DEEN
Start a project

AI in business: GDPR and the EU AI Act

Which rules apply when you use AI for customer requests, documents or internal processes? A practical overview of the GDPR and the EU AI Act, as of November 2026.

11 November 20263 min readBy devunoxAI
Key takeaways
  • For most business AI automation, the GDPR and the AI Act's transparency obligations matter most.
  • Since 2 August 2026, AI chatbots must be recognisable as AI to users (Article 50 AI Act).
  • Since February 2025, organisations must ensure sufficient AI literacy among their staff.
  • High-risk AI obligations were postponed to December 2027 and August 2028.

This article is a practical overview, not legal advice. Check your specific case with your data protection or legal advisers.

Two sets of rules, two questions

Two European regulations matter when you use AI in your business. The GDPR governs whether and how you may process personal data, with or without AI. The EU AI Act governs AI systems themselves: which are prohibited, which count as high-risk, and when you must disclose that AI is involved.

GDPR: what matters in AI projects

Legal basis and purpose

For most automations, such as answering customer requests or processing invoices, you process data to perform a contract or based on legitimate interest. Define the purpose before you start and process only what is needed.

Data processing agreements

If a service provider runs the AI solution for you, you need a data processing agreement. This also applies to the AI model provider if personal data reaches it.

Hosting and transfers outside the EU

The simplest setup keeps the application and its data in the EU. If data is transferred to providers outside the EU, you need a legal basis such as an adequacy decision or standard contractual clauses. Often you can avoid this by removing names and contact details before a document is sent to the model.

No training on your data

Make sure by contract that your data is not used to train AI models. The business offerings of the large providers usually exclude this, but it should be documented.

Data subject rights and deletion

Access and deletion requests must also work in AI solutions. Plan retention periods and deletion routines from the start.

EU AI Act: which deadlines apply

The AI Act has been in force since August 2024 and applies in stages. The so-called Digital Omnibus, in force since the end of July 2026, moved some deadlines. As of today:

Since / fromWhat applies
2 February 2025Prohibited AI practices; duty to ensure sufficient AI literacy of staff
2 August 2025Obligations for providers of general-purpose AI models
2 August 2026Transparency obligations (Article 50), e.g. chatbots must be recognisable as AI
2 December 2026End of the grace period for machine-readable marking of AI-generated content in existing systems
2 December 2027Obligations for stand-alone high-risk AI (Annex III), e.g. in recruitment
2 August 2028Obligations for high-risk AI in regulated products (Annex I)

What this means for typical projects

  • AI chatbot on your website or in customer service: users must be able to tell that they are talking to an AI. A clear note in the chat window is usually enough.
  • Reading invoices, delivery notes and emails: this is generally not high-risk AI. What matters here is the GDPR, a data processing agreement and human approval for critical steps.
  • AI in HR, such as pre-screening applications: this can count as high-risk AI. An early legal review pays off, even though the obligations only apply from December 2027.
  • AI-generated text and images: labelling duties apply to published content. Plan an editorial review.

Checklist for your AI project

  1. Define purpose and data types; process only what is needed.
  2. Choose EU hosting or secure any transfer outside the EU.
  3. Sign data processing agreements with all providers involved.
  4. Exclude training on your data by contract.
  5. Make AI recognisable where users interact with it directly.
  6. Keep human approval for critical decisions.
  7. Train your staff in using the system.

This is how we build our solutions: EU hosting, a data processing agreement, no training on your data, and approvals where they matter. More about our AI automation.

FAQ

Common questions

Can I use ChatGPT or Claude with customer data?

In principle yes, if there is a legal basis, a data processing agreement with the provider, safeguards for data transfers and training on your data is excluded. The large providers offer such contracts for business customers.

Do I have to label my AI chatbot?

Yes. Since 2 August 2026, users must be able to recognise that they are interacting with an AI system, unless this is obvious anyway.

Was the AI Act postponed?

Partly. The Digital Omnibus moved high-risk AI obligations to December 2027 and August 2028. The transparency obligations have applied since 2 August 2026.

Keep reading

More insights

11 November 2026 · 3 min readHow much does AI automation cost?An honest overview of what AI automation and custom software cost for small and mid-sized businesses: guide prices, cost drivers and running costs.11 November 2026 · 3 min readInvoice automation with AI: e-invoices and PDFsE-invoicing is becoming mandatory across Europe, but invoices still arrive in every format. Here is how AI handles the whole incoming invoice process, from inbox to approval.

Tell us what costs you time

In a free intro call we find out where automation or your own software pays off for you.

Book an intro call