EU AI Act for Business: What Every Team Using ChatGPT and Other AI Tools Needs to Know in 2026

Do You Know How Your Team Is Using AI Right Now?

There are probably already people in your company using ChatGPT. Someone is writing emails. Someone else is analysing an Excel file. Another person is uploading a client document to an AI tool. A fourth is generating images for social media.

But do you know exactly which tools your employees use, what data they enter and how they check the results?

In the corporate training sessions I run, I ask this question within the first ten minutes. The most common response from management is a telling pause. Not because anyone is hiding anything, but because AI entered the workplace from the bottom up: people simply started using it.

This is where the EU AI Act stops being a topic just for tech giants. Even an organisation that will never develop its own AI model has responsibilities when its employees use AI at work. The good news is that these responsibilities are reasonable, achievable and largely come down to one thing. Your people need to know what they are doing.

What Is the EU AI Act? A Plain-English Explanation

The EU AI Act (Artificial Intelligence Act) is a European Union regulation governing how AI systems are developed, placed on the market and used in the EU. As a regulation, it applies directly in Bulgaria without requiring a separate Bulgarian law to take effect. It entered into force on 1 August 2024 and applies in stages through to 2028 (European Commission).

Its logic is simple: the greater the risk associated with a particular use of AI, the stricter the rules. The regulation does not regulate “AI” as a technology, but the specific ways in which it is used.

The Four Levels of Risk

Risk level	What it means	Examples
Unacceptable risk	Prohibited	Social scoring, emotion recognition in the workplace, manipulative AI
High risk	Strict requirements before and during use	AI for screening CVs, evaluating employees and credit scoring
Transparency-related risk	An obligation to inform people	Chatbots, deepfake content
Minimal or no risk	No specific rules	Spam filters, AI in video games

According to the European Commission, the vast majority of AI systems used in the EU fall into the last category. This provides important perspective: the AI Act is not a ban on AI in business.

What Already Applies and What Comes Next (as of October 2026)

In July 2026, the EU adopted the first amendment to the regulation, known as the Digital Omnibus on AI (Regulation (EU) 2026/1744). It postponed the rules for high-risk systems and softened the wording of the AI literacy obligation. This is why many articles published in 2025 now contain outdated dates.

Date	What starts to apply	Status
2 February 2025	Prohibited practices (Article 5) and AI literacy (Article 4)	Applies
2 August 2025	Rules for general-purpose AI (GPAI) models and governance	Applies
27 July 2026	The Digital Omnibus on AI enters into force	In force
2 August 2026	General application, transparency rules (Article 50), supervision by national authorities	Applies
2 December 2026	New prohibition: AI systems for non-consensual sexual content and child sexual abuse material	Upcoming
2 December 2027	High-risk systems in sensitive areas (employment, education, biometrics, credit and others)	Upcoming
2 August 2028	High-risk AI systems embedded in products (machinery, lifts, toys)	Upcoming

Sources: European Commission, AI Act, Regulation (EU) 2026/1744 on EUR-Lex.

What this means in practice: for a company using ready-made AI tools, the most relevant issues today are AI literacy, transparency and avoiding inadvertently crossing into prohibited or high-risk uses.

In Bulgaria, the Ministry of e-Governance has been designated as the lead authority for implementing the regulation (Access to Public Information Platform). Work on the national framework for supervision and penalties is ongoing, so keep an eye on official announcements.

“We Only Use ChatGPT. Does This Affect Us?”

Yes, it does, but in most cases the obligations are less extensive than you might think. When your employees use an AI tool at work, your company is a deployer within the meaning of the regulation. The European Commission gives this exact example: a company whose employees write advertising copy or translate using ChatGPT must comply with the AI literacy requirement by ensuring that its people are aware of risks such as “hallucinations” (AI Literacy Q&A).

Provider and Deployer: The Two Roles You Need to Know

Role	Who this is (under Article 3 of the regulation)	Example
Provider	Develops an AI system or model, or has it developed, and places it on the market under its own name or brand	OpenAI, Anthropic, Google, Microsoft
Deployer	Uses an AI system under its authority in a professional capacity	Your company when the team works with ChatGPT or Copilot

Personal, non-professional use falls outside the definition of a deployer. But once an employee uses AI for work tasks, this is use on behalf of the company.

Be aware: if your company builds its own customer-facing chatbot using a large model’s API and launches it under its own name, you may become the provider of that system, with additional obligations. At that point, seeking a legal assessment is sensible.

