AI Act and ChatGPT: is your use compliant?
Using ChatGPT at work is still allowed under the AI Act. Since 2 August 2026, your duties come down to three things: disclosing AI when it is not obvious, labelling certain published content, and knowing whether you act as a deployer or a provider.
The question comes up in nearly every audit we run: "we use ChatGPT every day, are we breaking the law?" The short answer is no. The useful answer means separating a handful of situations that carry very different duties. If the topic is new to you, our AI Act compliance guide for SMEs sets out the general framework; this article deals only with the ChatGPT case.
No article of the AI Act bans ChatGPT
Regulation (EU) 2024/1689 does not target any brand: it regulates uses, roles and risk levels. No provision says "ChatGPT is banned" or "ChatGPT is allowed". What matters is what you do with it and where you sit in the chain.
Three parts of the regulation may apply when you use a generative AI tool such as ChatGPT:
- Article 5, which bans eight practices regardless of the tool, for example social scoring or emotion recognition in the workplace. The detail is in our article on prohibited AI practices;
- Article 50, which has imposed transparency duties since 2 August 2026. This is the part that covers 90 % of everyday office uses of ChatGPT;
- the high-risk regime, which is triggered by purpose rather than by tool, and whose deadline has moved.
Put differently, the same ChatGPT subscription may trigger nothing at all in a marketing team, and pull a company into a heavy regime if it is used to screen job applications.
In most cases you are a deployer, not a provider
This distinction drives everything else. Article 3 defines a provider as a party that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer is a party using an AI system under its authority in a professional context.
An SME buying ChatGPT Team licences for its staff is a deployer. OpenAI is the provider. The practical consequence: the heaviest duties in Article 50, in particular the technical marking of generated content, sit with the provider, not with you.
One point most articles miss: the role is not fixed. You can move to the provider side without changing tools, simply by changing how you expose it. We break down the scenarios in who the AI Act applies to.
Employees using ChatGPT under the company's authority are not separate deployers. Responsibility stays with the legal entity, including when a contractor or freelancer operates the tool on your behalf.
Machine marking of generated content is not your duty
Article 50(2) requires synthetic content to be marked in a machine-readable format, and that duty falls on the system provider. It is OpenAI that must make its outputs detectable as AI-generated, not your company.
Two important nuances, both confirmed by the European Commission's FAQ on Article 50:
- a limited grace period exists for systems placed on the market before 2 August 2026, and only for that marking duty: the providers concerned have until 2 December 2026. This is not a general postponement of transparency, contrary to what is often written;
- content generated before 2 August 2026 does not have to be labelled retroactively.
The trap lies elsewhere. Where you do have a disclosure duty, you cannot rely on the provider's technical marking to discharge it. The Commission says so explicitly: disclosure must be perceivable by a person, without any specific technical tool.
You only have to label ChatGPT text in one specific case
Article 50(4) covers text published to inform the public on matters of public interest, and only where it has not undergone human review. Three cumulative criteria, not one fewer: the text must be published, informative to the public, and about a matter of public interest.
The Commission's list of matters of public interest covers politics, public administration and services, justice and law enforcement, fundamental rights, public security, public health, environmental protection, consumer safety, and economic, financial, scientific or cultural developments that may feed public debate.
In practice, a product page written with ChatGPT falls outside that scope. A blog post about a tax reform, published without review, falls inside it.
And this is where the simplest way out sits, one that almost nobody highlights: text reviewed by a human does not have to be labelled. The Commission spells out what review means: a deliberate examination of the substance by a person with relevant knowledge, or editorial control by someone with authority to approve, alter or reject the text. Spell-checking or a formal proofread does not qualify.
For an SME the practical conclusion is clear: formalising a documented editorial review costs less, and reads better commercially, than an "AI-generated content" banner on everything you publish.
A ChatGPT chatbot on your website moves you to the provider side
If you plug the OpenAI API behind an assistant that you expose under your own brand, you are putting an AI system into service under your name. You become a provider within the meaning of Article 3(3), and Article 50(1) requires you to design the system so that users know they are interacting with an AI, from the first interaction, unless it is obvious.
The Commission reads that "unless it is obvious" exception narrowly: the benchmark is an average, reasonably well-informed and observant person. In practice, a visible notice at the top of the conversation settles it. The AI chatbot case and its notice are covered in our article on the AI information notice.
The same logic applies to images and video. If you produce realistic content depicting an existing person, place or event, you fall within the deepfake definition in Article 3(60) and must disclose it on first exposure. Artistic or satirical uses get a lighter regime, not an exemption.
Screening CVs with ChatGPT is a different matter
An HR purpose pushes the use into the high-risk regime, whatever the tool. Annex III covers, among others, systems used to filter applications and evaluate candidates. Using ChatGPT for that is no longer a matter of simple transparency.
