The AI Act and the GDPR: what to know before using an assistant at work

Two laws, two perspectives

When a company introduces an AI assistant, two pieces of EU legislation come into play. The GDPR deals with personal data: what may be processed, for which purposes and with which safeguards. The AI Act deals with artificial intelligence systems as such: how they are classified by risk and what obligations fall on those who develop them and those who use them.

The two overlap only in part. An assistant that answers questions about orders and invoices almost always processes personal data too, such as the names of customer contacts, and so falls under the GDPR. At the same time, the company using it is, in the language of the AI Act, a deployer of the system, with responsibilities of its own that cannot be handed over entirely to the vendor.

GDPR

• Protects personal data
• Purpose and legal basis
• Rights of data subjects

AI Act

• Regulates AI systems
• Risk-based approach
• Duties for providers and deployers

Classifying your uses

The AI Act does not treat every use the same way. Some practices are prohibited, some areas are considered high-risk, such as recruitment or the evaluation of workers, and others mainly carry transparency obligations. Most office uses fall into the categories with lighter requirements, but that is a conclusion to verify case by case, not to assume.

The first practical task is therefore an inventory: what does the company use the assistant for, or plan to use it for? Answering questions about customers and documents, drafting texts or summarizing reports are very different from screening job applications or assessing people’s performance. If a use case touches sensitive areas, it should be examined carefully before it is switched on, ideally with legal advice.

1. 01 List the use cases
2. 02 Note the data involved
3. 03 Assess the risk area
4. 04 Decide and document

Obligations for deployers

Even for lower-risk uses, some precautions always apply. The AI Act asks deployers to ensure an adequate level of AI literacy among the people involved: knowing what the tool does, where it can go wrong and how to check its results. Anyone interacting with an AI system, or receiving generated content, should be made aware of this where the circumstances require it.

On the GDPR side, the questions are the familiar ones, applied to a new tool. What is the legal basis for the processing, which data is genuinely needed, who acts as processor, where the data is processed and whether it leaves the European Union. For processing likely to result in a high risk to individuals, a data protection impact assessment may be required.

The AI service provider should be treated like any other supplier processing personal data on the company’s behalf: a proper contract, documented guarantees and a check of its security measures.

Before switching on

• Legal basis identified
• Data limited to what is needed
• Contract with the provider
• Processing location known
• People trained

Traceability and human oversight

Both laws reward a simple principle: being able to show what happened. A request log recording the user, the question, the sources consulted and the actions taken makes it possible to respond to a data subject’s access request, reconstruct an error and demonstrate that internal rules are genuinely applied.

Human oversight is the other pillar. An assistant that prepares the work and lets the person decide is easier to govern than a system that acts on its own. Even where the law does not require it, choosing explicit confirmation for actions that change data or communicate externally reduces risk and makes every later review simpler.

The most useful rules are the ones you can demonstrate, not just declare.

A sustainable approach

There is no need to turn every project into a legal file. A short document describing the authorized uses, the permitted data, the models in use and who reviews the log covers most needs, and should be updated whenever a new use case is added. The data protection officer, where there is one, should be involved from the start.

Innovaq’s AI is designed to support this approach. The assistant respects each user’s permissions, cites its sources, logs every request, carries out actions only after confirmation and lets you choose between off-the-shelf and dedicated models depending on where the data must stay. Compliance remains the company’s responsibility, but the tools to exercise it are already in place.