The Page Bears the EU AI Act Name — The Norms Are Georgian
In international practice, the central instrument of artificial-intelligence regulation is the EU AI Act, and for Georgian companies operating on the EU market its requirements apply directly. On Georgia's internal market, however, the use of AI systems is governed by the Georgian law on personal data protection, which regulates automated decision-making, data minimisation and impact assessment. This page explains precisely the Georgian norms, with the EU AI Act referenced as context.
Three provisions form the cornerstones of this regime: the rule on automated individual decision-making and the related rights, the priority of data minimisation, and the obligation of data protection impact assessment. Together they create the compliance frame within which every AI system must be placed.
Automated Decisions and Profiling
A data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects concerning him. Only three exceptions exist: the decision is based on explicit consent; it is necessary for entering into or performing a contract; or it is provided by law. Outside these, a purely automated significant decision is unlawful.
Upon the data subject's request, the controller must take measures to protect his rights, freedoms and legitimate interests — including involving human resources in the decision-making process, and giving the possibility to express a view and to contest the decision. The use of special categories of data in such decisions is admissible only in defined cases where appropriate safeguards exist.
The Priority of Data Minimisation
When creating a new product or service, the controller — both when determining the means and in the processing itself — must take appropriate technical and organisational measures, including pseudonymisation. These measures must ensure the effective implementation of processing principles and the integration of safeguards protecting the rights of data subjects.
In determining the quantity of data, the scale of processing, storage periods and access, measures must ensure that only the amount necessary for the specific purpose is processed automatically. The measures must be applied so that, before an alternative approach is chosen, access for an indefinite circle of persons is limited to the minimal amount of data. For AI systems this means: minimisation must be embedded at the design level.