Two things to keep in mind. First, the deadline has changed: the Digital Omnibus, adopted as Regulation (EU) 2026/1744 and in force since 27 July 2026, postponed the high-risk obligations for stand-alone Annex III systems to 2 December 2027, and to 2 August 2028 for AI embedded in already regulated products. Our full AI Act timeline lists every consolidated date.
Second, that postponement is not a licence. The GDPR already applies in full to processing candidate data, and Article 22 on automated decisions never paused. We cover the interplay in AI Act vs GDPR and in our GDPR glossary entry. If you run ChatGPT on personal data, the GDPR will catch up with you before the AI Act does.
A last point that is often missed: by steering a general-purpose system towards a high-risk purpose, you may, under Article 25, take on the role of provider of the high-risk system yourself. We develop this in our article on high-risk AI systems.
What to do, depending on your use
| Your use of ChatGPT | Your role | What you must do | Applicable since |
|---|---|---|---|
| Internal drafting, summaries, notes, code | Deployer | Nothing under Article 50 | Not applicable |
| Article published on a matter of public interest, no review | Deployer | Label the text clearly | 2 August 2026 |
| Same article after documented editorial review | Deployer | No labelling required | 2 August 2026 |
| Chatbot exposed on your site under your brand | Provider | Disclose from the first interaction | 2 August 2026 |
| Realistic image of an existing person or place | Deployer | Disclose the artificial nature | 2 August 2026 |
| CV screening, employee evaluation | High-risk deployer, sometimes provider | Full high-risk regime | 2 December 2027 |
Breaching the transparency duties can cost up to 15 million euros or 3 % of total worldwide annual turnover, with proportionality for SMEs. Enforcement sits with national market surveillance authorities. The detail is in our article on AI Act penalties.
AI training is no longer the hard obligation you were sold
The AI Omnibus softened Article 4 in July 2026: the AI literacy requirement on companies became an incentive, with the Commission and Member States taking the lead. Almost every piece published before summer 2026 still sells a firm obligation backed by a fine. That is out of date, and we would rather say so.
This does not make training pointless, for two verifiable reasons. Article 26 still requires effective human oversight from deployers of high-risk systems, which assumes competent teams. And the Article 50 duties assume your staff can recognise a labelling case: nobody applies a rule they do not know. Our full analysis is in AI Act Article 4: is AI training mandatory.
In short, train your teams because it prevents expensive mistakes, not because a regulator is threatening you.
How GrowthPerf helps SMEs on this
We always start in the same place: mapping. Until you know which AI tools actually circulate in the company, including free accounts opened by teams outside IT, no compliance analysis is worth much. The method and template are in mapping your AI systems.
Then comes qualification use by use, followed by two short deliverables: an internal AI policy stating what is allowed and with which data, and an editorial review procedure that, in most cases, spares you the Article 50(4) labelling.
On skills, our AI awareness and operational AI programmes are delivered by a Qualiopi-certified provider and can be funded through your OPCO. They cover both the regulatory framework and concrete uses, including prompt engineering applied to real jobs.
If you want to know where you stand before committing to anything, our 30-minute AI usage audit is free and carries no obligation. You leave with a list of your systems, your role for each of them, and the two or three actions that genuinely matter.
Frequently asked questions
Is using ChatGPT at work legal in 2026? Yes. No provision of the AI Act bans ChatGPT. Only certain uses are prohibited, under Article 5, such as emotion recognition in the workplace. The rest falls under transparency or the high-risk regime depending on the purpose.
Do I have to disclose that my content was generated with ChatGPT? Only if the text is published, informs the public on a matter of public interest, and has not been reviewed by a human on the substance. A product page or a commercial newsletter falls outside that scope.
Is a quick proofread enough to avoid labelling? No. The Commission requires examination of the substance by a competent person, or editorial control with authority to approve or reject the text. Spell-checking or a formal proofread does not qualify.
Does the 2 December 2026 deadline buy me time? In most cases, no. That deadline only covers the machine-readable marking duty in Article 50(2), for systems already on the market before 2 August 2026, and it falls on providers. Your deployer duties have applied since 2 August 2026.
Does ChatGPT Enterprise make me compliant automatically? No. The subscription tier changes contractual guarantees and how your data is handled, which matters a great deal for the GDPR, but it does not change your role or your duties under the AI Act.
What does an SME risk by doing nothing? Up to 15 million euros or 3 % of worldwide turnover for a transparency breach, with proportionality for SMEs. In practice the most frequent near-term risk remains the GDPR and confidential data leaking into a consumer tool.
Where should I start from scratch? List the AI tools actually in use, including personal accounts, then qualify each use: deployer or provider, publication or internal use, personal data or not. That mapping drives everything else, and takes half a day in a company with fewer than 50 staff.