Routine and Sensitive Uses: Examples from Everyday Work

Situation	Sensitivity	What to watch out for
A marketing employee writes copy with ChatGPT	Low	Fact-checking, copyright, brand voice
The team uses Copilot in Microsoft 365	Low to medium	Which company files the tool can access
An employee uploads a company document to Claude	Medium	Confidentiality, data settings, business or personal account
A salesperson analyses customer data using AI	Medium to high	Personal data and GDPR, accuracy of conclusions
AI for translation, communication and customer support	Medium	Customers must know when they are talking to a chatbot (the provider’s obligation)
Generating images and video	Medium	Realistic content featuring real people or events may qualify as a deepfake and require disclosure
HR uses AI for recruitment or evaluation	High	A high-risk area; some practices, such as emotion recognition, are prohibited

The common thread across all these cases is that the AI Act does not prohibit you from using these tools. It expects the people using them to understand what they are doing. Alongside the AI Act, GDPR, copyright rules and your contractual confidentiality obligations continue to apply.

AI Literacy: The Most Important Issue for Businesses Today

AI literacy means the skills, knowledge and understanding that enable people to make informed use of AI and recognise its opportunities, risks and the harm it may cause (a paraphrase of the definition in Article 3(56) of the regulation).

Article 4 creates an obligation affecting almost every company with a team using AI. It has applied since 2 February 2025, and national market surveillance authorities have supervised it since August 2026. Supervision of Article 4 takes place at national level, rather than through the EU AI Office (AI Literacy Q&A).

What Did the Digital Omnibus Change in Article 4?

	Original wording (2024)	After the Digital Omnibus (in force since 27 July 2026)
Wording	Measures to ensure, to the best extent possible, a “sufficient level” of AI literacy	Measures to support the development of AI literacy
Is a specific level required?	Yes, a “sufficient” level	Explicitly no: no particular level is guaranteed for an individual
Does the company still have an obligation?	Yes	Yes

The Commission emphasises that AI literacy remains an obligation for providers and deployers, but without a mandatory “sufficient” level (AI Literacy Q&A). The obligation concerns effort rather than outcomes. Put simply, you should be able to show that you have taken meaningful action.

Who Does the Company Need to Train?

Everyone working with AI systems on behalf of the company. This includes employees, but may also cover “other persons”: contractors, service providers and even customers, depending on the context and risk.

Does Everyone Need to Become an AI Expert?

No. Article 4 requires consideration of people’s technical knowledge, experience, education and training, as well as the context of use. The Commission explicitly allows different levels of training for different groups.

Is a Certificate Required?

No. The Commission says there is no need for a certificate, and organisations can keep an internal record of training and other initiatives. There is also no obligation to measure employees’ knowledge levels.

Is Training Mandatory?

The regulation does not prescribe a specific format or a mandatory course. However, the Commission notes that, in many cases, simply asking people to read a tool’s instructions for use may not be effective. In practice, structured training is the easiest way to demonstrate that you have taken action.

What Does an Employee Actually Need to Know?

The Commission recommends that AI programmes start with four questions: what AI is and how it works; whether the organisation develops AI or only uses it; what risks the specific systems pose; and what knowledge and context the people involved bring.

From my experience in training sessions, I would add: good AI literacy training is about more than “how to write prompts”. It should also cover:

• the limitations of AI and why it “sounds confident” even when it is wrong;
• hallucinations and how to verify information;
• handling confidential, personal and customer data;
• copyright and intellectual property rights in generated content;
• human oversight: when a person needs to take responsibility for the decision;
• bias in the results;
• appropriate and inappropriate applications for a particular role.

These are my recommendations for good practice, not explicit requirements of the regulation.

Different Training for Different Roles

Role	Training focus
Management	Risks, accountability, AI policy, decisions about tools
HR	Why recruitment and evaluation are high-risk areas, prohibited practices, bias
Marketing and communications	Fact-checking, copyright, deepfakes and disclosure, brand voice
Sales teams	Customer data, GDPR, checking conclusions drawn from analysis
Customer service	Chatbots, transparency with customers, escalation to a human
IT and digital transformation	Tool selection and settings, data access, when the company becomes a provider

An important clarification: if the company uses a high-risk AI system, a separate, stricter obligation under Article 26 also applies: the people exercising human oversight must have the necessary competence, training and authority.

Not Sure Where to Start?

That is completely normal. In most companies I work with, AI is already being used, but there are no shared rules, consistent approach or adequate team preparation yet.

A major project is rarely the best starting point. Usually, it starts with a conversation: how your people use AI today, where the risks are and which next steps make sense for your particular organisation.

Get in touch

Transparency and Human Oversight: What Applies to You

The transparency rules under Article 50 have applied since 2 August 2026: people must know when they are interacting with AI or viewing certain types of AI content. Some obligations apply to providers and others to deployers, including companies that simply use AI (AI Act Service Desk, Article 50).

