How I Build Digital Products for the European Union: Data, Rights, and AI

I build software for products, not just for a successful demo. When a project serves people in the European Union, that includes taking the legal conditions around data, content, and automated decisions seriously from the start. This is part of product quality: a system is not ready if the team cannot explain where its inputs came from, why it processes personal data, or what happens when an AI suggestion is wrong.

For digital materials, I check the source and licence before they enter a codebase or a production pipeline. That includes illustrations, fonts, datasets, libraries, and third-party APIs. Publicly reachable does not mean free to reuse. Where a licence requires attribution, restricts commercial use, or sets other conditions, those requirements belong in the implementation and handover notes, not in someone’s memory.

For personal data, I aim for a narrow, documented flow: a clear purpose and legal basis, only the fields the feature needs, defined retention, restricted access, and appropriate security. I also map processors and vendors so the client can assess disclosures and transfers. These choices follow the core GDPR principles, including purpose limitation, data minimisation, storage limitation, integrity, and accountability. The controller’s exact obligations depend on the project and should be confirmed with qualified counsel when needed. Official guidance: https://commission.europa.eu/law/law-topic/data-protection/information-business-and-organisations/principles-gdpr_en

AI needs its own use-case review. I identify what the system does, who may be affected, what data it uses, and whether the project makes me a provider, deployer, or another actor under the EU AI Act. The risk category and the intended context determine which safeguards and transparency duties apply. A drafting assistant is different from a tool that influences hiring or access to essential services. Where appropriate, I design for human oversight, traceable outputs, documented limitations, and clear notice that AI is involved. Official overview: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

My commitment is to build and integrate AI solutions for EU products and projects with applicable EU and national law in view, and to raise unresolved issues before launch. This is an engineering commitment, not a blanket legal certification: compliance depends on the actual system, contracts, data practices, market role, and sector. I work with the client and, where the questions require it, their legal advisers so the shipped product has a reviewable basis for its decisions.

The practical test is simple: can we show what data and materials the product uses, why it is allowed to use them, who can access them, how the AI is used, and how people can understand or challenge the result? If not, the next task is not another feature. It is closing that gap. EU copyright overview: https://digital-strategy.ec.europa.eu/en/policies/copyright