Your staff use ChatGPT. What the law asks, and a policy to adopt

Where staff use ChatGPT or another AI tool for the business's work, the business is a deployer under the EU AI Act. Article 3(4) defines a deployer as anybody using an AI system under its authority, other than in a personal non-professional activity. There is no size threshold. The Commission's Article 50 guidelines read authority as responsibility for deciding to use a system and how. They say staff acting on the business's instructions are not separate deployers. They do not deal with a tool used without the business's knowledge, and the policy below settles which tools are used.

Article 4 has applied since 2 February 2025, and Regulation (EU) 2026/1744, the Digital Omnibus on AI, replaced its wording from 27 July 2026. Providers and deployers must take measures to support the AI literacy of their staff and others using AI on their behalf, taking into account their knowledge and experience, the context and the people affected. The duty does not require anybody to guarantee any specific level of AI literacy. A template that asks for a sufficient level, the earlier wording, overstates what is owed.

The Commission's questions and answers say a company whose staff use ChatGPT to write advertising text or to translate must comply, with staff told about specific risks such as hallucination, where a tool states made-up things as fact. They say there is no need for a certificate, that an internal record of trainings can be kept, and that no specific governance structure is mandated. They warn that asking staff to read a tool's instructions might be ineffective. That is why the policy below has staff go through it with a named person, and records the date.

The Regulation of Artificial Intelligence Act 2026, in operation since 31 July 2026 (S.I. No. 403 of 2026), gives Article 4 no notice and no fine of its own. Its contravention notice (section 71) lists Articles 16, 23, 24, 26, 27(3) and 50. Its fines follow Article 99(3) to (5). None of these names Article 4. The Commission says national law could penalise it, so this can change. The Article 4 guide has the detail.

Since 2 February 2025, Article 5(1)(f) has prohibited using AI to infer the emotions of a person in the workplace or in education, except for medical or safety reasons. The Commission's guidelines on prohibited practices read the workplace broadly: anywhere work is done, physical or virtual, for employees, contractors, trainees and volunteers, and for job candidates during hiring.

Their examples of prohibited use include webcams and voice recognition tracking call-centre staff's emotions, emotion recognition during recruitment or probation, and supermarket cameras tracking staff's emotions. Assessing wellbeing or motivation is not a medical reason.

The dividing line is biometric data (Article 3(39)). The guidelines give the example of a system reading the tone of an article from its text, which is outside the prohibition. One reading emotion from typing, facial expressions or posture is inside it. Reading customers' emotions from biometric data, such as their voices on calls, is not caught by Article 5(1)(f). Article 50(3) requires the people exposed to it to be told, and Annex III point 1(c) makes such a system high-risk, with the Article 26 deployer duties from 2 December 2027.

S.I. No. 405 of 2026, made on 31 July 2026, designates the Workplace Relations Commission as market surveillance authority for Article 5(1)(f), other than in education institutions, and for the employment uses in Annex III point 4. Under the 2026 Act, also in operation since 31 July 2026, an authorised officer who suspects a breach of Article 5 may serve a prohibition notice (section 72). The officer may instead serve a notice of suspected non-compliance, which can lead to a fine (sections 79 and 105). The fine can be up to €35 million or 7% of worldwide annual turnover, whichever is lower for an SME (Article 99(3) and (6)). The WRC's page says further legislation in the coming months will provide for its supervision and enforcement powers.

From 2 December 2026, Article 5(1)(ba) also prohibits using AI to generate or manipulate realistic images, video or audio of an identifiable person's intimate parts, or of them in sexually explicit activity, without their explicit consent. For a business using a tool, the ban applies where it uses the tool for that purpose (Article 5(1a)(b)).

Article 50 has applied since 2 August 2026. Its chatbot and machine-readable marking rules fall on the companies that provide the tools. Paragraph 4 falls on the business using them, in two cases. The Article 50 guide covers the rest.

Deep fakes. If you publish AI-generated or manipulated image, audio or video content that is a deep fake, you must say so. Article 3(60) defines a deep fake as content resembling existing persons, objects, places, entities or events that would falsely appear to a person to be authentic or truthful. The Commission's Article 50 guidelines count consumer goods as objects, and give as an example an AI product image in an advert or on packaging that could mislead about the product. A real product on an AI background is not a deep fake if the advert does not mislead, and nor is a scene nobody would take for real, such as the guidelines' mice arguing over cheese in a cheese maker's advert.