Situation	Who is responsible	What is required
A chatbot that interacts with customers	The system’s provider	People must know they are talking to AI
AI generates text, images, audio or video	The system’s provider	Machine-readable marking that identifies the content as artificially generated
You publish a deepfake (a realistic image, audio recording or video of real people, places or events)	The deployer, meaning you	Disclose that the content has been generated or manipulated
You publish AI-generated text informing the public about matters of public interest	The deployer, meaning you	Disclosure, unless the text has undergone human editorial review and someone holds editorial responsibility
You use emotion recognition or biometric categorisation	The deployer, meaning you	Inform the people affected

What this means for marketing and communications: ordinary advertising or product copy written with AI assistance and reviewed by a person generally does not fall under the disclosure obligation in Article 50. A realistically generated video of someone saying something they never actually said does. The Commission has published transparency guidelines with examples and exceptions. Remember that social media platforms also have their own rules on AI content.

Human Oversight: A Legal Requirement or Good Practice?

It is important to be precise here. The explicit human oversight requirements in the AI Act (Articles 14 and 26) concern high-risk AI systems. For everyday work with ChatGPT, the regulation does not say that “every output must be checked by a person”.

But human review is the cheapest insurance you have. Responsibility for the email you send, the copy you publish or the decision you make about a customer remains yours, not the tool’s. GDPR also protects people against decisions with significant effects that are made entirely through automated processing. So my recommendation is clear: AI suggests, a human decides, at least for anything shared externally or affecting people.

6 Mistakes I See in Companies

The most common problem is not bad intentions, but a lack of clarity. Here are the six mistakes I encounter most often during training and the audits that precede it.

Mistake 1: “Everyone Already Uses ChatGPT, So There Is No Need for Training.”

Using a tool does not mean understanding its limitations. People who use AI every day are often the ones who most confidently copy an unchecked output.

Mistake 2: No Clarity on Which AI Tools Are Approved

Without a list, everyone makes their own choice. Company data then ends up in free personal accounts that no one in the company knows about.

Mistake 3: Employees Upload Company or Customer Data Without Any Rules

Contracts, proposals, CVs, financial spreadsheets. Without a clear rule about “what is allowed and what is not”, people make decisions on the fly, under deadline pressure.

Mistake 4: AI Outputs Are Used Without Human Review

Invented statistics in a board presentation. An incorrect price in a proposal. A non-existent legal provision in an email to a client. Hallucinations are not just theoretical.

Mistake 5: The Company Has a Policy That Nobody Understands

Ten pages of legal language, emailed around and signed to acknowledge receipt. A policy only works if someone can explain it to a colleague in two minutes.

Mistake 6: One-Size-Fits-All Training for Every Role

HR, marketing and finance use AI in very different ways and face different risks. The Commission itself encourages training tailored to people’s knowledge and context.

What a Good Internal AI Policy Should Include

The AI Act does not explicitly require a written AI policy, but having one is the most practical way to demonstrate that you support your team’s AI literacy. The Commission does not prescribe a particular governance structure either: you do not have to appoint an “AI officer” or establish an AI board. A good policy is short, understandable and kept up to date.

This is a practical checklist, not a legal document:

• ☐ Approved tools: which AI tools may be used and with what type of account (business or personal).
• ☐ Prohibited data: what must never be entered into AI (customers’ personal data, trade secrets, passwords, unsigned contracts and so on).
• ☐ Mandatory human review: when outputs must be checked before use (anything shared externally or affecting people).
• ☐ Personal and customer data: how GDPR rules apply when working with AI.
• ☐ Accountability: who is responsible for the final result (the answer is always a person, not the tool).
• ☐ Disclosure: when AI content must be labelled (deepfakes, public-facing text without human editorial review, platform rules).
• ☐ Reporting: how an employee reports an error, a data leak or a problematic output.
• ☐ Escalation: which situations require consultation with IT, security, legal or management (a new tool, HR use, automated decisions about customers).
• ☐ Training: who receives which training and how it is recorded.
• ☐ Review: when the policy is updated (I recommend at least every six months or whenever a new tool is introduced).

A useful test: if an employee cannot tell you the policy’s three most important rules without opening it, it is too long.

Take Particular Care: When AI Use Becomes Risky

Not all AI applications are the same. When AI influences decisions about people (employment, credit, education, access to services), the regulation becomes much stricter. Some practices have been prohibited since February 2025, while others are classified as high-risk and will face strict requirements from 2 December 2027 (European Commission).

