AI Compliance and Data Protection Insights for February 2026

AI and GDPR Monthly Update

February 5, 2026

Welcome to another edition of the AI & GDPR MONTHLY UPDATE, bringing you the latest insights into artificial intelligence and data protection. This update covers new AI regulations, opinions, court and authority decisions across the EU, and the latest use cases in AI implementation.

AI Act

The Prague High Court authorized the use of real-time remote biometric identification systems at the airport. This system utilizes AI to identify individuals of interest in public airport areas based on a reference database, aiming to enhance security, prevention, and investigation of criminal activities.

The European Commission established a Signatory Taskforce for the implementation of the Code of Practice for GPAI. Led by the AI Office, this Taskforce aims to facilitate uniform application of the voluntary Code, assisting GPAI model providers in meeting their obligations under the AI Act. It will support the exchange of views among signatories and contribute to interpretative documents, serving as a forum for discussion on technological development, research, and expert materials.

Data Protection News

The French DPA (CNIL) presented a tool to track the genealogy of open-source AI models. This demo tool maps the origin and further use of models available on the HuggingFace platform, answering questions about exercising data subject rights under GDPR, especially the rights of access, erasure, and objection to processing. CNIL emphasizes that AI models may memorize personal data from training data, hence generally falling under GDPR, as stated by the EDPB.

On January 20, 2026, the EDPB and EDPS issued a joint opinion on the Digital Omnibus proposal. They support simplifying the implementation of the AI Act but warn against weakening the protection of rights. Recommendations include maintaining registration of AI systems in the EU database, involving data protection authorities in AI sandboxes, and preserving the obligation for AI literacy among staff.

The CJEU ruled on the obligation to inform data subjects immediately when using body cameras. In the case of Storstockholms Lokaltrafik, it confirmed that when collecting personal data through body cameras, the information obligation must be fulfilled without delay.

The EU and Brazil adopted mutual adequacy decisions on January 27, 2026, confirming that personal data protection in both jurisdictions is comparable, allowing free data transfer without additional requirements. A review of this decision’s functioning will occur after four years.

The Hamburg supervisory authority published a comprehensive questionnaire for assessing legitimate interests under GDPR on January 6, 2026. This questionnaire guides controllers through key assessment steps, focusing on necessity and minimization of processing, balancing interests, documentation, and ongoing updates.

On January 14, 2026, CNIL published interactive maps of GDPR certifications and codes of conduct across Europe, displaying all certifications approved by national authorities or the EDPB since GDPR took effect.

IP & AI News

The Walt Disney Company and OpenAI concluded a landmark licensing agreement for the Sora platform. Announced on December 11, 2025, this three-year agreement allows for the generation of short user videos featuring characters from Disney, Marvel, Pixar, and Star Wars. Notably, the agreement excludes actor likenesses or voices, with Disney becoming a major OpenAI customer.

Market Updates

On January 22, 2026, South Korea launched its AI regulation laws with the enactment of the AI Basic Act. This comprehensive legal framework aims to strengthen trust and security in the sector, requiring human oversight of “high-impact” AI in critical areas like healthcare and finance. Companies have a one-year preparation period for compliance.

The EU is investing over €307 million in AI and related technologies, as announced under the Horizon Europe initiative. This funding aims to bolster digital innovation and strategic autonomy, focusing on trustworthy AI services, data innovation, robotics, and other key areas. The application deadline for funding proposals is April 15, 2026.

The Czech government appointed Lukáš Kačena as the government commissioner for AI, tasked with coordinating AI development across public administration and businesses, emphasizing AI’s role in public services and active participation in European digital policy.