Using ChatGPT at work

The answer in thirty seconds

Using a generative assistant at work is perfectly legal and is not a high-risk use. Your obligations fit in two lines: take reasonable measures so that your teams know how to use it, and disclose the AI when it speaks to someone or when it produces content you publish. The rest — confidentiality, quality, copyright — is not imposed by the AI Act, but that is where the real risks for a business lie.

Training: what changed, and what almost nobody has written

Many French articles still announce a fine of 15 million euros, as of 2 August 2026, for a company whose staff have not been trained in AI. This is false.

The Digital Omnibus, which entered into force on 27 July 2026, rewrote Article 4. It now says that providers and deployers ‘take measures to promote the development of AI literacy’ among their teams, taking account of their knowledge and of the context — and it adds, in black and white, that ‘this obligation does not require providers or deployers to guarantee a specific level of AI literacy by an individual’. We have moved from a duty to deliver a result to a best-efforts obligation.

One honest caveat, because it matters: Article 4 does not appear in the list of breaches penalised by Article 99, but two indirect routes exist — the penalties each Member State lays down for any infringement of the regulation, and a new power of the AI Office. In other words: this is not the catastrophe announced, and it is not nothing either.

Your internal policy, on one page

The most useful document you can write fits on a single sheet and answers five questions:

• Which tools are allowed, and which are not.
• What never goes into them: personal data of clients or employees, health data, trade secrets, proprietary source code, documents from an ongoing case.
• What has to be reviewed by a human before it leaves the company — and by whom.
• What has to be flagged as AI-generated, and in what form.
• Who to call when in doubt. One name.

That one page, circulated and explained in a thirty-minute meeting, on its own makes up a serious part of the ‘measures’ expected by Article 4.

Three risks the AI Act does not cover, and that cost more

Confidentiality. What you paste into a consumer tool may, depending on the settings, be used to train a model. Vendors’ business plans generally provide for the opposite: check the setting rather than hope for it.

Personal data. Here it is the GDPR that applies, immediately and with no transition period: pasting a client file into a generative tool is a data transfer that has to have a legal basis.

Quality. Generated text is plausible before it is accurate. On a figure, a date, a legal reference or a name, checking is not a precaution: it is the only thing that protects you.

What you can do tomorrow

• Write the page of internal rules, even an imperfect one.
• Check the privacy settings on the accounts used in the company.
• Decide once and for all what never leaves the building.

Reference sources

Going further

This page is based on the consolidated text of Regulation (EU) 2024/1689 in its version of 27 July 2026. Verified 26 August 2026. General information: it does not constitute individual legal advice.