics of the system; (d) the basic information of the system, i.e. trade-title, version, and producers’ data; (e) measures for the safety of the system; and (f) the completion of an algorithmic impact assessment or an data protection impact assessment, if necessary.

With regard to data, the Text and Data Mining (TDM) Exception was introduced by Arts 3 and 4 of EU Directive 2019/790. This reform was transposed into Greek Law by L.4996/2022, which amended L.2121/1993. Since data is crucial for AI, TDM is essential because it enables a fast processing of huge amounts of text and data. Also, TDM is an important tool for research of all kinds. However, on the other side, TDM may result in possible infringement of the right of reproduction (copyright) and of the sui generis database right. The following are the common steps in TDM processes: (a) access to content (freely or through a licence); (b) extraction and/or copying of content, if required; and (c) mining of text and/or data and knowledge discovery, which requires the pre-processing of relevant text and data and extraction of structured data, to then analyse such output.

The entities benefitting from this TDM Exception are research organisations and cultural heritage Institutions, i.e museums, libraries, public broadcasting organisations, on the condition of lawful access to the data (through licensing for example), and of scientific research for the specific purpose of both research and storage. The law also provides for a possibility for data storage if an appropriate level of security is guaranteed. In addition, any user may benefit from the TDM Exception on the condition that there is lawful access to the data (through licensing for example). However, right holders may ‘opt out’ from this exception and limitation by expressing reservation of their respective use. Moreover, the duration of the storage must be limited for the purposes of TDM.

The notions of scientific research and its beneficiaries seem problematic since they are too limited and some important beneficiaries are left outside (i.e. start-ups, individual researchers, SMEs, journalists). Furthermore, the exclusion of the commercial interest does not reinforce a competitive landscape.

It is also debated as to the extent that the EU Directive 96/9 on the SGR applies on AI inference models. Art. 7 specifies that Member States shall provide for a right for the maker of a database which shows that there has been, qualitatively and/or quantitatively, a substantial investment in either the obtaining, verification or presentation of the contents to prevent extraction and/or re-utilisation of the whole or of a substantial part, evaluated qualitatively and/or quantitatively, of the contents of that database. However, investment in a database must refer to the finding and collecting of existing data. It cannot refer solely to data creation. The training process of AI models consists of defining (i.e. ‘creating’, through the process of ML) the values of the parameters that constitute the model.

Also, Art. 35 of the EU Data Act proposal states that the sui generis database right protection does not apply to databases containing data from or generated by the use of devices connected to the IoT. This may have a significant impact on SGR protection. In particular, if it excludes from the scope of protection any database containing machine-generated data (cf. Art. 35 ‘data obtained from or generated by the use of a product or a related service’) such databases, comprising a mixture of machine-generated data and other ‘obtained’ data will not be protected. That is, the sui generis protection would no longer be available to someone who has made a substantial investment of human, financial or technical resources in verifying and/or presenting data in a database, simply on the basis that it ‘contains’ machine-generated data.

On another note, the proposal for the harmonised rules on fair access to and use of data (the Data Act) provides for a framework on making data generated by the use of a product or related service available to the user of that product or service, on the making data available by data holders to data recipients, and on the making data available by data holders to public sector bodies or Union institutions, agencies or bodies, where there is an exceptional need for the performance of a task carried out in the public interest. This proposal, being part of the initiative in the context of the EU’s Data Strategy, solidifies data as a non-rival good. It introduces new access rights to personal and non-personal data for users of hardware ‘products’, often labelled as IoT devices. It also extends portability rights to non-personal data and to users who are not data subjects and introduces quasi IP rights, such as rights to remuneration for product manufacturers and de facto data holders. However, it is debated which kind of data shall be made accessible, especially with regard to ‘raw data’, ‘prepared data’, ‘derived’, ‘inferred’, and/or ‘aggregated’ data.

6 Implementation of AI/Big Data/ML into businesses

From the private sector point of view, the above-mentioned registry obligation under L.4961/2022 (in electronic form) is also required from medium to large size (classification according to L.4308/2014) entities.  Such obligation, however, applies exclusively to the following two areas: (a) the compilation of profiles for consumers; and/or (b) the evaluation of all kinds of employees and/or collaborating natural persons. 

For each AI system, the registry, which must be kept by each entity, must contain the following information: (a) a description of the operating parameters, capabilities and technical characteristics of the system; (b) the number and status of the natural persons concerned or likely to be concerned; (c) the technical information relating to the supplier or external partners involved in the development or operation of the system; (d) the period of operation of the system; and (e) the measures taken to ensure their safe operation.