Text. AI-generated or manipulated text published to inform the public on matters of public interest must be disclosed too. The guidelines read public interest widely, from politics and public health to consumer safety and economic or scientific developments. Their example puts advertising copy and product descriptions outside the rule, but not claims on, for example, health, consumer safety or sustainability. Text counts as published when an open-ended, fairly large number of unrelated readers can reach it. Private correspondence and internal texts are not published.

No disclosure is needed where the text has had human review or editorial control and a person or organisation holds editorial responsibility for publishing it. The guidelines say review means somebody with relevant knowledge examining the substance, and at least checking the facts. A spelling check, an editorial policy on paper or a cursory sign-off does not count. A substantive AI edit afterwards cancels the exception. They also say the person or function responsible should be named, with contact details, somewhere easy to find on the website.

Article 50(5) requires a disclosure to be clear and distinguishable, and given no later than the first time a person is exposed to the content.

In the Data Protection Commission's 2025 case studies, a data loss prevention tool at a financial sector organisation flagged that an employee had uploaded 32 CVs, including passport or visa details and photographs, to an external free AI tool. The organisation notified a personal data breach: the data had gone to a third-party site with no data processing agreement and was out of its control. It had no policies on free external tools, including AI, and agreed to review its policies and give its staff direction and training. The DPC's takeaways stress how easily free AI tools are used without an organisation's knowledge, and the importance of usage policies staff know about.

The GDPR does not mention AI tools, but three of its articles apply to them. Article 5(1)(f) requires personal data to be kept secure against unauthorised processing. Article 32(4) requires steps to make sure anybody acting under the business's authority processes personal data only on its instructions. Article 24(2) requires data protection policies where proportionate. A written rule about AI tools is an instruction of that kind.

Where a tool's provider processes personal data on the business's behalf, Article 28 requires sufficient guarantees and a contract with the terms Article 28(3) lists. The organisation in the DPC's case had no such contract. Where the provider's terms let it re-use what is typed in for its own purposes, such as training its models, it is not acting on the business's behalf for that use (Article 4(8)). A data processing agreement does not cover that use. Putting personal data in then needs a lawful basis under Article 6. It also has to fit the purposes people were told about (Articles 5(1)(b), 13 and 14). The DPC's AI guidance says such processing can affect those principles.

Health information is special category data, which also needs one of the conditions in Article 9(2). A clinic's patient notes are data concerning health, and so is a record of a client's allergy (Article 4(15)).

Sending personal data outside the European Economic Area (EEA) also needs a legal basis under Chapter V. For a US provider, that is the EU-US Data Privacy Framework if the provider is on its List. If it is not, the basis is usually Article 46 safeguards such as standard contractual clauses, because Article 49 covers only specific situations. The US transfers guide has the checks.

The DPC's guidance on AI and large language models (18 July 2024) supplies most of the questions in the policy's approved-tools clause. It says that where the business is a controller, a formal risk assessment should be considered. Whether that has to be a data protection impact assessment (DPIA) turns on Article 35 and the DPC's list. It warns that relying on AI output without critical human analysis can bring in automated decision-making risks, which Article 22 limits.

If personal data goes into a tool it should not have, that can be a personal data breach (Article 4(12)). It must be notified to the DPC without undue delay and, where feasible, within 72 hours of the business becoming aware, unless it is unlikely to result in a risk to people's rights and freedoms (Article 33(1)). Every breach must be documented, notified or not (Article 33(5)). The first 72 hours are set out separately.

None of these is required of a business that only uses general AI tools for ordinary work.

Copy the clauses as they stand and fill in the names. The brackets say whether each comes from the law or good practice. It is not legal advice, and AI used in decisions about hiring, health or credit needs more.

Neither has a form set by law. The literacy record can be four entries per session: the date, who took part, what was covered and which tools.

An AI tool that handles personal data also belongs in any record of processing you keep: Article 30(1) asks for the recipients of the data, including any in countries outside the EEA, and for transfers outside the EEA.