Many proposals for Horizon Europe, Digital Europe and other EU programmes now involve artificial intelligence, personal data or both. Consortia invest heavily in the scientific concept, the impact pathway and the work plan. The sections on ethics, data management and regulatory compliance, by contrast, are often written at the last minute and copied from previous proposals.

This is a missed opportunity. These sections are read by evaluators and ethics experts. If they are weak, they can delay the grant agreement. They also show whether the consortium understands the regulatory environment its results will have to enter. That environment has changed: the AI Act’s prohibitions have applied since February 2025, its transparency obligations since August 2026, and the obligations for high-risk systems will apply from 2 December 2027 under the Digital Omnibus. Many projects starting today will end after that date.

What evaluators look at

The ethics self-assessment. Horizon Europe proposals include an ethics self-assessment, and projects that raise ethics issues undergo an ethics review alongside the scientific evaluation. Personal data, AI, research involving people and potential misuse are among the most frequent issues. Points left unresolved become ethics requirements and deliverables in the grant agreement. A clear and specific self-assessment shortens this process.

AI-specific ethics. For projects that develop or use AI, the Commission’s guidance on Ethics by Design and Ethics of Use Approaches for Artificial Intelligence sets out what is expected: human agency and oversight, privacy and data governance, fairness, transparency, accountability and attention to societal impact. These principles should be built into the project from the design phase.

The data management plan. Projects must manage research data in line with the FAIR principles, and a data management plan is normally an early deliverable. It should describe:

• what data will be collected or reused;
• how personal data will be protected;
• how data will be shared between partners;
• which results can be made open.

The credibility of the exploitation plan. Evaluators of impact increasingly ask whether results can actually reach the market or public services. A credible path to compliance is needed for any solution that will be a high-risk AI system under the AI Act, or a product with digital elements under the Cyber Resilience Act. Ignoring this weakens the impact section; addressing it strengthens it.

The AI Act research exemption, and its limits

The AI Act does not apply to AI systems and models specifically developed and put into service for the sole purpose of scientific research and development. It also excludes research, testing and development activities on AI systems before they are placed on the market or put into service.

Many consortia read this as a general exemption, but it is narrower than it looks:

• Testing in real-world conditions is not covered by the exclusion. A pilot in which a city, a hospital or a company uses the system with real people may fall within the AI Act.
• Results intended for the market also fall within the AI Act once a partner places them on the market or puts them into service after the project.
• Prohibited practices need attention from the design phase: a project should not develop a system whose intended use is prohibited.
• Transparency obligations under Article 50 have applied since 2 August 2026. They are relevant for chatbots or AI-generated content used in pilots and public engagement activities.

The GDPR in a consortium

Research benefits from specific GDPR provisions, such as the safeguards for scientific research under Article 89, but not from an exemption. Before the project starts, a consortium needs to do the following:

• clarify who is controller, joint controller or processor for each processing activity, and put the corresponding agreements in place;
• for pilots involving public bodies, identify a legal basis that covers the research purpose;
• for transfers to partners outside the EU, provide appropriate safeguards;
• assess whether a data protection impact assessment is required, as it often is for monitoring, health data or large-scale processing.

Where AI systems are trained or tested to detect and correct bias, the Digital Omnibus now provides a specific basis for processing special categories of data, subject to strict safeguards. It is not a general exemption from data protection law.

The risks are real. In January 2024 the Italian Garante fined the Municipality of Trento EUR 50,000 in connection with two EU-funded research projects that used AI to analyse footage and audio from city cameras and microphones. The authority found that the municipality lacked a legal basis for the research, had not carried out an impact assessment and had not anonymised the data sufficiently. EU funding did not make the processing lawful.

For projects that affect people’s rights, a fundamental rights impact assessment can also be a strong addition, even where the AI Act does not yet require it. We have described a methodology designed for EU-funded research.

A practical checklist for proposals

1. Map the AI and data in the project: which systems will be developed or used, with which data, by whom and in which pilots.
2. Classify under the AI Act: for each system, check whether the research exemption really applies, whether real-world testing is planned and what the risk class would be after the project.
3. Define data protection roles early: controllers, joint controllers and processors, with the corresponding agreements provided for in the consortium agreement.
4. Plan the assessments: data protection impact assessment, ethics deliverables and, where relevant, a fundamental rights impact assessment, with realistic timing in the work plan.
5. Write a specific data management plan: not a template, but the real data, the real safeguards and the real sharing arrangements.
6. Link compliance to exploitation: show how results will reach the market or public use in line with the AI Act, the GDPR, the Cyber Resilience Act and sector rules.
7. Budget for it: legal and ethics work takes time, and a dedicated task with resources makes the plan credible.

A proposal that treats regulation as part of the research design rather than as an annex is more convincing to evaluators and faster to bring to grant agreement. It is also more likely to produce results that can actually be used.

Data Valley Consulting supports consortia from proposal drafting to implementation, including regulatory compliance and risk management across the project lifecycle.

‍