A lawful basis must be established before processing begins and should be documented. If no lawful basis applies then the processing will be unlawful and in breach of the GDPR principles.

“I don't really see that much additional in the AI act to what GDPR already provides. The principles are exactly the same, principles of transparency, security, and consent” she said. There ...