EU AI Act and GDPR: what do you need to sort out now?

Your people already use AI. In a chat window, in a summary, in a tool someone switched on themselves. The question isn't whether you need to deal with it, but whether you can show what happens to which data. Two regimes set the rules: the GDPR, which has applied for years, and the EU AI Act, which is coming into force in stages.

This article sets out an approach, not legal advice. Check yours with your data protection officer or a lawyer.

Where do the GDPR and the AI Act overlap?

The GDPR covers personal data. As soon as you run AI on CVs, customer files, email or HR data, it applies. The AI Act covers the AI system itself: what it does, how much risk that carries and which safeguards go with it, even when no personal data is involved.

They overlap on the points that matter in practice: transparency, human oversight, recording what happens, and agreements with your suppliers. Get those four right and you have covered most of both.

What the GDPR asks of you when you use AI

Five points come up every time.

• Lawful basis: you must be able to say why you are allowed to process this data for this purpose.
• Data minimisation: the model sees no more data than the task needs.
• Transparency: people know you use AI and what for.
• Automated decision-making: extra requirements apply to decisions made solely by automated means that significantly affect someone.
• Processors: with every party that processes data on your behalf, you sign a data processing agreement and record where the processing takes place.

For uses that pose a high risk to the people involved, you also need a data protection impact assessment (DPIA). That is work up front, and it saves a lot of argument later.

What the AI Act adds on top

The AI Act classifies uses by risk. A small number of practices are banned. A set of uses count as high risk, including AI used in recruitment and selection, in decisions about terms of employment, in access to education and in credit scoring. These come with requirements for risk management, data quality, technical documentation, logging and human oversight, among others.

Systems that interact directly with people or generate content carry transparency obligations. Everything else is minimal risk, where your own policy applies. The regulation is phased in, and that phasing has been debated. Check the current position before you plan around it.

Mind your role, too. If you build an AI system yourself and place it on the market, you are a provider, with heavier obligations than when you use an existing system. If you deploy a bought-in system under your own name or modify it substantially, you can still be treated as a provider.

Step 1: list where AI is already in use

Start with an inventory, not a policy. Ask each department which tools they use, including the ones nobody requested. For each use, note what it does, what data goes in, who uses it and what happens to the output.

The list is almost always longer than expected, and it is the basis for everything that follows. You can't assess what you don't know about. Add what you plan to build as well; the roles we set up for that are listed in the overview of AI employees.

Step 2: assess the risk of each use

Go through the list with two questions. Is there personal data involved, and if so, what kind? And what happens to the output: is it a tool for a person, or does it lead to a decision about someone?

Summarising a public document is different from pre-screening job applicants. Sort your uses into three groups: normal use, extra attention, and not without an assessment. Rougher than the law, but workable straight away.

Step 3: record what the system does and who keeps an eye on it

For every use that goes beyond a simple tool, record four things: what the system does and doesn't do, what data goes in, who checks the output, and how someone can object.

Make sure the system also logs what it does: the input, the sources, the output and who approved it, if anyone. For high-risk uses that logging is mandatory, and in every other case it is the only way to trace a mistake.

Human oversight means more than an approve button. Whoever approves must see the reasoning, be able to overrule it and have time to do so. How we set that up as standard is described under AI implementation.

Step 4: sort out your supplier agreements

Ask every supplier four things. Where is the data processed and stored? Is my data used to train models, and can I turn that off? How long is it kept? And what information do I get to meet my own obligations? Record the answers in the data processing agreement, including transfers outside the EU, and review them every year.

What to watch for with ChatGPT and other public models

The biggest risk isn't the model, it's the pasting. Someone drops a customer contract or an HR file into a chat window to get a quick summary. Without rules, you don't know where that ends up.

So sort out three things: a business environment instead of personal accounts, a short house rule on what can and can't go in, and an alternative that is just as easy to use. That last one matters most. A ban without an alternative gets worked around.

For sensitive data, you can run a model within the EU, or a model you manage yourself. How to connect those models to your own systems is covered under ChatGPT and Claude.

When don't you need to make a big deal of this?

If you only use AI on public or your own non-personal information, and the output never leads to a decision about a person, you are in the lightest category. Think of summarising a public report or drafting an email you check yourself.

Even then, a short house rule helps: what information can go in, who the contact person is, and where to report it when something goes wrong. One page is enough. Nobody reads a thirty-page policy.

If you want to map what is already running in your organisation and what it requires, we do that in the AI Opportunity Audit. What it delivers is set out on the AI Opportunity Audit page. Your Tech Club is ISO 9001 and ISO 27001 certified by Kiwa. That covers how we work; it doesn't replace an assessment of each use.