You want to use AI on customer emails, CVs or patient notes, and someone asks a reasonable question: are we allowed to? Two laws come up straight away. GDPR, which you already know. And the EU AI Act, which you’ve probably heard about mostly through headlines and shifting deadlines.
The short version: GDPR applies whenever personal data goes into an AI tool, and that’s where most of your day-to-day work lies. The AI Act mostly lands on companies that build and sell AI systems. For companies that use them, it’s much lighter, unless the use falls into a high-risk area such as hiring or credit. This post explains both in plain terms and ends with a list of what most small and mid-sized companies actually need to do.
This is a practical overview, not legal advice. For decisions about your own situation, talk to your data protection officer or a lawyer.
Two laws, two different questions
GDPR asks: what happens to personal data? It doesn’t care whether you process that data in a spreadsheet or with a language model. If a customer’s name, an employee’s sick leave or a candidate’s CV goes into an AI tool, all the usual GDPR rules apply.
The AI Act asks: what is the AI system used for, and how risky is that use? It applies even when no personal data is involved, for example to a chatbot on your website or to AI that controls a machine.
In practice, you’ll think about GDPR every time you introduce an AI tool. You’ll think about the AI Act mainly to check whether a use falls into a high-risk or transparency category.
GDPR when you use AI
A lawful basis for each purpose
Every use of personal data needs a legal basis, and AI doesn’t change that. Summarising a client’s emails so you can answer them is usually covered by the same basis as answering them at all, often the contract with that client. Using the same emails to train or improve a model is a new purpose, and it needs its own basis.
If you rely on legitimate interest, do the balancing test and write it down. In December 2024, the European Data Protection Board said in an opinion that legitimate interest can be a basis for developing and using AI models, but only when that test is passed.
Send only what the task needs
To draft a reply about a late delivery, the model needs the order details, not the customer’s full history. Remove national ID numbers, bank details and health information the task doesn’t need. Replace names with “Client A” where you can. Less data in means less to explain, protect and delete later.
Treat the AI provider as a processor
When a provider processes personal data on your behalf, it is usually your processor. GDPR then requires a written contract with it (Article 28), usually called a data processing agreement. Business and API plans from the major providers offer one. Free personal plans often don’t, and they shouldn’t be used for personal data.
Before you sign, check four things. Does the provider use your data to train its models? For business data, it shouldn’t. Which sub-processors does it use? How long does it keep prompts and outputs? Some keep them for a limited time to monitor abuse. And how do you get data deleted?
Know where the data goes
Transfers outside the European Economic Area need a legal mechanism. For US providers this is often the EU-US Data Privacy Framework, if the provider is certified under it, or standard contractual clauses. The Framework is in force, but an appeal against it is pending at the EU Court of Justice, so check its status from time to time.
Several providers offer processing in EU regions on business plans, either directly or through cloud platforms such as Microsoft Azure, Google Cloud or AWS. If data must not leave your control at all, the answer is a model you host yourself.
Decide how long you keep things
AI processes create new data: prompts, outputs, logs, chat histories, search indexes built from your documents. Each needs a retention period like any other record. A chatbot that stores every conversation forever is a liability, not an asset.
Tell people, and respect their rights
Update your privacy notice: say that you use AI tools to process certain data, for what purpose and with which processors. People’s rights to access, correct, delete and object apply to data in AI systems too, so plan how you’d find one person’s data in your logs.
If a decision with legal or similarly significant effects on someone is made solely by automated means, Article 22 applies. Refusing a loan or rejecting a job applicant are the classic examples. In most cases the practical answer is simple: AI prepares the decision, a person makes it. We cover how to design that in human in the loop.
Do an impact assessment when the risk is high
A data protection impact assessment (DPIA) is required when processing is likely to result in a high risk to people. Health data at scale, systematic evaluation of employees or candidates, and new technology applied to sensitive data are typical triggers. Even when it isn’t required, it’s a useful structure for thinking through a larger AI project.
Choosing a provider: public API, EU-hosted or self-hosted
Where the model runs decides most of the GDPR questions above. There are three common setups:
Three ways to run the model
| Standard public API | EU-hosted enterprise API | Self-hosted model | |
|---|---|---|---|
| Where data is processed | Provider’s choice, often the US | An EU region set in the contract | Your servers or your own cloud account |
| Data processing agreement | Yes | Yes | Only with your hosting provider |
| Training on your data | Usually off for API use, check the terms | Off by contract | Data never leaves your setup |
| Model quality | The best current models | The best models, sometimes later in EU regions | Good for many tasks, behind the best on hard ones |
| Effort to run | Low | Low | High: hardware, updates, monitoring |
| Fits | Non-sensitive data, prototypes | Most business data | Health, legal and strictly confidential data |
For most business data, a business plan or API with a data processing agreement, training switched off and an EU region is a sensible default. A self-hosted open-weight model, such as Llama, Mistral or Qwen, makes sense when your rules forbid any outside processing: patient records, client files under strict confidentiality, or contracts that say so. We compare the options in detail in self-hosted LLMs or API models.
The EU AI Act in plain terms
Are you a provider or a deployer?
The AI Act puts most duties on the provider: the company that develops an AI system, or has one developed, and puts it on the market or into service under its own name. A deployer is a company that uses an AI system in its work.
Most companies using AI assistants, AI features in their software or a tool someone built for them are deployers. If you sell a product with an AI system inside under your own name, you are likely its provider. The same can apply when you have a custom AI system built and use it under your name. For minimal-risk uses that changes little. For high-risk uses it matters a lot. The rules for general-purpose models, the large models behind chat assistants, apply to the companies that develop them, not to you as a user.
