EU AI Act ChatGPT at work rules are live right now, and they apply to far more organizations than the high-risk provisions everyone has been preparing for. If your staff use Copilot, ChatGPT, or any similar assistant in their jobs, you are a deployer of an AI system under the Act.
That matters more than it did a month ago. Since 2 August 2026, the European Commission’s AI Office and national authorities have been enforcing the AI Act, and new transparency rules now require certain AI systems to tell people they are dealing with AI and to mark AI-generated content.
The scale of exposure is easy to underestimate. Eurostat found that 19.95% of EU enterprises used AI technologies in 2025, rising to 55.03% among large enterprises — and those figures count sanctioned use, not what staff have quietly adopted.
In this article, we’ll cover which duties apply to everyday AI use today, why unmanaged AI is a security problem before it is a compliance one, and a table of exactly what your company should do this quarter.
Do I Need a Policy for Employees Using ChatGPT?
The EU AI Act does not require an AI acceptable use policy by name. It requires outcomes — AI literacy, appropriate use, transparency where relevant — that in practice you cannot evidence without one.
A policy is also the cheapest control available to you. It costs a fortnight of drafting and an internal comms push, and it closes the gap between what leadership assumes is happening and what is actually happening.
Here’s what a workable AI acceptable use policy covers:
- Approved tools and accounts. Which assistants are sanctioned, on which licenses, and who approves additions. Consumer accounts and corporate accounts have very different data handling.
- Data classification rules. What may never be pasted into an assistant — client confidential material, personal data, credentials, unreleased financials, source code under restrictive terms.
- Review obligations. Where AI-assisted output must be checked by a competent person before it leaves the building, and who that person is.
- Disclosure expectations. When customers, candidates, or counterparties must be told that AI was involved.
- Reporting route. How staff flag a bad output, a suspected data exposure, or a tool they want added, without fear of being blamed for asking.
Policies that only forbid things get ignored. The ones that work name an approved path, because staff are reaching for these tools to do their jobs faster, not to cause problems.
What Does the EU AI Act Require for AI Literacy Training?
Article 4 of Regulation (EU) 2024/1689 requires providers and deployers of AI systems to take measures ensuring, to their best extent, a sufficient level of AI literacy among staff and anyone else operating AI systems on their behalf. This obligation has applied since 2 February 2025.
Three things make Article 4 unusual, and worth reading carefully.
It applies to all AI systems, not only high-risk ones. It applies to deployers, not only builders. And it is explicitly contextual — the standard is calibrated to your people’s technical knowledge, experience, education, and training, the context the systems are used in, and the people the systems are used on.
Let’s look at what a proportionate AI literacy program actually contains:
- What these systems are and are not. Enough understanding that staff know an assistant is producing plausible text, not verified fact.
- Failure modes in plain language. Hallucination, confident errors, bias in outputs, and why fluent writing is not evidence of accuracy.
- Data handling. What happens to information entered into a tool, and how that differs between consumer and enterprise licenses.
- Role-specific depth. HR, legal, engineering, and marketing each need different examples. Generic training satisfies the letter and misses the point.
- A record that it happened. Attendance, content, and date. Article 4 asks for measures, and measures you cannot evidence are hard to defend.
This sits naturally alongside existing security awareness work. If you already run phishing simulations and annual training, adding an AI module is an extension rather than a new program — and our guide to social engineering covers ground that increasingly overlaps.
What Is Shadow AI and Why Is It a Compliance Risk?
Shadow AI is the use of AI tools inside an organization without the knowledge or approval of IT, security, or leadership. It is the AI-era version of shadow IT, and it moves considerably faster because the barrier to entry is a browser tab and a personal email address.
It creates a specific compliance problem: you cannot inventory what you do not know about, and almost every AI Act obligation begins with knowing what you run.
Here’s what shadow AI typically costs you:
- Data leaving your control. Client material pasted into consumer accounts with training rights you never reviewed.
- An inventory that is wrong. Your AI system register describes sanctioned tools while the real footprint sits outside it.
- Unreviewed AI features in tools you already own. Vendors add assistants to existing products; adoption happens by default rather than decision.