More importantly, such private entities are also obliged to establish and maintain an ethical data use policy, which shall include information on the measures, actions and procedures it applies in relation to data ethics in the use of systems of AI.

As far as transparency is concerned, companies that use AI systems that affect any decision-making process with regard to employees and prospective employees and concern the employment conditions and/or the selection, recruitment or evaluation process, must provide sufficient and explicit information, before the use of the system.  This information must contain at a minimum the parameters on which the decision is based, without prejudice to cases which require prior consultation with the employees.  To this end, private entities must ensure compliance with the principle of equal treatment and the fight against discrimination in employment on the grounds of sex, race, colour, national or ethnic origin, genetic features, origin, religious or other beliefs, disability or chronic illness, age, marital or social status, sexual orientation, gender identity or gender characteristics.

7 Civil liability

The Greek Civil Liability legal framework is comprised of L.2251/1994 on the protection of consumers and the Greek Civil Code which contains provisions with regard to the sale of goods and defective products (in particular Arts 513, 522, 534, 540, 543) and tortious liability (Art. 914).  EU Directive 85/374 concerning liability for defective products has been transposed in Greece through the same L.2251/1994.  In any regard, contractual liability and general tort liability for AI products persist.

Currently, there are two proposals for AI liability.  The first is to reform Directive 85/374 (PLD) which mainly concerns the producers’ liability; and the second is the creation of a new Directive on AI Liability COM (2022) 496 final (AILD).

The proposal for the new PDL has the following main amendments, i.e. an extended product definition, a redefinition and expansion of the concept of defect, the inclusion of the concept of data in the scope of protected legal assets, the expansion of the responsible parties and, most importantly, the easing of the burden of proof in favour of damaged parties.  Such extended liability concerns are not only for AI products, but for all products in general.  According to the draft Art. 4 (1) of the PLDP, ‘product means all movables, even if integrated into another movable or into an immovable’ … ‘including electricity, digital manufacturing files and software’.  While there is no reference specifically to AI, software products and applications are included in general.  Furthermore, according to draft Art. 6, there is an extended concept of defectiveness, whereby the product is defective if it does not meet the safety expectation of the public at large.  In addition, the draft legislation introduces an extended definition of the manufacturer by Art. 7 (1), i.e. all manufacturers of defective products and component manufacturers.  A component is any item, whether tangible or intangible, or any related service, that is integrated into, or inter-connected with, a product by the manufacturer of that product or within that manufacturer’s control.  As far as the burden of proof is concerned, though it remains unaltered and the burden and causality lies on the injured party, the proposal of Art. 9 of the PLD provides for certain evidence facilitations.  That is, the following rules are introduced, i.e. a presumption of defectiveness (Arts 9(2)), a presumption of causality (9(3)), and that all presumptions are rebuttable (9(5)).  

On the other hand, the AILD does not seek to harmonise liability laws in general, but is complementary to the EU AI Act.  While it remains with national laws to provide the basis for non-contractual liability for fault (Art. 1 par. 2), the AILD focuses on evidence facilitation by providing the right of access to evidence, (Art. 3 paras 1–4), the presumption of fault for refusal of access, (Art. 3 par. 5), the presumption of causality in case of established fault, (Art. 4) etc.

The right of access to evidence applies to providers and users of high-risk systems, (Art. 3 (1)).  An AI system needs to be ‘suspected’ of having caused damage and the plaintiff must have ‘undertaken all proportionate attempts at gathering the relevant evidence from the defendant’ (Art. 3 (2)).  Such right, however, should be counterbalanced by the necessity and the proportionality of the disclosure and the potential protection of trade secrets must be also taken into account.  For the rebuttable presumption of causality, the AILD provides that there is presumed causality between the breach of duty (Arts 10, 13–16 of the AI Act) by the provider/user and the output of the AI system.  There is no presumed causality between the output of the AI system and the damage/violation of legal interests.

The AI liability directive concerns ‘extra-contractual’ civil liability rules, i.e. rules providing a compensation claim irrespective of a contractual link between the victim and the liable person.  The rules would ensure that any type of victim (individuals or businesses) can be compensated if they are harmed by the fault or omission of a provider, developer or user of AI resulting in a damage covered by national law (e.g. health, property, privacy, etc.).

