Contents
- What is the AI Act and why does it matter for businesses in Bulgaria
- How the GDPR applies to AI models
- The Digital Omnibus: upcoming changes to the GDPR
- Practical steps: a GDPR audit for AI systems
- The CPDP and AI: what to expect in Bulgaria
- Risks and fines: what you need to know
- Frequently asked questions
In our practice we see that many Bulgarian companies are already deploying AI tools without being aware of the accompanying legal risks. In this article our team summarises the key legal requirements, the practical steps towards compliance and the specific risks associated with AI and personal data protection.
What is the AI Act and why does it matter for businesses in Bulgaria
The Artificial Intelligence Regulation (Regulation (EU) 2024/1689 on artificial intelligence (AI Act)), known as the AI Act, is the world’s first comprehensive legal framework for artificial intelligence. It introduces a risk-based approach, categorising AI systems into four levels:
- Prohibited practices – social scoring, emotion recognition in the workplace, biometric categorisation based on sensitive characteristics
- High-risk systems – recruitment, credit scoring, healthcare
- Limited-risk systems – chatbots, deepfakes (require transparency)
- Minimal-risk systems – most AI applications (no special requirements)
Since 2 February 2025 the prohibitions under Art. 5 and the AI literacy obligation under Art. 4 already apply. The requirements for high-risk AI systems under Annex III apply from 2 August 2026, and those under Art. 6(1) (high-risk AI embedded in regulated products) from 2 August 2027. The proposed Digital Omnibus (November 2025) discusses extending these deadlines, but as at the time of publication it has not been adopted.
Important
The AI Act operates in parallel with the GDPR. When an AI system processes personal data, the two regulations apply cumulatively. Businesses must ensure compliance with both sets of rules.
How the GDPR applies to AI models
Opinion 28/2024 of the European Data Protection Board (EDPB), adopted on 17 December 2024, outlines the application of the GDPR to AI models in three main areas.
Anonymity of AI models
Not every AI model trained on personal data automatically “contains” personal data. The EDPB takes the view that anonymity must be assessed on a case-by-case basis. For a model to be considered anonymous, the likelihood of extracting personal data – directly or through queries – must be insignificant. In practice, companies must document the technical measures taken to ensure anonymity.
Legitimate interest as a legal basis
The EDPB confirmed that legitimate interest under Art. 6(1)(f) GDPR is a permissible legal basis for processing personal data in the development and deployment of AI models. However, a three-step test is required:
- Identifying a legitimate interest
- Demonstrating that the processing is necessary to achieve it
- Balancing the interest of the controller against the rights of the data subjects
Specific examples given by the EDPB include conversational agents (chatbots) for customer service and AI for cybersecurity.
Consequences of unlawful processing
If personal data was processed unlawfully during the training phase of an AI model, this may also affect the lawfulness of its subsequent deployment. Supervisory authorities may order:
- Fines under the GDPR
- Temporary restrictions on processing
- Erasure of the data from the training dataset
- Deletion of the model itself
The only way to “cleanse” the situation is demonstrable anonymisation of the model.
The Digital Omnibus: upcoming changes to the GDPR
On 19 November 2025 the European Commission published the Digital Omnibus package – a wide-ranging proposal to amend a number of digital acts, including the GDPR. The proposal is currently under discussion.
The key proposals affecting AI and personal data include:
- A new “relative” approach – data that a particular controller cannot link to a natural person is not considered personal data for that controller
- An explicit legal basis for processing personal data to train AI models on the ground of legitimate interest
- Processing of special categories of data (health, ethnic origin, etc.) for the purpose of detecting and correcting discrimination in AI systems
Position of the EDPB and the European Data Protection Supervisor (EDPS)
Their joint opinion of 11 February 2026 firmly opposes the changes to the definition of personal data, noting that they contradict the case law of the Court of Justice of the EU and significantly narrow the scope of the GDPR.
Practical steps: a GDPR audit for AI systems
Regardless of how the legislative changes progress, every company that uses AI should implement the following minimum set of measures:
1. Inventory of AI systems
Prepare a complete list of all AI tools your business uses – including chatbots, marketing automation systems, AI-based CRM solutions and data analytics tools. For each system, determine whether it processes personal data.
