Staff use ChatGPT, Claude or Gemini for drafting and summaries

Minimal riskDeployer

The company pays for a team plan of a general-purpose chat assistant. Staff use it to draft emails, summarise documents and brainstorm.

How we classify it

It is an AI system, and the company uses it under its own authority, so the company is a deployer. The model vendor is the provider.
Drafting and summarising is not a prohibited practice and is not listed in Annex III, so it is not high-risk.
Staff read the output themselves; nothing is shown to customers as coming from a chatbot, so Article 50 does not apply to this use.
Result: minimal risk. The duties that apply are AI literacy (Article 4) and, if personal data goes in, GDPR.

Take AI literacy measures for the staff who use it (Article 4, since 2 February 2025)
Written rules on what data may be entered, and a signed acknowledgment
An entry in the AI system register with an owner
GDPR: a contract with the vendor as processor if personal data is entered, and no special-category data unless assessed

If the output is published as news or public-interest text without human editorial responsibility, the disclosure duty in Article 50(4) applies
If it is used to screen candidates or evaluate staff, the use becomes high-risk (Annex III point 4)

In the AI Compliance Kit: 02AI Acceptable Use Policy · 03AI System Inventory · 06AI Literacy Programme.

Legal basis: AI Act art. 3(4), 4; GDPR.