Using ChatGPT at work is enough for the AI Act to apply to you. There are fewer obligations than people write about, and they are a bit different from what you would expect.
“We don’t have any AI, people just check something in ChatGPT now and then.” That is exactly the situation the regulation has in mind.
You don’t become a deployer by developing AI, but by using it at work. The regulation has no size threshold. The same goes for Copilot in Microsoft 365 or Gemini in Google Workspace.
Article 4 says a company should take measures so that people who work with AI understand it to a proportionate level. That includes contractors working with it on your behalf. Since July 2026 this has been an obligation of effort. You don’t have to guarantee that everyone has reached a certain level, but you have to be able to show that you did what was proportionate.
In practice, it comes down to two things. The Commission says that sending people a tool’s user manual is not enough. And while a certificate isn’t required, you should keep internal records of training and measures. Training without a record is very hard to prove.
Most texts ChatGPT helped you write don’t need a label. Only text that is published, informs the public and concerns matters of public interest has to be labelled, all three at once. And not even then if someone has reviewed it and takes responsibility for it. Offers, product descriptions and newsletters are not labelled.
Images, audio and video are different. Generated content that looks like a real recording of a person or event must be labelled when published. Even if it shows someone who doesn’t exist.
A client contract, price list or personal data pasted into a public tool. That is no longer just the AI Act, it is also data protection, with its own penalties.
Then made-up numbers. ChatGPT sounds most confident exactly when it is making things up, and someone who doesn’t know that sends a client a figure that doesn’t exist.
And shadow use. People use AI, nobody has approved or banned it, and management doesn’t know who uses which tool for what. It comes to light when something goes wrong.
The AI Act has changed several times over the past year, and the tools themselves keep changing. What was true about ChatGPT a year ago no longer is. Rules you write down today and file away will be out of date in six months. AI Act compliance has to be maintained, you can’t tick it off once.
No. A certificate is not legally required, the Commission has said so directly. You should, however, keep internal records of training and measures.
Mostly not. Ordinary commercial copy isn’t labelled. Labelling applies to published text on matters of public interest that hasn’t gone through human review.
Not for untrained staff. That rate belongs exclusively to prohibited practices under Article 5. The regulation sets no separate fine for Article 4.
Not sure what applies to you? Message us and we’ll tell you straight.
Message us on WhatsAppWe use cookies to measure traffic and ad performance. Essential ones always run, the rest only with your consent. More info