A business owner hears "AI Act" and thinks: another law to deal with. The question that matters is simpler: what do I need to do now, and what can wait? The answer starts with understanding that the AI Act and the GDPR regulate two different things and apply side by side.
#GDPR and AI Act: two laws, two questions
The GDPR asks a question about data: do you process personal data lawfully, with a legal basis, purpose limitation and data minimisation? That law applies as soon as personal data is involved, including in an AI tool.
The AI Act asks a question about the system: how risky is this AI system, and which safeguards does it need? That law looks at the system itself, regardless of whether it contains personal data.
If you use AI with personal data, you must comply with both. The GDPR says what may happen to the data; the AI Act says how safe and transparent the system must be.
#The AI Act works with risk levels
The AI Act sorts AI systems by risk:
- Prohibited. A short list of practices that are not allowed, such as social scoring by governments. Prohibited since 2 February 2025.
- High risk. AI used in decisions with major consequences for people, for example recruitment and selection, assessment or access to services. These carry the heaviest obligations.
- Limited risk. Here the main requirement is transparency, such as making clear that someone is talking to AI or that content was made by AI.
- Minimal risk. Most everyday uses, with few extra obligations.
Important for most organisations: a general chatbot you use to write or summarise text usually does not count as high risk. That changes as soon as you use AI for decisions with major consequences for people.
#The timeline: what applies when
The AI Act entered into force on 1 August 2024 and is being phased in. The high-risk deadline was originally 2 August 2026; in July 2026 the Digital Omnibus moved it to 2 December 2027.
What exactly changed and what carries on as planned is covered in the AI Act timeline after the Digital Omnibus.
#What most organisations must do now
Two things apply regardless of whether you use high-risk AI.
1. AI literacy (since 2 February 2025). Organisations must make sure that staff who work with AI systems have enough knowledge and skills to use them responsibly. It does not need to be a formal qualification, but you must be able to demonstrate it. In practice this means explaining what AI may and may not be used for, and which data does not belong in a prompt. Our guide on what you can and cannot share with AI can form part of that.
2. A GDPR basis for personal data in AI. If you use AI with personal data, you need a lawful basis, purpose limitation and data minimisation, and often a data processing agreement with the vendor. The AI Act does not change this; it was already in the GDPR.
#What is added for high-risk AI
If you deploy a high-risk AI system, extra duties apply to you as the deployer from 2 December 2027, including:
- Human oversight of how the system works.
- Informing workers. An employer must inform worker representatives and the affected workers before a high-risk AI system is put into use in the workplace.
- A DPIA and, in certain cases, a fundamental rights impact assessment (FRIA) on top of it.
- Transparency towards people affected by the system.
#Five things to put in place
For most small and mid-sized businesses, it comes down to:
- AI register. Track which AI tools are in use and for what. BeeSensible sees which tools are in use and records your decision per tool in the AI register.
- Short AI policy. A few pages with the rules for staff is often enough. See enforcing an AI policy.
- Data processing agreement. Agree with each AI vendor what may happen to personal data.
- DPIA where needed. Especially for sensitive processing or monitoring.
- AI literacy. Make sure people know what they can and cannot share.
An AI register kept by hand goes stale the moment a new tool shows up that nobody logged. BeeSensible's catalogue covers that step: over 1,000 AI tools, each scored for risk, and continuously extended with tools that turn up in organisations.
#Where the risk arises in practice
The AI Act and the GDPR call for oversight you can demonstrate, but most of the risk arises during everyday work: an employee pastes customer or patient data into a prompt. A ban often backfires and leads to shadow AI.
BeeSensible helps at the source. Sensitive data is highlighted while someone types in browser-based AI tools, so it can be masked or removed before the prompt is sent. That supports data minimisation under the GDPR and puts AI literacy into practice at the moment it counts. The Accountability screen in the dashboard sets the resulting figures against the provisions of the GDPR, NIS2 and the AI Act, stating for each provision what the figures do not cover. BeeSensible runs on ISO 27001-certified EU infrastructure.
Start with your own list rather than the legal text: which AI tools are in use, who works with them and which data goes in. The other obligations follow from that.
Further reading: our overview of GDPR and workplace AI and the guide to GDPR and AI tools in the workplace.
