Short answer: before using AI with customer or employee data, review the GDPR (legal basis, minimisation, suppliers, transfers) and the EU AI Act (transparency, staff training and obligations depending on risk level). This article is indicative and does not replace legal advice.
Two frameworks to tell apart
- The GDPR (and national data protection law): applies whenever personal data is involved.
- Regulation (EU) 2024/1689 on Artificial Intelligence (the AI Act): sets obligations depending on the type of system and its risk level. It applies in stages; confirm the current timetable in official sources.
Data protection checklist
- Legal basis and purpose: what the data is processed for and on what grounds.
- Information to individuals: an up-to-date privacy policy that describes the use of AI.
- Minimisation: do not send the AI more data than necessary; anonymise where possible.
- Suppliers: a data processing agreement, location of processing and sub-processors.
- International transfers: safeguards if data leaves the European Economic Area.
- Impact assessment: consider whether one is needed when the processing may pose a high risk.
- Retention and security: periods, access and logs.
- Automated decisions: if they significantly affect a person, review the rights and safeguards that apply.
What the AI Act means for a company that uses AI
- Prohibited practices: the Regulation bans certain uses considered unacceptable; check you are not close to any.
- AI literacy: organisations that use AI must ensure a sufficient level of knowledge among their staff.
- Transparency: informing people when they interact with an AI system or when synthetic content is generated, in the cases provided for.
- High-risk systems: areas such as employment, education or essential services carry additional obligations (risk management, human oversight, logs).
Good internal practice
- An inventory of AI tools and use cases in the company.
- An acceptable use policy for the team (which data can and cannot be entered).
- Human oversight in decisions that affect people.
- Logging of inputs and outputs in sensitive processes.
- Periodic review of suppliers and terms.
Common mistakes
- Pasting customer data into public tools with no contract or safeguards.
- Not updating the privacy policy.
- Forgetting employees: AI for recruitment or evaluation has stricter rules.
- Thinking “the provider handles it” and not reviewing anything.
Frequently asked questions
Can I use ChatGPT or similar tools with customer data?
Only with a legal basis, appropriate information, a suitable contract with the provider and security measures. If you cannot guarantee that, do not enter personal data.
Do I have to say I use AI?
In many cases yes: transparency is a GDPR principle and the AI Act provides information obligations in certain cases.
Who can advise me?
A legal adviser or data protection officer with AI experience. We design solutions taking these requirements into account, but we do not provide legal advice.
If you are about to deploy AI and want to do it properly, see the applied AI agency or contact us.
