Legal decisions, use by use

Describe the actual activity before trying to classify its obligations.

This section is an orientation for decisions, not legal advice or a complete compliance assessment. Requirements depend on the system, the organisation's role, the data, the audience and the contractual arrangements. Check the official text and obtain appropriate advice for the proposed use.

Role, classification and literacy

An association using a third-party assistant will often be a deployer. Developing or offering a system under its own name may involve different responsibilities. A politically sensitive briefing is not automatically a high-risk AI system under the AI Act; a recruitment application may require a different assessment under the defined categories and conditions. [23]

The amended Article 4 requires providers and deployers to take measures supporting AI literacy among relevant staff and people acting on their behalf. It does not require a guaranteed level for every individual. Training should reflect real tasks, such as checking a summary, recognising an unsupported claim and knowing which information must not enter a tool. [24]

Transparency is not one rule

Article 50 distinguishes obligations. Providers of systems intended to interact directly with people generally need to make the AI interaction apparent unless it is obvious in context. Providers generating synthetic content face technical marking requirements, subject to specified exceptions. [25]

For deployers, disclosure requirements cover deepfakes and AI-generated or manipulated text published to inform the public on matters of public interest. The text-related exception concerns human review or editorial control together with editorial responsibility held by a natural or legal person. It is not a blanket exemption from deepfake disclosure. Your editorial policy may require more transparency than the legal minimum. [25]

Personal data, rights and commercial sensitivity

For personal data, establish the purpose, lawful basis, information provided to individuals, access, retention and contractual safeguards. Examine international transfers and whether an impact assessment is required. A no-training promise does not settle storage, access or deletion. CNIL provides practical guidance on these questions. [27]

Assess intellectual property separately. Access to a text, image or recording is not permission for every subsequent use. Examine source rights, output use and agreements concerning identifiable people and voices. [28]

For associations bringing together competitors, future pricing intentions, individual strategies and detailed commercial forecasts may be sensitive even without personal data. A shared assistant can raise questions about indirect information exchange. The Commission's horizontal cooperation guidelines address exchanges through associations, platforms and algorithms. Aggregation is not a universal exemption: assess information, market context, access and purpose before combining or disclosing it. [29]

Campaign context and application dates

Certain communications intended to influence legislative or regulatory processes can fall within the EU political advertising framework, depending on the activity, services, definitions and exceptions. Assess a relevant campaign before commissioning or distributing it; do not assume that all association communication is in scope. [30]

At the reference date of 13 October 2026, Article 113 retains general application of the AI Act from 2 August 2026, with differentiated dates. Specified provisions for Annex III high-risk systems apply from 2 December 2027, and specified provisions for Annex I product-related high-risk systems from 2 August 2028. Other provisions have their own dates. This is not a general postponement of every obligation. [26]

A useful approval record describes the specific use and the assessments it required. "We use AI" is not precise enough.