ChatGPT and similar generative Artificial Intelligence (“AI”) tools are becoming part of everyday business operations. Employees use them to draft emails, summarise contracts, prepare marketing materials, analyze documents, write code, screen applications and communicate with customers.
For many companies, using ChatGPT at work still feels like using ordinary software. Legally, however, professional use of an AI system may place the company within the scope of Regulation (EU) 2024/1689, commonly known as the EU Artificial Intelligence Act (“AI Act”).
A company does not need to develop its own model to have AI Act obligations. It may be regulated simply because it uses an AI system in its professional activities. The applicable requirements depend on how the tool is used, the company’s role, and whether the AI affects employees, customers, or other individuals.
Using ChatGPT for business: is your company a deployer?
Under the AI Act, a deployer is generally a person or organization using an AI system under its authority in the course of professional activities. Personal, non-professional use is excluded.
A business may therefore act as a deployer when its employees use ChatGPT or another AI tool for company purposes, even if an external provider developed and hosts the system.
This does not mean that every use of ChatGPT triggers extensive compliance requirements. The assessment of AI Act deployer obligations depends on the system used, its intended purpose, the outputs it produces, and whether those outputs influence decisions affecting individuals.
Using generative AI to improve an internal email is not treated in the same way as using AI to rank job candidates, assess creditworthiness, or determine access to essential services.
The first step is therefore not to prohibit ChatGPT or immediately draft a generic AI Policy. First, identify how AI is actually being used across the business.
Third-party AI does not remove your responsibility
Many companies assume that the AI provider bears all legal responsibility. That assumption can be misleading. The provider is responsible for its own AI model or system, but the company using it remains responsible for how it deploys the tool within its business.
In practice, responsible use of generative AI in the workplace may require the company to address employee training, human review of AI-generated outputs, confidentiality, personal-data processing, discrimination risks, transparency, copyright, and incident escalation.
The company should also define which AI tools it may use, which business functions require prior approval, and which uses are prohibited. In some cases, a company may take on provider-level obligations itself. This may happen where it places an AI system on the market under its own name, substantially modifies the system, or changes its intended purpose in a way that alters its regulatory classification.
AI literacy requirements already apply
The AI Act requires providers and deployers to ensure an appropriate level of AI literacy among employees and other people using AI systems on their behalf.
AI literacy training for employees should reflect their roles, experience, and the context in which they use the AI system. A marketing employee, HR manager, and software developer will not necessarily require the same level of training.
At a minimum, employees should understand that AI-generated information may be inaccurate, incomplete, or fabricated. They should know when human verification is required, what information must not be entered into external AI tools, how biased outputs can arise, and how to report suspected incidents.
AI literacy should therefore be based on the company’s actual tools and use cases, rather than limited to a general presentation about AI.
AI Act transparency requirements: do customers need to be told?
Sometimes. Transparency requirements may apply where individuals interact directly with an AI system, such as a customer-service chatbot. Specific disclosure rules may also apply to certain AI-generated or manipulated content, including deepfakes and some public-interest content.
This does not mean that every AI-assisted email or internal document must be labeled. The requirement depends on the system type, the content, and the context in which it is used.
EU AI Act compliance: what should companies do now?
A practical approach to EU AI Act compliance should begin with an AI inventory. The company should identify which AI tools it uses, who uses them, for what purpose, what information it enters, and whether the outputs influence decisions affecting individuals.
Based on the results, the company may need an internal AI Policy, an AI systems register, employee training, approved-use rules, data-input restrictions, human-review procedures, vendor due diligence, transparency notices and an incident-escalation process.
An AI policy for employees cannot replace this assessment. The policy should reflect the company’s actual AI use, risks, and responsibilities.
At Manimama Law Firm
At Manimama Law Firm, we help businesses navigate this new reality effectively. We prepare documentation, manage application processes, and develop long-term crypto compliance strategies.