- Untraceable output. Work product no one can explain the provenance of, which becomes a problem the moment a client or regulator asks.
- A widening security surface. Browser extensions and integrations that request broad access to mail, files, and calendars.
Discovery is the first control here, and it is ordinary security work: network and SaaS visibility, expense review, browser extension inventory, and asking people directly without punishing honest answers. A structured risk assessment turns that picture into a prioritized list, and log management keeps it current after the first sweep.
Do You Have to Tell People They Are Talking to an AI?
Yes. Since 2 August 2026, Article 50 transparency obligations require that AI systems interacting directly with people are designed so those people are informed they are dealing with an AI, unless it is obvious from the circumstances to a reasonably well-informed person.
The Commission published guidelines on transparency obligations on 20 July 2026, and a Code of Practice on transparency of AI-generated content that more than 180 organizations had signed by the end of that month.
Here’s what Article 50 covers in practice:
| Chatbots and interactive systems | Tell people they are interacting with AI, not a human |
| Synthetic content | Mark AI-generated or AI-altered images, audio, video, and text in a machine-readable format |
| Deepfakes | Disclose that image, audio, or video content has been artificially generated or manipulated |
| AI-generated public interest text | Disclose where text is published to inform the public on matters of public interest |
| Emotion recognition and biometric categorization | Inform the people exposed to the system |
Two things make this the most widely relevant part of the Act. It applies regardless of risk tier, so a marketing chatbot is caught even though it is nowhere near high risk. And under Article 99, breaching Article 50 carries administrative fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher.
If your website runs an AI chat widget, or your content team publishes AI-generated imagery, this is a live obligation with a real penalty attached — not a 2027 planning item.
Are AI Assistants Like Copilot High Risk?
Generally no. General-purpose assistants used for drafting, summarizing, and everyday productivity are not high-risk AI systems in themselves. High-risk classification under Annex III depends on the use case, not the tool.
But the use case can change the answer, and that is where organizations get caught.
Here are the situations that move an ordinary assistant into scope:
- Screening candidates. Using an assistant to filter, rank, or score job applicants falls within the employment category of Annex III.
- Deciding on access to essential services. Credit, insurance, benefits, and similar decisions are covered.
- Evaluating employees. Performance evaluation, task allocation, and promotion decisions are within scope.
- Educational assessment. Determining access to education or evaluating learning outcomes is covered.
In each case the tool is unremarkable. The use is what triggers the obligation, and the obligation lands on you as the deployer — including human oversight, monitoring, log retention, and informing affected workers.
Those high-risk duties apply from 2 December 2027 for Annex III systems, following the AI Omnibus that entered into force on 27 July 2026. Article 4 literacy duties and Article 50 transparency duties apply now.
What Does My Company Actually Have to Do This Quarter?
If your AI use is limited to everyday assistants, the list is shorter than the coverage suggests. Most of it is work your own team can do without outside help.
The point of putting it in a table is that it turns an anxious topic into a set of tasks with owners. That is usually what unblocks the conversation internally.
Here’s the deployer baseline, in the order it makes sense to do it:
| Action | AI Act reference | Who usually owns it | Typical effort |
| Find out what is actually in use. Sanctioned tools, AI features inside licensed software, and shadow AI. | Art. 3(1) | IT and security | 2–5 days |
| Classify each use case. Almost all everyday assistant use is narrow scope. Flag anything touching hiring, evaluation, credit, or education. | Art. 5, 6, 50 | Compliance, with department heads | 2–4 days |
| Confirm your role. Deployer for licensed tools. Check whether anything has been rebranded or fine-tuned. | Art. 2, 25 | Legal and compliance | 1–2 days |
| Screen for prohibited practices. Emotion recognition in the workplace is the one that catches employers. | Art. 5 | Compliance and HR | 1–2 days |
| Name an owner. One person accountable, one route for approving new tools, one place the inventory lives. | Art. 4 | Executive sponsor | 1–2 days |
| Write the AI use and approval policy. Approved tools, data rules, review obligations, disclosure, reporting route. | Art. 4, 26 | Compliance, with HR and IT | 3–8 days |
| Deliver AI literacy training. Role-differentiated, recorded, proportionate to context. | Art. 4 | HR and security awareness | 2–5 days plus rollout |
| Run the transparency check. Chat widgets, AI-generated imagery, synthetic audio and video. Live obligation since August 2026. | Art. 50 | Marketing, product, and web | 1–3 days |
| Add AI clauses to vendor reviews. Documentation access, change notification, data handling. | Art. 22–25 | Procurement | 2–5 days |
| Set the reporting route. How staff flag a bad output or a suspected exposure without being blamed. | Art. 72, 73 | Security operations | 1–3 days |
Nine of those ten are policy, process, and communication. Only the discovery step usually needs tooling, and even that starts with expense reports and an honest conversation.
