EU AI Act: what duties do companies have that only use AI?

Checked on 13 November 2026. General information, not legal advice. The dates changed in 2026; older articles that give “August 2026” for high-risk duties are out of date.

What is your role under the AI Act?

The AI Act (Regulation (EU) 2024/1689) distinguishes, among others, providers and deployers. A deployer is anyone using an AI system under their own authority, except where the system is used in the course of a personal non-professional activity.^[4] A company that uses ChatGPT, Claude, Gemini or Copilot for work is, as a rule, a deployer. The provider is the company behind the system. Many of the Act’s obligations fall on providers; the deployer duties for ordinary use of chat assistants are limited.

Anyone who modifies a tool or offers it under their own name in a way that makes them a provider has wider duties. That is not the normal case for using chat assistants in the office and is not covered here. This guide covers the EU AI Act only; UK teams should check separately which rules apply to them.

When does what apply? The timeline after the Digital Omnibus

Regulation (EU) 2026/1744 of 8 July 2026 (the “Digital Omnibus on AI”) amends the AI Act. It was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026.^[3] The title and text are on EUR-Lex.^[2] The table gives the application dates as stated on the European Commission’s page.^[1]

The transition until 2 December 2026 for Article 50(2) and the new prohibitions rests on summaries of the legislative process that we cite as secondary sources.^[9][10] Check these against the Official Journal text if they matter to you.

What applies to ordinary use of chat assistants?

Article 4: AI literacy

Under Article 4 as amended by Regulation (EU) 2026/1744, providers and deployers must take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context in which the systems are used.^[2] Before the amendment the text required them to ensure a sufficient level of AI literacy; the change turns that into a duty to take measures. The duty has applied since 2 February 2025 and reaches every deployer.

The law does not say what counts as evidence. The following are suggestions, not legal requirements, and should be scaled to your size and use:

• Suggestion: an inventory. A list of the AI tools in use, who uses them and for what, so that training can be matched to real use.
• Suggestion: training by role. A short course for everyone on what may and may not go into a chat assistant, plus a deeper session for people who use AI on personal data, in HR or in customer work. The German supervisory authorities also advise training and sensitising employees.^[11]
• Suggestion: attendance records. A dated list of who took part and what was covered, kept with your other compliance documents.
• Suggestion: onboarding and refresh. A short module for new joiners and a refresh when tools or rules change.
• Suggestion: a named owner. One person responsible for keeping the plan current. Pair it with your AI acceptable use policy, so training and written rules say the same thing.

Article 4 has no tier of its own among the fines in Article 99;^[8] that does not rule out supervisory, civil-law or employment-law consequences. Do not expect, or cite, a fine “for Article 4”.

Article 50: transparency

Article 50 applies from 2 August 2026. Paragraphs 1 and 2 address providers: users must be told that they are interacting with an AI system, and synthetic content must be marked in a machine-readable way.^[5] Deployers are addressed by paragraph 3 (informing persons exposed to an emotion recognition or biometric categorisation system) and paragraph 4: a deployer of an AI system that generates or manipulates deep fakes must disclose this, and a deployer who publishes AI-generated text to inform the public on matters of public interest must disclose it, unless there was human review with editorial responsibility.^[5] For purely internal use of a chat assistant by staff, the Article 50 duties lie mostly with the provider. It is different if your company publishes press texts or posts that a model produced without editorial review.

What does not apply automatically

A general chat assistant is not, in itself, a high-risk system. High-risk systems are the applications named in Annex I and Annex III. That a tool could in theory be used for such purposes does not make ordinary use high-risk; a specific purpose of use, however, can bring the tool into that area, as the next section shows.

When can a use become high-risk, for example in HR?

Annex III point 4 covers employment and workers’ management: recruitment and selection (targeted job advertisements, analysing and filtering applications, evaluating candidates), and decisions on terms of work relationships, promotion and termination, task allocation based on individual behaviour or personal traits, and monitoring and evaluating performance and behaviour.^[7] Using a general chat assistant to sort applications or evaluate staff can therefore fall under this area. Whether a particular use does is a question of interpretation that you should clarify case by case with specialists.

For deployers of high-risk systems, Article 26 lists duties including these: use the system according to the instructions for use, assign human oversight to competent persons, monitor and report risks, keep logs for at least six months, inform workers’ representatives and affected workers before use at the workplace (Article 26(7)), and inform individuals about whom Annex III decisions are taken (paragraph 11); the provider’s information is to be used for the data protection impact assessment (paragraph 9).^[6] These duties apply to Annex III from 2 December 2027.^[1] We checked Article 26 through a copy of the Official Journal text; check the text before you implement it.

Data protection and employment law apply already. Applicant data is personal data. In Germany, for example, the employer must inform the works council about planning of work procedures and workflows, including the use of artificial intelligence (§ 90(1) no. 3 of the Works Constitution Act).^[12] The German supervisory authorities add that decisions with legal effect should in principle be taken only by humans, with real discretion.^[11]

What fines can be imposed?

Article 99, as amended, sets these tiers: breaches of the prohibitions in Article 5 up to EUR 35 million or 7% of worldwide annual turnover; breaches of other operator obligations, such as deployers under Article 26 or transparency under Article 50, up to EUR 15 million or 3%; incorrect information to authorities up to EUR 7.5 million or 1%. For small and medium-sized enterprises, the lower of the two amounts applies in each case.^[8] Article 4 is not listed in the tier for operator obligations,^[8] and other consequences are not excluded by that.

For comparison, under the GDPR breaches of duties such as Articles 28 or 35 can be fined up to EUR 10 million or 2%, and breaches of the principles and legal bases up to EUR 20 million or 4%.^[13]

How do the AI Act and the GDPR apply side by side?

Both regimes apply at the same time. The amending regulation restates in Article 2(7) that the AI Act does not affect the GDPR, apart from the new Articles 4a and 59.^[2] The AI Act asks about the system, its risk and the roles of the parties; the GDPR asks about the personal data, its legal basis and its protection. Anyone entering customer data into a chat assistant must observe the GDPR even where the AI Act sets few deployer duties for that use. In practice the sharper limit is one of control: after a prompt has been sent you cannot see where the provider processes it or recall it, so the decisive step for staff training is what to leave out before sending. For the provider side, see where your data goes when you use an AI assistant.

The GDPR part of the Digital Omnibus has not been adopted, and the definition of personal data has not changed. The Council’s negotiating mandate of 21 October 2026 did not take over the Commission’s proposal of 19 November 2025 to change Article 4(1) GDPR; as far as we know the European Parliament has no position yet, and a conclusion is not expected before 2027. This is based on secondary sources on an ongoing procedure,^[14][15] so follow its progress. For terms such as pseudonymisation, see the glossary.

How do you proceed? A checklist for deployers

Your AI acceptable use policy is the natural place for the rules on tools, data classes and high-risk areas. If staff already use tools that were never approved, start with the plan in shadow AI.

Next step

Put the three dates in the calendar and decide who takes on the inventory and the Article 4 training plan by the end of the year. If you use or plan to use AI in HR, clarify with data protection, and where applicable employee representatives, whether Annex III point 4 is touched before you start. The overall approach to a data-protection-minded introduction is described in use AI at work without leaking data.

This article is general information and not legal advice. It does not replace an assessment of your own case by your data protection officer or a lawyer. Last updated: 13 November 2026.