Goldmanmalka.com

Goldmanmalka.com

An online notepad

EU AI Case Law Watch: The Actionable To‑Do List (Governance You Can Prove)

·

AI   Boards

Most organisations treat AI law as a reading assignment.

That fails the moment you get a regulator letter, a rights holder complaint, or a data subject request asking, “How did the system decide this?” Courts and regulators do not grade your awareness. They grade your evidence: what you can show, what you logged, what you can reproduce, and what you changed when risks surfaced.

This is a practical checklist based on the case-law fronts we’ve covered: copyright and training data, automated decision‑making under the GDPR, liability allocation, and national enforcement fault lines.

1) Data and Training Governance (Copyright‑Ready by Default)

The copyright battlefield is converging on two proofs:

  • provenance and licensing posture (where the data came from, under what rights)
  • memorisation/extractability controls (whether protected text can be pulled out through simple prompts)

To‑do: inventory and document training datasets

Build an inventory that can survive scrutiny:

  • dataset source (domain, provider, acquisition method)
  • licence status (permitted, restricted, unknown)
  • opt‑out signals (where applicable) and how they were respected
  • retention rules (what you keep, for how long, and why)
  • traceability (how a sample can be traced back to source category)

Use this as a living artifact. Courts don’t accept “we think it was public.”

Why now: national courts are already treating “memorised and extractable” content as a legally relevant fact pattern in copyright disputes, and they are questioning whether TDM exceptions cover permanent reproduction in models when exploitation interests are impacted.
See: IFRRO press release (unofficial translation), MediaLaws case note, and Bird & Bird analysis.

To‑do: implement memorisation / extractability testing

Create a repeatable evaluation suite:

  • “near‑verbatim” tests for copyrighted corpora likely to be targeted (lyrics, books, news, standards, code)
  • prompt sets that mimic how claimants will test you (“What are the lyrics to…”, “Give me the chorus…”, “First verse…”)
  • thresholds and escalation rules (what triggers suppression, retraining, or refusal)

Treat the test suite as you treat security scanning: frequent, automated, and logged.

To‑do: define an extraction incident playbook

When someone shows a reproducible prompt that yields protected text:

  • capture evidence (prompt, output, timestamp, model version)
  • replicate in controlled environment
  • decide mitigation (filtering, refusal policy update, retraining)
  • document remediation and communicate (internally and, where appropriate, externally)

Audit checkpoint: If you cannot reproduce and suppress the problematic output within a defined time window, you are not operating a defensible model lifecycle.

2) Product and Decision‑Making Design (GDPR Article 22‑Ready)

The GDPR already constrains automated decisions with significant effects. Recent CJEU case law in credit scoring demonstrates that “we only provide a score” may not protect upstream vendors when a third party relies strongly on the output.
See: Matheson on SCHUFA (C‑634/21) and Bird & Bird on transparency vs secrets (C‑203/22).

To‑do: map where you automate “significant effect” decisions

Create an internal register:

  • decisions affecting access (approve/deny), pricing, prioritisation, restriction/sanction
  • the AI component’s role (decisive vs advisory vs triage)
  • who relies on it (“draw strongly on” risk)
  • the contestability path (how a person can challenge)

If you cannot articulate the role, you cannot defend it.

To‑do: design “meaningful human review” as a measurable process

Human oversight is not a sentence in a policy. It is a workflow with evidence:

  • reviewer has authority to override
  • reviewer sees enough context to disagree
  • reviewer interventions are logged (and audited)
  • escalation is fast enough to prevent harm

To‑do: build explanation output into the system

Courts and authorities push for intelligible “logic involved” disclosure. That means you need:

  • key parameters and their influence (in plain language)
  • sensitivity (“what could have changed the outcome”)
  • a clear contestability pathway

Trade secrets are not a refusal strategy. C‑203/22 emphasises balancing and intelligibility; if secrecy conflicts arise, supervisory authorities/courts can be part of the balancing process.
See: Bird & Bird summary of C‑203/22.

Audit checkpoint: If explanations require an engineer to hand‑craft a response, your product is not litigation‑ready.

3) Liability and Risk Allocation (Contracts That Match Reality)

Liability disputes become ugly when contracts allocate risk to the wrong actor or assume “the other side will handle compliance.”