If any use case does land in Annex III territory, the obligations escalate considerably. Our guide to whether the EU AI Act applies to your company sets out the full breakdown by classification.
Frequently Asked Questions
Do I need a policy for employees using ChatGPT?
The EU AI Act does not require an AI acceptable use policy by name, but it requires outcomes such as AI literacy, appropriate use, and transparency that are difficult to evidence without one. A policy should cover approved tools, data classification rules, review obligations, disclosure expectations, and a reporting route. It is the cheapest control available and closes the gap between assumed and actual usage.
What does the EU AI Act require for AI literacy training?
Article 4 requires providers and deployers of AI systems to take measures ensuring, to their best extent, a sufficient level of AI literacy among staff and anyone operating AI systems on their behalf. It has applied since 2 February 2025, covers all AI systems rather than only high-risk ones, and is calibrated to the technical knowledge of your people and the context of use.
What is shadow AI and why is it a compliance risk?
Shadow AI is the use of AI tools inside an organization without the knowledge or approval of IT, security, or leadership. It is a compliance risk because almost every EU AI Act obligation begins with knowing what AI systems you run, and an inventory that misses unsanctioned tools is wrong from the start. It also creates data exposure through consumer accounts and untraceable work product.
Do you have to tell people they are talking to an AI?
Yes. Since 2 August 2026, Article 50 requires AI systems that interact directly with people to be designed so those people are informed they are dealing with AI, unless it is obvious from the circumstances. AI-generated or altered images, audio, video, and text must also be marked in a machine-readable format, and deepfakes must be disclosed. Breaching Article 50 carries fines of up to €15 million or 3% of worldwide annual turnover.
Are AI assistants like Copilot high risk under the EU AI Act?
Generally no. General-purpose assistants used for drafting, summarizing, and everyday productivity are not high-risk systems in themselves, because high-risk classification depends on the use case rather than the tool. However, using an assistant to screen job candidates, evaluate employees, decide access to essential services, or assess educational outcomes falls within Annex III and brings high-risk deployer obligations.
What does my company actually have to do this quarter about AI at work?
Find out what AI is actually in use including shadow AI, classify each use case, confirm your role, screen for prohibited practices, name an accountable owner, write an AI use and approval policy, deliver AI literacy training, run an Article 50 transparency check on chat widgets and generated content, add AI clauses to vendor reviews, and set a reporting route. Nine of those ten are policy and process rather than technology.
Strengthen Your AI Awareness With CyberGlobal
Most organizations discover their AI exposure the same way: someone asks a simple question in a management meeting and nobody can answer it. The gap between what leadership thinks is running and what staff actually use is where both the compliance risk and the security risk live.
But with the right partner by your side, closing that gap is a matter of weeks, not quarters.
At CyberGlobal, our GRC team helps organizations find what is actually in use, write policies people will follow, and build the awareness that makes those policies stick. We keep the scope proportionate — a company with 40 staff and three AI tools does not need an enterprise governance program.
We would rather tell you that a short policy and one training session covers your obligations than sell you a framework you will never use.
But behind our advanced technology, there are real people — local teams who will sit with your staff and answer the awkward questions honestly.
Reach out to CyberGlobal and let us be your ally against today and tomorrow’s cybersecurity challenges.