2. Impact assessment (DPIA)
Under Art. 35 GDPR, where processing (including by means of AI) is likely to result in a high risk to the rights of natural persons, a DPIA is mandatory. This is particularly important for profiling, automated decision-making or the processing of sensitive data.
3. Determining the legal basis
For each AI system that processes personal data, determine the legal basis under Art. 6 GDPR. If you rely on legitimate interest, document the three-step test.
4. Transparency and information
Arts. 13 and 14 GDPR require data subjects to be informed about the processing, including about automated decision-making. The AI Act additionally requires users to be notified when they interact with an AI system.
5. Contracts with providers
If you use AI as a service (for example, a cloud-based AI model), a data processing agreement under Art. 28 GDPR with the provider is required. Make sure the agreement also covers the AI Act requirements on the allocation of responsibilities between provider and deployer.
The CPDP and AI: what to expect in Bulgaria
The new composition of the Commission for Personal Data Protection (CPDP), elected in May 2025, has yet to set out the strategic priorities of the national supervisory authority. Under the AI Act, each Member State must designate a national competent authority to supervise AI systems. It is not yet clear whether this role will be entrusted to the CPDP or to another institution.
The CPDP’s track record shows an active stance on sanctions – the Bulgarian supervisory authority has imposed fines totalling over EUR 3.2 million since the GDPR took effect, including the significant penalty of BGN 1,000,000 on DSK Bank for a breach of security measures. With the spread of AI, new inspections and sanctions should be expected.
Risks and fines: what you need to know
The sanctions regime for infringements involving AI and personal data is multi-layered:
- GDPR: up to EUR 20 million or 4% of global turnover
- AI Act (prohibited practices): up to EUR 35 million or 7% of turnover
- AI Act (other infringements): up to EUR 15 million or 3% of turnover
- Personal Data Protection Act (PDPA, national law): up to BGN 10,000 for natural persons and up to BGN 100,000 for legal entities for minor infringements
For serious infringements, the sanctions under Art. 83 GDPR apply directly.
Frequently asked questions
How does the AI Act affect my business in Bulgaria?
The AI Act affects every business that develops or uses AI systems within the EU. If your business uses AI for recruitment, credit scoring, health services or biometric identification, this falls into the category of “high-risk AI systems” and must meet strict requirements for transparency, documentation and human oversight.
Can I use ChatGPT and other AI tools without infringing the GDPR?
Yes, provided that you have taken the necessary measures: you have determined a legal basis for the processing; you have informed the data subjects; you have concluded an appropriate agreement with the provider; and you do not enter third parties’ personal data without a legal basis. For business use, it is advisable to use the versions that come with a data processing agreement (Enterprise/Business plans).
What is a DPIA and when is it mandatory for AI?
A data protection impact assessment (DPIA) is mandatory under Art. 35 GDPR where processing is likely to result in a high risk to the rights of natural persons. For AI this includes: systematic profiling; automated decision-making with legal or similarly significant effects; large-scale processing of sensitive data; or the use of new technologies.
Is consent required for AI processing of personal data?
Not necessarily. Consent is only one of the six legal bases under Art. 6 GDPR. For AI models, legitimate interest is the most commonly used basis, but it requires a documented three-step test. It is important to know that consent in an AI context must be informed, specific and freely given – which in practice is difficult to achieve for large-scale model training.
What fines can the CPDP impose for AI-related infringements?
The CPDP can impose fines under the GDPR of up to EUR 20 million or 4% of annual turnover for serious infringements. The AI Act will add further sanctions. In Bulgaria, the most common fines for GDPR infringements range from BGN 5,000 to BGN 100,000, but for systemic or serious infringements they can be considerably higher.
What is a high-risk AI system?
Under the AI Act, high-risk AI systems are those used in areas such as: biometric identification; management of critical infrastructure; education and vocational training; employment and workforce management; access to essential public and private services (incl. credit scoring); law enforcement; migration and border management; and the administration of justice.
How can I protect my rights if an AI makes a decision about me?
Art. 22 GDPR gives you the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you. You can request human intervention, express your point of view and contest the decision. In the event of an infringement, you can lodge a complaint with the CPDP.