At EU level, the Commission’s AI liability materials frame the policy objective: reduce proof barriers and ensure harmed persons have comparable protection.
See: EU Commission — liability rules for AI.

To‑do: update contracts for the AI lifecycle

For providers, deployers, and integrators, contracts should include:

  • IP/training data indemnities (scoped to actual training posture and output controls)
  • cooperation duties (DSARs, regulator inquiries, incident investigations)
  • patch / retrain obligations (including time windows)
  • audit rights (where appropriate) and documentation access

To‑do: review insurance and risk transfer

Ask the uncomfortable questions:

  • Does your coverage contemplate AI‑driven harms, IP disputes, and regulatory investigations?
  • Are exclusions triggered by “intentional acts” if your training posture is challenged?
  • Can you demonstrate reasonable controls (which insurers increasingly require)?

To‑do: define responsibility boundaries inside your organisation

Boards should be able to answer:

  • Who owns dataset governance?
  • Who owns automated decision registers?
  • Who owns incident response for model behaviour?

If ownership is fragmented, courts will treat it as unmanaged.

4) Monitoring and Escalation (Turn Case Law Into Product Changes)

This is where most “case law watch” efforts fail: they become newsletters, not governance.

To‑do: establish a lightweight EU AI decision tracking process

Track:

  • CJEU decisions touching automated processing, transparency, scoring, liability
  • national court decisions in key jurisdictions (especially interim measures)
  • regulator enforcement actions with judicial review potential
  • sector regulator guidance that will become “expected practice”

Useful reference hubs:

To‑do: convert each major ruling into an internal “case note”

Use this template (one page, max):

  1. Facts: system, actors, effect, evidence
  2. Holding: what the court decided (definitions + thresholds)
  3. Why it matters: what risk it changes for your stack
  4. Required actions: specific changes with an owner and deadline
  5. Residual risk: what remains unknown / contested

To‑do: create escalation triggers

Define what automatically triggers:

  • a DPIA / risk reassessment
  • an engineering mitigation sprint
  • a contract review
  • a board update

Audit checkpoint: If your monitoring function cannot trigger a product change, it is not a control. It is content.

Closing

EU AI law is no longer a “regulation reading” problem. It is a governance evidence problem.

If you can do four things well, you will be ahead of most organisations:

  • prove dataset provenance and licensing posture
  • test and suppress memorisation/extractability risks
  • log and demonstrate meaningful human oversight
  • translate new decisions into internal case notes that trigger real changes

That is what courts reward: not awareness, but operational control you can show on demand.

  • AI Act overview (European Commission): https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
  • AI Act text (EUR‑Lex): https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
  • Independent AI Act tracking/tools: https://artificialintelligenceact.eu/
  • GEMA v OpenAI (Munich) press release (unofficial translation): https://ifrro.org/resources/documents/General/German_Court_OpenAI_Memory_Output_Infringe_Copyright_NOV25.pdf
  • GEMA v OpenAI case note: https://www.medialaws.eu/gema-v-openai-decision-of-the-munich-regional-court/
  • Bird & Bird analysis of GEMA v OpenAI: https://www.twobirds.com/en/insights/2025/landmark-ruling-of-the-munich-regional-court-(gema-v-openai)-on-copyright-and-ai-training
  • SCHUFA (C‑634/21) analysis: https://www.matheson.com/insights/cjeu-delivers-important-decision-on-automated-decision-making-under-the-gdpr/
  • C‑203/22 transparency vs secrets: https://www.twobirds.com/en/insights/2025/cjeu-decision-on-algorithmic-transparency-and-secret-protection-(cjeu-c-20322)
  • EU Commission: AI liability rules / AILD proposal: https://commission.europa.eu/topics/business-and-industry/doing-business-eu/contract-rules/digital-contracts/liability-rules-artificial-intelligence_en
  • National implementation snapshot: https://www.technologyslegaledge.com/2025/11/state-of-the-act-eu-ai-act-implementation-in-key-member-states/
  • AI Act “state of play” briefing: https://www.traverssmith.com/knowledge/knowledge-container/the-eu-ai-act-the-current-state-of-play/