Workshops Use Cases Architecture Projects Blog
About Contact Offers Talks
Home›AI tools›EU rulesDeutsch

AI tools in the EU: what applies when your staff use them

This page is for companies in the EU and Austria whose staff use ChatGPT, Claude, Gemini, Copilot, Notion AI or coding assistants. It shows which parts of the AI Act and the GDPR apply to you as a user, as of September 2026.

Book a free 30-min call →AI Enablement Workshop →

Two EU laws apply side by side. The AI Act regulates AI systems and AI models by role: the provider builds the tool, the deployer uses it. The GDPR applies whenever prompts, files or answers contain personal data. Meeting one law does not meet the other.

A company that gives its staff an AI tool without changing it is normally a deployer. Most duties sit with the providers such as OpenAI, Anthropic, Google or Microsoft. Your own duties depend on what you use the tool for: AI literacy always, labelling in some cases, and high-risk duties only for uses such as screening job applications.

This page is general information as of September 2026 and not legal advice. For your own case, ask a lawyer or your data protection officer.

The dates

DateWhat applies
1 Aug 2024The AI Act enters into force.[1]
2 Feb 2025Prohibited practices and the AI literacy duty (Art. 4) apply.[2]
2 Aug 2025Obligations for providers of general-purpose AI (GPAI) models apply, as do the governance rules and the penalty chapter.[2]
27 Jul 2026The Digital Omnibus on AI (Regulation (EU) 2026/1744) enters into force. It postpones the high-risk rules and rewrites the AI literacy duty.[3]
2 Aug 2026The AI Act applies in general. Transparency duties (Art. 50) apply, and the Commission can enforce the GPAI rules and fine providers.[4]
2 Dec 2026New bans on AI that creates non-consensual intimate images or child sexual abuse material apply. Generative AI tools already on the market must mark their output as AI-generated.[3]
2 Aug 2027GPAI models placed on the market before 2 Aug 2025 must comply.[2]
2 Dec 2027High-risk rules for Annex III uses apply, for example recruitment and decisions about employees. This date was 2 Aug 2026 before the Omnibus.[3]
2 Aug 2028High-risk rules for AI built into regulated products apply.[3]

Provider or deployer

Provider[2]A provider develops an AI system or model, or has it developed, and offers it under its own name. OpenAI, Anthropic, Google and Microsoft are providers of their models and tools.
Deployer[5]A deployer uses an AI system under its authority for work, not for private purposes. The Austrian RTR says a company that uses third-party AI systems without changing them is normally a deployer.
When you become a provider[6]You become a provider if you build a chatbot in-house and run it under your own name. The same applies if you put your name on a high-risk system or turn a general tool to a high-risk purpose, for example using a chatbot to screen CVs.

What you have to do as a company using AI tools

AI literacy[7]Always, since 2 Feb 2025. New wording since 27 Jul 2026.Take measures to support the AI literacy of the staff who use AI on your behalf. The law does not require a set level. The Commission says staff using ChatGPT-type tools should learn about risks such as hallucination. No certificate is needed, and an internal record of training is enough.
Label deepfakes[8]From 2 Aug 2026, when you publish them.Disclose that images, audio or video you publish are AI-generated or manipulated. For evidently artistic, satirical or fictional work, a lighter notice is enough.
Label some published text[6]From 2 Aug 2026.Label AI-generated text only if you publish it to inform the public on matters of public interest and no human has reviewed or edited it. Internal texts and business correspondence are not "published" in this sense.
Say that a chatbot is AI[6]From 2 Aug 2026, if you run your own chatbot.This is a provider duty. It applies when you offer your own chatbot to customers under your name. The Commission guidelines treat an internal assistant for trained staff as an obvious case where no notice is needed.
Respect the bans[2]Since 2 Feb 2025, and new bans from 2 Dec 2026.Prohibited practices include emotion recognition at the workplace, except for medical or safety reasons.
High-risk uses[3]From 2 Dec 2027.Using AI to filter job applications, evaluate candidates, or decide on promotion or dismissal is high-risk. As deployer, you then follow the instructions for use, assign human oversight, keep logs for at least six months, and inform workers' representatives and affected staff beforehand.

