EU AI Act

The EU AI Act applies to companies that use AI in their work (as a deployer) or build it into what they sell (as a provider). Privacyboard keeps that work next to your register: which activities use AI, how each use is classified, what the Act asks of you and from which date.

For an overview of what the AI Act asks and when each duty applies, see EU AI Act.

#When it appears

An AI Act tab is added to Assessments when your company says it uses AI (in the company profile, Use of AI), or when your records already show it: a vendor of the AI services category, or an activity marked as using AI.

#Mark the activities that use AI

In each activity of the processing register, Does it use AI? has three answers: No, Yes, an AI tool made by others (you are a deployer) or Yes, AI we built (you are a provider). When an activity uses a tool known to use AI, Privacyboard suggests the answer; you confirm it.

#Classify each use

For each activity that uses AI, Classify asks three short sets of questions:

• Prohibited practices, such as manipulation, social scoring or emotion recognition at work. Any one of them means the use must stop.
• High-risk uses listed in the Act, such as recruitment and employee evaluation, credit scoring, education or access to essential services. A listed use that only does a narrow or preparatory task and never profiles people is not high risk (Article 6(3)); you note why.
• Transparency duties: a chatbot, generated images, audio or video, texts published to inform the public, emotion recognition.

What your records point to is offered ticked (a recruiting tool suggests recruitment, an AI support tool suggests a chatbot): check it. The result is one of Minimal risk, Transparency duties, High risk or Prohibited practice.

#What applies, and from when

Each classified activity lists what the Act asks of you as a deployer or as a provider, with the date each duty applies: prohibited practices and AI literacy since 2 February 2025, transparency duties from 2 August 2026, high-risk duties later, depending on the kind of system. The tab counts what is left to do.

Your privacy policy gains a short section on AI: which activities use it, and what people are told about it. It states only what your records say.

#AI literacy

Everyone who uses or oversees AI in your company must understand it and its risks (Article 4). No certificate or test is required, but you must be able to show the measures you took. In the company profile, AI literacy records each measure: its kind (training, usage rules, a guide, an awareness session), who it is for and its date.

An AI assistant connected to your workspace can also mark activities, propose a classification and record literacy measures; you confirm each change.

This is practical guidance based on your answers, not legal advice. For a high-risk or borderline use, have your classification checked.

#FAQ

#Does the AI Act apply if we only use ChatGPT or another AI tool?

Yes, as a deployer, but most everyday uses are minimal risk: the duty that applies to everyone is AI literacy. Duties grow with the use: a chatbot facing customers brings transparency duties, and using AI to screen candidates is high risk.

#Do we need a certificate for AI literacy?

No. The Act asks you to take measures suited to each role and to the risks, and to be able to show them. Recording each training, rule or guide with its date is enough to show what you did.