A policy officer at a municipality uses ChatGPT to summarise a long advisory memo before she reads it. A colleague sees it and asks whether that is still allowed now that the AI Act applies. She is not sure, and the news reports about fines in the millions do not make it clearer.
The short answer: little changes in her daily work. ChatGPT is built on a general-purpose AI model, and the heavy obligations of the AI Act sit with OpenAI as the provider. For her organisation three things apply: explain AI use, do not deploy a few applications, and follow the high-risk rules for certain applications. What she herself needs to know is what the organisation has decided about ChatGPT, and which data does not belong in a prompt. That was already true before the AI Act.
What is ChatGPT according to the AI Act?
The law distinguishes between an AI model and an AI system. The model is the technology underneath; the system is the service you use. ChatGPT is an AI system that runs on models from OpenAI, and those models are general-purpose AI models: they can perform many different tasks and were not built for one purpose.
For such models the AI Act has a separate chapter, with obligations that have applied since 2 August 2025 and that sit with the provider: technical documentation, information for parties that build on the model, a copyright policy and a summary of the training data. That is OpenAI's work, not your organisation's and not yours. What the full timeline looks like, including what shifted in 2026, is in the AI Act timeline after the Digital Omnibus.
What applies to my organisation, then?
Under the AI Act your employer is a deployer: an organisation that uses someone else's AI system under its own authority. A shorter list comes with that than with the provider. The full list is in the EU AI Act for employers; this is the core for anyone who uses ChatGPT.
| Obligation | Who | Since | What you notice |
|---|---|---|---|
| Documentation and transparency about the model | OpenAI, as provider | 2 August 2025 | Nothing directly |
| Measures for AI literacy (Article 4) | Your organisation | 2 February 2025 | An explanation of which tools are allowed and which data does not belong in a prompt |
| Prohibited practices (Article 5), such as emotion recognition in the workplace | Your organisation | 2 February 2025 | Such features are not deployed |
| Transparency for chatbots and AI content (Article 50) | Provider and organisation, depending on the application | 2 August 2026 | A chatbot for customers or citizens makes clear it is AI |
| High-risk rules (Article 26) for Annex III applications, such as assessing applicants | Your organisation | 2 December 2027 | Only if ChatGPT is used for such an application |
The last row is where the confusion usually sits. The AI Act classifies applications, not tools. Using ChatGPT to write a job advert is not high-risk. Asking the same tool to rank fifty applications by suitability is an Annex III application. That is not a decision an employee takes alone; it is a decision for the organisation, with oversight, instructions and informing the people concerned in advance.
What changes because of Article 50?
The transparency rules have applied since 2 August 2026. Anyone running a chatbot towards customers or citizens makes clear that people are talking to AI. Providers of systems that generate text, images or audio make sure that content carries a machine-readable marking; for systems already on the market there is a transition period until 2 December 2026. Deepfakes have to be recognisable as artificial.
For an internal email or a report a colleague reads over, the AI Act requires no statement. For texts an organisation publishes to inform the public, additional requirements can apply. Anyone working in communications or as a spokesperson asks whoever manages the organisation's policy, because that is where the line sits, not with the employee making a summary.
What stays the same?
The GDPR. It already applied to every prompt containing personal data and does not change because of the AI Act. Pasting an advisory memo with residents' names into ChatGPT was a GDPR question last year and still is. Which account you use matters here: OpenAI states that data from ChatGPT Business, Enterprise and Edu is not used for model training by default, while in a personal account you have to switch that off yourself. What else applies to ChatGPT is in the privacy risks of ChatGPT, and what can and cannot go into a prompt in what not to share with AI.
What does that look like at the municipality?
The policy officer asks. The municipality's register turns out to have three rows that concern her: Copilot allowed, ChatGPT with a business account allowed for public documents, ChatGPT with a personal account not allowed, with Copilot as the alternative. The advisory memo is public, so her summary was fine. What she did not know: a colleague in recruitment had started using ChatGPT to assess applicants' letters, and that is the application the AI Act does say something about. That use stops until HR has determined what oversight looks like.
An inventory also shows Perplexity and two specialised tools in use that are not yet in the register. That is not an incident. It shows that the question "what have we decided about ChatGPT" can only be answered if the organisation knows which tools are in use, and that a list made once quickly falls behind.
