AI ethics and legislation

The ethics and law of AI,
explained plainly

I am Laura Graells, a Program Manager with twenty years of IT programmes behind me — the last five in the video games industry, leading a service-management programme across three continents. I write here about the side of artificial intelligence that decides whether any of it is defensible: what the law actually requires, who answers when a system gets it wrong, and what has to be on record before it does.

What I do → Read the blog →
✓ Free to read and cite✓ No advertising✓ No cookies

What you will find here

Articles on the ethics and legislation of artificial intelligence, written for the people who have to apply them — in an organisation with no legal department as readily as in one with a compliance function. This is a space for public writing: everything here can be read, quoted and linked freely.

A weekly column, written in Catalan and Spanish; the pieces on regulation, trust and safety are also in English.

Who writes this

Where I write from

I am not a lawyer and not a researcher: I run programmes. And I write from there — from what the rules actually ask someone to do when they have to apply them on a Monday morning, with a delivery date already in the calendar.

📐

Programme management

PMP, ITIL 4 and Scrum Master. Twenty years getting IT programmes delivered across Europe, the Americas and APAC, with the documentation to show for it.

⏱️

Service operations

Intake and queues, SLAs, escalation, and multilingual teams across non-overlapping time zones. ServiceNow CSA, with ITIL 4 as the foundation.

⚖️

AI regulation in practice

The EU AI Act and GDPR applied to real projects: what is actually required, of whom, and from when. Evaluating AI tools before they reach production.

🧩

My own projects

ParsIA, MemorIA and AlfabetIA: things I built end to end to find out where AI genuinely helps and where it does not. All of it in the portfolio →

What I write about

The topics

Six threads that keep crossing each other: the law, the technology, and the people who end up on the receiving end of both.

⚖️

The EU AI Act and regulation

What the European regulation requires, of whom and from when. Real deadlines, not headlines.

🎭

Bias and discrimination

When a system treats some people worse than others, and why nobody usually notices until it is late.

🔒

Data, privacy and GDPR

What really happens to the data that goes into an AI tool, and what the law says should happen to it.

🛡️

Security and scams

Cloned voices, flawless emails and impersonation. The side of AI that is already affecting people today.

🔍

Transparency and traceability

Being able to explain what a system decided, why, and who is accountable. Without that, nothing can be corrected.

👥

AI and work

How the job changes for the person facing the AI every day, and who decides how it gets used.

Own project · Art. 4 EU AI Act

Already in force

AlfabetIA: what happens when the rule changes mid-delivery

I built a full AI literacy programme around Article 4 of the EU AI Act — training sized to actual use, a comprehension test, named certificates and a compliance dossier — to find out what it really takes to evidence that an organisation's people use AI properly.

2 Feb 2025The obligation is already in force
August 2026Authorities can ask for evidence
September 2026Published correction, dated

Then the Digital Omnibus softened Article 4 and the material went out of date — in places, alarmist. I corrected it publicly, with a dated note at the top of every affected article. That correction is the part of this project I would put on a CV: a regulation changing while you are delivering is a management scenario, not an accident.

What AlfabetIA is →
AlfabetIA✓ Art. 4 EU AI Act
Team trainedLogged, with a date✓
CertificatesNamed, per person✓
Compliance dossierReady to show✓
AI usage policyIncluded✓

Own project · IAètica

ParsIA: an architecture decided by accountability, not by the model

A tool I built end to end to read invoices, delivery notes, contracts and payslips and pull the fields out of them. The question that settled the architecture was not which model extracts best — it was who answers if a figure comes out wrong, and where that can be evidenced. So it runs on the user's own infrastructure, no document travels to an external service, and human review stays on any field involving amounts or deadlines.

What ParsIA is →
ParsIA✓ Data extracted
NumberFAC-2024-0312✓
Supplier VAT no.B-59992701✓
Net amount1.240,00 €✓
Total1.500,40 €✓

Own project · IAètica

MemorIA: the value was the information architecture, not the model

A system that gathers contacts arriving through several channels, holds their status, and flags whoever has been waiting too long for a reply. Building it taught me something I keep applying: ordering what already exists solves more than adding intelligence on top of it. The AI-generated summary is optional, and it always links back to the original message rather than replacing it.

What MemorIA is →
MemorIA✓ Weekly summary
First contactNo reply · 12 days!
Second contactAwaiting reply · 4 days!
Third contactResolved✓
New contactLogged automatically✓

The projects, explained one by one

Each of these is written up in the portfolio with the design decision behind it, the main risk, how compliance was handled and what it taught me.

Read the portfolio →

Materials

The training material

I have put together two pieces of training material on artificial intelligence. These pages explain what they cover, how they are built and what I learned making them — including the part where a rule changed mid-delivery and the material had to be publicly corrected.

📘

AlfabetIA

What Article 4 of the EU AI Act asks for and how it can be answered: six modules, a test, certificates and a dossier. Read more →

⚙️

Automation with AI

How to work out which repetitive tasks in a small company can be automated, and which cannot. Read more →

Who writes this

Laura Graells

Program Manager — bridging users and the business, with a specialisation in AI governance. I write here about the ethics and law of artificial intelligence: what I am reading, what I am applying, and what I am still unsure about.

If you write to me, I will gladly answer questions about what I publish.