The EU code of practice for AI models

The General-Purpose AI Code of Practice is a voluntary code for model providers, published on 10 July 2025. It has three chapters: transparency, copyright, and safety and security. The Commission calls it an "adequate voluntary tool" for showing compliance. It binds providers, not the companies that use their tools. As of the Commission list updated on 31 July 2026:[9]

Signed:

AmazonAnthropicGoogleIBMMicrosoftMistral AIOpenAIAleph AlphaCohereServiceNowWRITERAI Studio DeltaAlmawaveBlack Forest LabsBria AIDomynDweveFastwebLINAGORAOpen HippoPleiasxAI (safety and security chapter only)

Not on the list:

Meta (not on the Commission list)

GDPR when your staff use AI tools

GDPR applies in parallel[10]The AI Act does not replace the GDPR. As soon as personal data goes into a prompt, a file or an answer, the GDPR applies as well.
Legal basis[11]Every use of personal data in an AI tool needs a legal basis under Art. 6(1) GDPR. Special categories of data, such as health data, also need a condition under Art. 9(2).
Processing agreement (Art. 28)[11]If the vendor processes personal data on your behalf, you need a contract with the content that Art. 28(3) requires. Vendors often offer this only on business plans. Check each tool page.
Transfers outside the EU[12]Under the EU-US Data Privacy Framework, personal data can go to certified US companies without extra safeguards. Otherwise you use standard contractual clauses. On 3 Sept 2025 the EU General Court upheld the framework.
Impact assessment (DPIA)[11]A DPIA under Art. 35 GDPR is required when processing is likely to cause a high risk to people's rights and freedoms.
Check the model's origin[13]The EDPB says authorities should consider whether a company using a model "conducted an appropriate assessment" that the model was not built with unlawfully processed personal data.
Automated decisions[11]Art. 22 GDPR limits decisions based solely on automated processing that have legal or similarly significant effects on a person.
GDPR changes are only proposed[14]The Commission has proposed changes to the GDPR (Digital Omnibus, COM(2025) 837), but they are not law as of September 2026.

Data residency

The GDPR regulates transfers of personal data, not where data is stored, so it does not require EU hosting. EU hosting reduces transfer questions but does not remove them, because remote access from outside the EU is still a transfer (EDPB Guidelines 05/2021).

Austria

RTR KI-Servicestelle[15]The national AI information hub and contact point at the regulator RTR. It explains the AI Act and supports its implementation, but it is not a supervisory authority.
No AI Act supervisor designated yet[16]Austria has not yet named its market surveillance authority for the AI Act. The Commission's list, updated on 7 Sept 2026, shows no entry for Austria.
AI literacy in practice[17]RTR recommends documenting your AI strategy, your internal AI policy, your training concept and each employee's training. RTR notes that missing training can make a company liable under § 1313a ABGB.
Datenschutzbehörde (DSB)[18]The DSB's FAQ on AI and data protection says the GDPR applies in parallel. It asks you to check whether personal data goes to the maker of the system or other third parties.
DPIA list names AI[19]The Austrian DPIA regulation (DSFA-V) requires a DPIA for processing with new technologies that make the impact hard to assess, "in particular through the use of artificial intelligence".

How each tool family handles EU data

claudeclaudecode

Claude

Read more →
openaicodex

ChatGPT

Read more →
gemininotebooklm

Gemini

Read more →
copilotmicrosoft

Microsoft Copilot

Read more →
kiroaws

Kiro

Read more →
cursor

Cursor

Read more →
continue

Continue

Read more →
notion

Notion AI

Read more →
colabgooglecloud

Google Colab

Read more →

What would help you next?

Learn to decide

The course “From Managed to Hybrid” shows where AI should run: what each layer costs, what you operate and where your data has to stay. In preparation, with a free live session first.

Join the course waitlist →
Linda MohamedLinda Mohamed
AI and cloud consultant, AWS Community Hero, Vienna

Roll it out with me

Tell me which tools your teams use or want. In 30 minutes we look at plans, settings, data rules and whether AWS funding can cover part of a pilot. How AWS funding works →

Book a free 30-min call →15-min question slot

You already know what you need

Book a workshop directly:

  • AI Enablement Workshop →
    One workshop for one role, up to 12 people: how your team uses these tools well, and what stays inside the rules.
  • AI Discovery Workshop →
    Sort your ideas into a scored shortlist, so you know which use case is worth more than a tool licence.
ai-solutions.wiki

Read more on ai-solutions.wiki

My open knowledge base, with longer comparisons and sources.