The revised PLD proposal aims to modernise the existing EU no-fault-based (strict) product liability regime and would apply to claims made by private individuals against the manufacturer for damage caused by defective products.  In contrast, the new AI liability directive proposes a targeted reform of national fault-based liability regimes and would apply to claims, made by any natural or legal person against any person, for fault influencing the AI system that caused the damage.

8 Discrimination and bias

According to Art. 21 of the EU Charter of Fundamental Rights, on non-discrimination, ‘Any discrimination based on any ground such as sex, race, colour, ethnic or social origin, genetic features, language, religion or belief, political or any other opinion, membership of a national minority, property, birth, disability, age or sexual orientation shall be prohibited’.

From a privacy perspective, the following two principles of the GDPR apply, that is, under the principle of data accuracy, data must be kept accurate and data controllers must take proactive measures to ensure that the data are properly updated.  This principle applies to AI, with regard to the prevention of discrimination.  Input and training data must be accurate in relation to the intended purpose, in the sense that they must not lead to discrimination.  Thus, training data must be selected very carefully, after a process of data labelling or cleaning.

More importantly, under the lawfulness principle, it is extremely important with regard to AI that data controllers must consider the effect of the use of AI and the possible effects of the processing and prevent any undesirable consequences.

A typical example is profiling and any discrimination that may arise.  In the case of automated decision-making and profiling, important information must be provided to the data subject about the rationale behind the decision-making process (Arts 13 and 14 GDPR), in particular when legitimate outcomes for the data subject are produced (Art. 22).  However, the European Data Protection Board guidelines extend this obligation to all processing operations involving automated decision-making.

In addition, according to the High Level Expert Group on AI and the issued Ethics Guidelines for Trustworthy AI, the development, deployment and use of AI systems should meet seven key requirements: (1) human agency and oversight; (2) technical robustness and safety; (3) privacy and data governance; (4) transparency; (5) diversity, non-discrimination and fairness; (6) environmental and societal well-being; and (7) accountability.

Technical and non-technical methods should be considered to ensure the implementation of those requirements.  The requirement of equality, non-discrimination and solidarity includes the rights of persons at risk of exclusion.  Equal respect for the moral worth and dignity of all human beings must be ensured.  This goes beyond non-discrimination, which tolerates the drawing of distinctions between dissimilar situations based on objective justifications.  In an AI context, equality entails that the system’s operations cannot generate unfairly biased outputs (e.g. the data used to train AI systems should be as inclusive as possible, representing different population groups).  This also requires adequate respect for potentially vulnerable persons and groups, such as workers, women, persons with disabilities, ethnic minorities, children, consumers or others at risk of exclusion.

Data sets used by AI systems (both for training and operation) may suffer from the inclusion of inadvertent historic bias, incompleteness and bad governance models.  The continuation of such biases could lead to unintended (in)direct prejudice and discrimination against certain groups or people, potentially exacerbating prejudice and marginalisation.  Harm can also result from the intentional exploitation of (consumer) biases or by engaging in unfair competition, such as the homogenisation of prices by means of collusion or a non-transparent market.  Identifiable and discriminatory bias should be removed in the collection phase where possible.  The way in which AI systems are developed (e.g. algorithms’ programming) may also suffer from unfair bias.  This could be counteracted by putting in place oversight processes to analyse and address the system’s purpose, constraints, requirements and decisions in a clear and transparent manner.  Moreover, hiring from diverse backgrounds, cultures and disciplines can ensure diversity of opinions and should be encouraged.

To this end, according to the draft EU AI Act, high-risk AI systems should therefore be accompanied by relevant documentation and instructions of use and include concise and clear information, including in relation to possible risks to fundamental rights and discrimination, where appropriate.  Therefore, draft Art. 10 provides that high-risk AI systems which make use of techniques involving the training of models with data shall be developed on the basis of training, validation and testing data sets that meet certain quality criteria.  Training, validation and testing data sets shall be subject to appropriate data governance and management practices, which includes an examination in view of possible biases.  Human oversight (draft Art. 14) is therefore also of crucial importance.

To download this chapter FREE

Σιούφας & Συνεργάτες | Γιώργος Σιούφας | Μάριος Σιούφας

For More Info

Contact the secretariat of the Legal Services Directorate at telephone: 213 017 5600, or send an email to and we will contact you immediately.


Would you like to discuss our article further?
Please provide your contact information,
and one of our specialized associates
will contact you today
between 3:00 pm - 5:00 pm.