Area	What the AI Act says	Status
Emotion recognition in the workplace and education	Prohibited (with exceptions for medical or safety reasons)	Prohibited since 2 February 2025
Biometric categorisation to infer sensitive characteristics	Prohibited	Prohibited since 2 February 2025
Recruitment (targeted job advertisements, CV screening, candidate evaluation)	High-risk area (Annex III)	Requirements apply from 2 December 2027
Employee evaluation, promotion, termination, task allocation, performance monitoring	High-risk area (Annex III)	Requirements apply from 2 December 2027
Credit assessment and access to essential services	High-risk area (Annex III)	Requirements apply from 2 December 2027
Education: admissions, assessment, monitoring during examinations	High-risk area (Annex III)	Requirements apply from 2 December 2027

Whether a specific system is high-risk depends on its intended purpose and how it is used. The regulation also includes exceptions, for example for systems performing a narrow procedural task. So not every use of AI in HR is automatically high-risk.

A practical example: an HR professional using ChatGPT to write a clearer job advertisement is in a very different position from a company deploying software to rank candidates automatically. And a tool that “analyses the emotions” of a candidate during a video interview takes the company into territory it should not enter at all.

If you use or plan to use AI for recruitment, evaluating people, biometrics, automated customer decisions or other sensitive decisions, this is where your organisation should seek a specialist legal assessment. This is also the point where AI policy, training and human oversight become critical rather than simply “good practice”.

10 Questions Every Company Should Ask Itself

The quickest way to understand where you stand is to answer these ten questions honestly. “I don’t know” is an answer too.

1. Do we know which AI tools our employees use?
2. Do we have a list of approved AI tools?
3. Are there clear rules on what information may be shared with AI?
4. Have our people been trained to check AI outputs?
5. Do employees understand the limitations and risks of generative AI?
6. Do we use AI in HR or other sensitive processes?
7. Is there a designated person or team responsible for the AI policy?
8. Do we have human oversight of important decisions?
9. Do we document AI training and internal initiatives?
10. Do we have a process for updating the rules when new AI tools are introduced?

If your answer to several of these questions is “I don’t know”, that does not necessarily mean you are breaking the law. But it is a good indication that your organisation needs a clearer approach to AI.

How Prepared Is Your Organisation? AI Act Readiness Check

I have created a short AI Act Readiness Check that takes around three minutes and helps you assess whether your organisation has the basic processes, AI literacy and rules needed for responsible use of artificial intelligence.

This is a practical assessment of your team’s readiness, not a legal review, a compliance audit or proof that the company complies with the law. The result shows which areas are in place and where it makes most sense to start.

Area	What it assesses
People	Whether your people know how to use AI responsibly
Tools	Whether it is clear which tools are used and which are approved
Data	Whether there are rules for company, personal and customer data
Processes	Whether AI is integrated into workflows in a controlled way
Governance	Whether there is an owner, a policy and documentation
Human Oversight	When and how a person reviews outputs and makes decisions

[Take the Free AI Act Readiness Check]

Bringing Order to AI Use Without Panic

The EU AI Act should be seen as more than just another regulation. It gives companies a good reason to finally adopt a more mature approach to AI:

clear rules + trained people + appropriate tools + human oversight.

For most companies using ChatGPT, Claude, Gemini or Copilot, this does not need to be a major legal project. It is about getting organised: knowing what is being used, having a few clear rules and making sure people understand the tool in front of them. There is no need to panic. But it is certainly worth putting a clear framework around how you use AI.

This article is for information and educational purposes and does not constitute legal advice. For a specific legal assessment of how the EU AI Act applies to a particular system or organisation, consult a specialist in European technology law.

Official Sources

• Regulation (EU) 2024/1689 (AI Act), EUR-Lex
• Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex
• AI Act, European Commission
• AI Literacy – Questions & Answers, European Commission
• Article 50, AI Act Service Desk
• Guidelines on Transparency for AI-Generated Content, European Commission
• AI Act Single Information Platform (Service Desk)

Want to Prepare Your Team to Work with AI?

I deliver practical corporate AI training tailored to your team’s roles, processes, tools and current level. We work with your actual tasks and documents rather than generic examples.

Depending on your organisation’s needs, the training may cover:

• AI literacy;
• the EU AI Act from a practical perspective;
• responsible AI;
• handling company and customer data safely;
• the risks and limitations of generative AI;
• checking AI outputs;
• human oversight;
• internal rules for working with AI;
• practical case studies from employees’ day-to-day work;
• ChatGPT, Claude, Gemini, Microsoft Copilot and the other tools your team uses.

You do not need to know exactly what training you need in advance. We can first discuss how your team currently uses AI, where the main challenges are and which format would be most useful. If training turns out to be a good fit, we will design it together.

My role is to help organisations put AI into practice and prepare their people. If your organisation needs a specific legal assessment under the EU AI Act, I recommend consulting a specialist in European technology law.

Get in touch

Frequently Asked Questions About the EU AI Act