Four levels of risk
The Act sorts AI uses by risk. The higher the level, the more rules apply.
The EU AI Act’s four risk levels
- Prohibited Social scoring, manipulative techniques, emotion recognition at work or school
- High-risk Hiring and staff management, education, credit scoring, essential services, safety parts of regulated products
- Transparency Chatbots, deepfakes, AI-generated content: people must be told
- Minimal risk Drafting, summarising, spam filters, internal search: no extra duties beyond AI literacy
Prohibited practices rarely touch an ordinary business. One to note: emotion recognition of employees at work is banned, except for medical or safety reasons.
High-risk uses are where the real obligations sit. They include AI used to recruit, select, promote, dismiss or monitor staff, to admit or grade students, to assess creditworthiness, and to price life and health insurance. AI that is a safety component of a regulated product, such as machinery or a medical device, is also high-risk. As a deployer of a high-risk system you must use it according to its instructions, have trained people overseeing it, keep its logs, monitor how it works and tell affected people and workers’ representatives.
Transparency rules cover systems that talk to people or create content. A chatbot must make clear it’s an AI, unless that’s obvious. Deepfakes must be labelled. AI-generated text published to inform the public on matters of public interest must be disclosed, unless a person reviewed it and takes editorial responsibility. Providers of generative AI must also mark its output in a machine-readable way.
Minimal-risk uses cover most of what companies do with AI today: drafting emails, summarising documents, searching internal knowledge, sorting tickets. The Act adds no specific duties here, apart from AI literacy for staff.
The timeline
The Act entered into force in August 2024 and applies in stages.
When the AI Act’s rules apply
- 1
1 Aug 2024
Entry into forceThe Act becomes law. Its duties start in stages.
- 2
2 Feb 2025
Bans and AI literacyProhibited practices banned. Companies must take steps on staff AI literacy.
- 3
2 Aug 2025
General-purpose modelsRules for the developers of large models, such as those behind chat assistants.
- 4
2 Aug 2026
TransparencyChatbots must say they are AI. Deepfakes and some AI-generated text must be labelled.
- 5
2 Dec 2026
Marking and new bansMachine-readable marking for systems already on the market. New bans on AI that creates non-consensual intimate images or child abuse material.
- 6
2 Dec 2027
High-risk usesHiring, education, credit and similar uses. Originally August 2026.
- 7
2 Aug 2028
High-risk productsAI in machinery, medical devices and similar products. Originally August 2027.
What the Digital Omnibus changed
In November 2025, the European Commission proposed a “Digital Omnibus”: two packages to simplify EU digital rules, one for the AI Act and one for data rules including GDPR. The AI part was adopted as Regulation (EU) 2026/1744 and entered into force on 27 July 2026. The main changes for companies:
- High-risk uses listed in the Act, such as hiring, education and credit, now have to comply from 2 December 2027 instead of 2 August 2026.
- High-risk AI in regulated products now follows from 2 August 2028 instead of 2 August 2027.
- Transparency rules were not postponed. They apply from 2 August 2026. Only machine-readable marking by systems already on the market gets extra time, until 2 December 2026.
- The AI literacy duty was reworded. Companies must take measures to support their staff’s AI literacy, but don’t have to guarantee a specific level.
- Some simplifications for small companies were extended to small mid-sized companies.
The data part of the package proposes changes to GDPR, including on using personal data for AI and on the definition of personal data. At the time of writing it is still being negotiated by the European Parliament and the Council. Until anything is adopted, GDPR applies as it is.
What it means for four ordinary companies
An accounting firm uses an AI assistant to summarise client correspondence and draft letters. GDPR: a business plan with a data processing agreement, client identifiers removed where the task doesn’t need them, an updated privacy notice. AI Act: minimal risk. Train staff and keep a short policy.
A distributor puts a chatbot on its website to answer product questions. AI Act: a transparency case, so the chatbot must say it’s an AI. GDPR: if it collects names or emails, say so in the privacy notice and set a retention period for chat logs.
A clinic wants AI to summarise patient notes for doctors. Health data is a special category under GDPR, so expect to need an impact assessment. Strongly consider a self-hosted model or a strictly EU-hosted service with a solid contract, and have a doctor check every summary. If the software were meant to support diagnosis or treatment decisions, it might count as a medical device, which brings the high-risk rules into play. Check this before you build.
A recruitment agency wants AI to rank candidates. Under the AI Act this is a high-risk use, with deployer duties from 2 December 2027. Under GDPR, a rejection based solely on the ranking would fall under Article 22. The practical route: let AI parse and summarise CVs, and keep the decision with a person who sees the actual application. More in AI in HR and recruitment.
What most small and mid-sized companies need to do
None of this needs a compliance department. For most companies it’s a few days of work, then a review once or twice a year.
The practical list
- List every AI tool in use Including personal accounts people use for work
- Classify the data going in Personal? Health or other special category? Client-confidential?
- Business plans with a data processing agreement And training on your data switched off
- Check where data is processed EU region, or a valid transfer mechanism
- Update your privacy notice
- Label chatbots and AI-generated public content Required from 2 August 2026
- A person decides about people Hiring, credit, access to services
- Impact assessment where the risk is high Health data, employee or candidate evaluation
- Check for high-risk uses Hiring, education, credit, insurance pricing
- A short AI policy and staff training This also covers the AI literacy duty
A written policy turns most of this list into everyday habits. Our guide to writing an AI usage policy includes a template. If your data can’t leave your environment, see how we build self-hosted and private AI systems, or get in touch to talk it through.
