Rules That Apply to My Role

Build your own rule inventory for AI use: which parts of the EU AI Act reach you and when, what GDPR means for what you type into a tool, and what your organization actually requires.

Standard or regulation: the EU AI Act, Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744; data protection guidance from IMY and the EDPB (Opinion 28/2024). The dates for February 2025, December 2026 (new bans and Article 50(2) for systems already on the market), December 2027 and August 2028 were checked against the amending regulation on EUR-Lex. The amended Article 4 wording and the August 2026 date for Article 50 were not confirmed; those rows are marked. This area moves; confirm on EUR-Lex before you rely on a date. This page is orientation, not legal advice.

Use it when:

• You want to know what you may and may not do with AI in your role.
• Someone asks "is this even allowed?" and nobody knows where the answer is written.
• You are about to write or update a team policy (10.10 Team AI Policy).

Skip it when:

• You want the practical risks and controls rather than the rules: use 10.2 What Can Go Wrong.
• The question is about your private use: use 10.4 Personal Privacy Check.

The EU AI Act regulates by risk. A few practices are banned outright, high-risk uses such as recruitment or credit scoring carry heavy duties, and ordinary office use carries light ones (Regulation (EU) 2024/1689). The rules arrive in stages, and the stages move. An amending regulation in 2026 (Regulation (EU) 2026/1744) pushed the high-risk dates back, added bans on AI that makes sexual images of real people without their consent, and softened the AI literacy duty: providers and deployers must now take measures to support their staff's AI literacy, without guaranteeing a set level for each person. Something you read about the Act in 2025 may already be out of date.

For most professionals, data protection reaches further than the AI Act. Personal data in a prompt is ordinary GDPR processing, and European regulators say so in their guidance (IMY; EDPB, 2024). The third layer is your own organization's rules, often thinner than people assume. So this page works from the outside in: the law's timeline, the literacy duty, GDPR, then your workplace, ending with the gaps you need answered.

For each stage, write Yes, No or Unsure. "Unsure" is an honest answer; it becomes a question in Step 4.

Strong answer: "Feb 2025: Yes, we use assistants for office work. Dec 2027: Yes, HR is piloting a screening tool for applications, which is an Annex III area."

What most professionals need to know: if you only use general-purpose assistants for ordinary office work, the bans, the literacy duty and the transparency rules are what reach you. The high-risk rules matter if your organization builds or uses AI in Annex III areas. Recruitment and worker management are on that list, which makes HR the most common way an ordinary organization walks into high-risk territory.

Illustrative example: the roles and the organization are made up.

A team lead at a mid-sized engineering firm in Sweden fills in the page.

Step 1: office assistants are used daily (Yes for 2025 and the literacy row). HR is piloting an AI tool that ranks applications: Yes for December 2027, an Annex III area. The marking rows: Unsure.

Step 2: she uses AI on the firm's behalf. Support today: none she can find. She would show this module and her own notes.

Step 3: no applicant or employee data goes into the general assistant. The screening pilot touches automated decisions about people, so GDPR Article 22 applies already, not in 2027.

Step 4: IT has a list of approved tools, but there is no disclosure rule and no training. Biggest gap: who reviews the screening tool's rankings. She asks HR to bring in the data protection officer now, books a short AI course for her team and starts a team policy (10.10) to cover the rest.