Since the AI Act came into existence, a trade has emerged in "AI compliance checks". Much of it sells fear of rules that don't apply to you.

This post is our own inventory, made to know where we stand. We haven't had a lawyer look at it, and you should know that before you read on. It's a map, not advice.

01 / the shortest versionDoes the AI Act require anything in your privacy policy?

No. Those are two different laws with two different subjects.

Your privacy policy is a GDPR document. It's about personal data: what you collect, for what purpose, for how long, and with whom you share it. The AI Act is about AI systems and their risks. There is overlap, but one law doesn't prescribe anything for you in the other's document.

What doesn't follow from that: that you don't need to write anything down. There are two reasons to do it anyway, and those are in blocks 4 and 5.

The question isn't whether you have to. The question is whether you can explain it if someone asks.

02 / the only rule that probably affects youWhen does Article 50 apply?

When someone is talking directly to an AI and doesn't realise it.

Article 50, first paragraph, comes down to this: if a human talks to an AI system, they must be told. Enforcement starts 2 August 2026.

There's an exception that settles a lot of discussions: it's not required if it's clear from the circumstances. Someone who clicks a button that says "chat with our assistant" already knows.

Concretely, for an average business:

In short: if you don't have an AI that talks directly to customers, Article 50 probably doesn't affect you.

03 / what isn't yoursWhich obligations lie with the model provider?

More than sellers of compliance packages tell you.

Two obligations that are often placed on the wrong shoulders:

Machine-readable marking of AI-generated content (Article 50, second paragraph) rests on the party that offers the generating system. If you use a language model from a provider, that's their obligation, not yours.

Labelling AI texts (fourth paragraph) only applies to texts published to inform the public about matters of general interest, journalism in short. And even there an exception applies when a human retains editorial control. Your newsletter or your quote doesn't fall under this.

Another misunderstanding that costs money: the heavy obligations in the Act apply to high-risk systems, and that's a defined list: recruitment and selection, credit scoring, education, biometrics, government services. Sales, marketing and internal automation aren't on it.

One warning about the dates. There's an amendment package that shifts the high-risk date from August 2026 to December 2027. At the time of writing, formal publication of that hadn't been confirmed. So don't present that postponement as an established fact to a client.

04 / what weighs heavierWhy is the GDPR the real work?

Because it already applies, is already enforced, and does ask something of your privacy policy.

The questions that matter in practice are almost all GDPR questions:

• Does personal data go to a language model? Then its provider is a processor and belongs on your list and in your processing agreement.
• Where is it processed? The major providers are based in the United States. That's allowed, but it requires justification, not silence.
• Does the system make decisions about people? Article 22 GDPR sets limits on decisions made solely by automated means that affect someone.
• Is data used to train models? Usually not with business subscriptions, but check it and write down what you found.

That last one is the most common mistake: companies promise "a human always checks" and then don't set that up. A promise you keep but can't demonstrate has to be reconstructed if there's a complaint.

05 / the six questionsSo what do you write down?

Answer these six and you have the content. The form comes after.

• Which AI do you use for what? One line per application.
• Does personal data go into it? If so: which, and whose.
• Who is the provider and where do they process it? Name and country.
• Does it talk directly to customers? If so, Article 50 applies and you add that line.
• Does a human check before anything goes out? And can you demonstrate that?
• What happens if someone objects? Who picks that up.

We answered these six for ourselves and came up with one relevant exposure: the moment a system we build starts talking directly to a client's customers. Everything else is minimal risk.

Our own advice to ourselves was actually stricter than the law: state that a report was drafted by AI, even when it isn't required. If your proposition is that you automate work, concealing that you do so is the worst possible signal.

This text was produced with AI assistance and checked and approved by a human before publication.