A policy officer at a municipality uses ChatGPT to summarise a long advisory memo before she reads it. A colleague notices and asks whether that is still allowed now that the AI Act applies. She is not sure, and news reports about multi-million fines do not make it any clearer.
The short answer is that her daily work barely changes. ChatGPT is built on a general-purpose AI model, and the heaviest obligations in the AI Act rest with OpenAI as the provider. Her organisation has three things to do: explain AI use to staff, stay away from a handful of prohibited applications and follow the high-risk rules for certain uses. What she needs to know herself is what the organisation has decided about ChatGPT and which data does not belong in a prompt. That was true before the AI Act too.
What is ChatGPT under the AI Act?
The law distinguishes between an AI model and an AI system. The model is the technology underneath; the system is the service you use. ChatGPT is an AI system that runs on OpenAI's models, and those are general-purpose AI models: they can perform many different tasks and were not built for a single purpose.
The AI Act has a separate chapter for these models. Its obligations have applied since 2 August 2025 and rest with the provider: technical documentation, information for those building on the model, a copyright policy and a summary of the training data. That is OpenAI's job, not your organisation's and not yours. The full timeline, including what shifted in 2026, is set out in the AI Act timeline after the Digital Omnibus.
So what applies to my organisation?
Under the AI Act your employer is a deployer: an organisation that uses someone else's AI system under its own authority. That role carries a shorter list of obligations than the provider's. The full list is in the EU AI Act for employers; below is the core for anyone who uses ChatGPT.
| Obligation | Who | Since | What you notice |
|---|---|---|---|
| Documentation and transparency about the model | OpenAI, as provider | 2 August 2025 | Nothing directly |
| AI literacy measures (Article 4) | Your organisation | 2 February 2025 | A briefing on which tools are allowed and which data does not belong in a prompt |
| Prohibited practices (Article 5), such as emotion recognition in the workplace | Your organisation | 2 February 2025 | Such features are not used |
| Transparency for chatbots and AI content (Article 50) | Provider and organisation, depending on the use | 2 August 2026 | A chatbot for customers or citizens makes clear it is AI |
| High-risk rules (Article 26) for Annex III applications, such as assessing applicants | Your organisation | 2 December 2027 | Only if ChatGPT is used for such an application |
The last row is where most of the confusion lies. The AI Act classifies applications, not tools. Using ChatGPT to write a job advert is not high-risk. Asking the same tool to rank fifty applications by suitability is an Annex III application. An employee should not make that call alone. It is a decision for the organisation, and it comes with oversight, instructions and informing the people concerned in advance.
What does Article 50 change?
The transparency rules have applied since 2 August 2026. Anyone running a chatbot for customers or citizens has to make clear that people are talking to AI. Providers of systems that generate text, images or audio have to label that content in a machine-readable way; systems already on the market have a transition period until 2 December 2026. Deepfakes have to be recognisable as artificial.
The AI Act requires no disclosure for an internal email or a report a colleague reads through. Texts an organisation publishes to inform the public can carry extra requirements. Anyone in communications or working as a spokesperson should check with whoever manages the organisation's policy, because that is who draws the line, not the employee writing a summary.
What stays the same?
The GDPR. It already applied to every prompt containing personal data, and the AI Act does not change that. Pasting an advisory memo with residents' names into ChatGPT was a GDPR question last year and still is. Which account you use matters here: OpenAI states that data from ChatGPT Business, Enterprise and Edu is not used for model training by default, while with a personal account you have to switch that off yourself. For more on ChatGPT, see the privacy risks of ChatGPT; for what can and cannot go into a prompt, see what not to share with AI.
How does this play out at the municipality?
The policy officer asks around. It turns out the municipality's register has three entries that concern her: Copilot allowed; ChatGPT with a business account allowed for public documents; ChatGPT with a personal account not allowed, with Copilot as the alternative. The advisory memo is public, so her summary was fine. What she did not know was that a colleague in recruitment had started using ChatGPT to assess applicants' letters, which is exactly the kind of use the AI Act does address. That stops until HR has worked out what oversight should look like.
An inventory also turns up Perplexity and two specialist tools that are in use but not yet in the register. That is not an incident. It shows that "what have we decided about ChatGPT?" can only be answered if the organisation knows which tools are in use, and that a one-off list soon goes out of date.
