We only use ChatGPT in the office. Does it apply to us?

Yes. You are a deployer, and that already carries duties: taking AI-literacy measures for your team, use in line with the instructions of the provider, human oversight, and transparency if you generate content for third parties. You also have a parallel data protection problem if personal data or confidential information is pasted into the prompt.

We are a small startup. Are there exemptions?

There is proportionality and, since the Omnibus, more help: SMEs, startups and small mid-cap enterprises can submit their technical documentation using a simplified form (article 11), SMEs can meet parts of the quality management system in a simplified way (article 63), and there are regulatory sandboxes with priority access for them, plus the lower penalty cap. What there is not is an exemption: the Regulation sets no size threshold below which it does not apply.

If we already comply with the GDPR, are we covered?

No, but you have covered much of the ground. The GDPR governs the processing of personal data; the AI Act governs the system itself, whether or not it processes personal data. Your records of processing, impact assessments and vendor policy can all be reused as a foundation.

What will an auditor or a large client ask for first?

The system inventory with its risk classification, and evidence of the AI-literacy measures taken for staff. They are the two things asked for before anything else, and the two almost nobody has ready.

EU AI Act: what you have to do, and when (2026 guide)

First things first: what role you play under the rules

Your obligations do not depend on your size but on the role you play. And most Spanish companies occupy the second of these roles convinced that none of it applies to them.

Provider

You develop an AI system, or place it on the market under your own name or brand. It is the heaviest role: technical documentation, risk management, conformity assessment, CE marking where applicable.

Deployer

You use an AI system in your professional activity. This is 90 % of companies. You have obligations of your own: use in line with instructions, human oversight, informing the people affected, and staff training.

Importer or distributor

You bring third-party systems into the EU or sell them on. You must verify that the provider complied before putting the product into circulation.

Watch out for one counter-intuitive point: if you take a third-party system, put your brand on it and offer it to your clients, or if you substantially change its purpose, you become a provider with every obligation that entails.

The four risk levels

Unacceptable risk — banned

Social scoring, subliminal manipulation, exploitation of vulnerabilities, emotion recognition at work and in education, biometric categorisation using sensitive data, and untargeted scraping of facial images. Banned since 2 February 2025. From 2 December 2026 the list also covers non-consensual realistic intimate images of identifiable people and child sexual abuse material.

High risk — allowed, with heavy obligations

Recruitment and employment management, creditworthiness assessment, education, biometrics, critical infrastructure, essential public services, and systems acting as a safety component of an already regulated product. Obligations apply from 2 December 2027 (Annex III) or 2 August 2028 (Annex I products).

Limited risk — transparency obligations

Chatbots, conversational assistants and synthetic content generation. You must disclose that the user is interacting with an AI, and label generated or manipulated content as such.

Minimal risk — no specific obligations

Most everyday uses: spam filters, recommenders, internal optimisation. No obligations under the Regulation itself, though the GDPR and the rest of the law still apply.

Application timeline

Date	What comes into play
2 February 2025	Banned practices and the duty to provide AI literacy training to staff (article 4).
2 August 2025	General-purpose AI models (GPAI), the governance structure and the penalty regime.
27 July 2026	The Digital Omnibus on AI (Regulation (EU) 2026/1744) enters into force: it postpones the high-risk deadlines and recasts AI literacy (article 4).
2 August 2026	Transparency obligations (article 50): telling people they are dealing with an AI, marking synthetic content and disclosing deepfakes.
2 December 2026	Two new prohibitions: non-consensual realistic intimate images of identifiable people, and child sexual abuse material. Also the deadline for the article 50.2 marking of systems placed on the market before 2 August 2026.
2 August 2027	General-purpose AI models that were already on the market before August 2025.
2 December 2027	High-risk systems in Annex III: employment, biometrics, education, credit and the rest of the list.
2 August 2028	High risk embedded in already regulated products (Annex I).

Where to start, in practice

Inventory

A list of every AI system the company uses or sells. That includes the ChatGPT someone on the team uses without permission, and the AI module your long-standing software switched on in an update. It is almost never the three that management thinks.

Classification

For each system: its risk level and your role. This defines everything that follows, so getting it wrong multiplies the work or leaves you exposed.

AI literacy

Measures so that whoever uses these systems understands what it does and where its limits are. A duty since February 2025 and, after the July 2026 recast of Article 4, one of means rather than result: documenting it is still what proves it.

Governance

An internal AI use policy, an assigned owner, a record of decisions, effective human oversight and an impact assessment where required. Documented: what is not written down cannot be evidenced.

The contract chain

If you use third-party AI, your contracts must allocate liability and guarantee you information from the provider. If you sell AI, your clients will start demanding the same of you — and that is where compliance turns from a cost into a selling point.

The AI Act does not replace the GDPR

If the system processes personal data — and almost all of them do — you still need a legal basis, information for the data subject, minimisation and, in many cases, a data protection impact assessment. In practice both analyses are done at once, because 80 % of the documentation overlaps. Doing them separately means paying twice.

Want to know for your specific case?

Take the free EU AI Act test: in five minutes it tells you your risk level, your role and your obligations, with the article behind each one.

Penalties

Up to €35 million or 7 % of total worldwide annual turnover for engaging in banned practices, and up to €15 million or 3 % for other breaches — including failing to meet the deployer's obligations. For SMEs, startups and small mid-cap enterprises, the lower of the two figures applies. In Spain, supervision falls to AESIA, the Spanish Agency for the Supervision of Artificial Intelligence.

EU AI Act: what you have to do, and when