The technology underneath: AI technologies explained →

Sources

  1. AI Act, digital-strategy.ec.europa.eu. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
  2. AI Act, eur-lex.europa.eu. https://eur-lex.europa.eu/eli/reg/2024/1689/oj
  3. AI Act, eur-lex.europa.eu. https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
  4. AI Act, ai-act-service-desk.ec.europa.eu. https://ai-act-service-desk.ec.europa.eu/en/faq
  5. Deployer, rtr.at. https://www.rtr.at/rtr/service/ki-servicestelle/faq/FAQ.de.html
  6. When you become a provider, ai-act-service-desk.ec.europa.eu. https://ai-act-service-desk.ec.europa.eu/sites/default/files/2026-07/guidelines_on_the_implementation_of_the_transparency_obligations_for_certain_ai_systems_under_article_50_of_the_ai_act_bzptwqhk0ikg1dtlddap41psfy_131215.pdf
  7. AI literacy, digital-strategy.ec.europa.eu. https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers
  8. Label deepfakes, digital-strategy.ec.europa.eu. https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act
  9. European Commission, GPAI Code of Practice signatories. https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai
  10. GDPR applies in parallel, dsb.gv.at. https://dsb.gv.at/aktuelles/informationen-der-datenschutzbehoerde-zum-verhaeltnis-zwischen-der-dsgvo-und-der-verordnung-eu-ueber-kuenstliche-intelligenz-ki-vo-fuer-verantwortliche-des-privaten-bereichs
  11. Legal basis, eur-lex.europa.eu. https://eur-lex.europa.eu/eli/reg/2016/679/oj
  12. Transfers outside the EU, commission.europa.eu. https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en
  13. Check the model's origin, edpb.europa.eu. https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-282024-on-certain-data-protection-aspects-related-to_en
  14. GDPR changes are only proposed, europarl.europa.eu. https://www.europarl.europa.eu/legislative-train/theme-a-new-plan-for-europe-s-sustainable-prosperity-and-competitiveness/file-digital-package
  15. RTR KI-Servicestelle, rtr.at. https://www.rtr.at/rtr/service/ki-servicestelle/ki-servicestelle.de.html
  16. No AI Act supervisor designated yet, digital-strategy.ec.europa.eu. https://digital-strategy.ec.europa.eu/en/policies/market-surveillance-authorities-under-ai-act
  17. AI literacy in practice, rtr.at. https://www.rtr.at/rtr/service/ki-servicestelle/ai-act/ki-kompetenz.de.html
  18. Datenschutzbehörde (DSB), dsb.gv.at. https://dsb.gv.at/faqs/faqs-zum-thema-ki-und-datenschutz
  19. DPIA list names AI, ris.bka.gv.at. https://ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20010375
  20. GDPR vs EU AI Act, ai-solutions.wiki. https://ai-solutions.wiki/comparisons/gdpr-vs-eu-ai-act/
  21. EU AI Act: August 2026 obligations, ai-solutions.wiki. https://ai-solutions.wiki/news/eu-ai-act-august-2026-obligations/
  22. Data residency pattern, ai-solutions.wiki. https://ai-solutions.wiki/patterns/data-residency-pattern/
  23. EU AI Act compliance guide, ai-solutions.wiki. https://ai-solutions.wiki/guides/eu-ai-act-compliance-guide/
  24. EDPB Guidelines 05/2021 on Art. 3 and Chapter V GDPR (remote access as transfer). https://www.edpb.europa.eu/documents/guideline/guidelines-052021-on-the-interplay-between-the-application-of-article-3-and-the_en
  25. CJEU press release 106/25, General Court T-553/23 Latombe v Commission (3 Sept 2025). https://curia.europa.eu/site/upload/docs/application/pdf/2025-09/cp250106en.pdf

Checked against the vendors' own pages in September 2026. Plans, models and features change often: check the linked pages before you decide.