Using AI in Your Business with Legal Certainty: The EU AI Act, Data Protection and Liability at a Glance

The risk-based approach of the EU AI Act

The AI Act links its requirements to the purpose, context and risk potential of a system. Certain practices, including specific forms of manipulation and social scoring, are prohibited. High-risk AI is subject to particularly demanding controls. Depending on the use case, this may include systems used in recruitment, creditworthiness assessments or critical infrastructure. Relevant duties may cover risk management, technical documentation, data governance, human oversight, logging and post-deployment monitoring.

Other systems are primarily subject to transparency obligations. Users may need to be told that they are interacting with AI or that content has been artificially generated or altered. Many low-risk applications remain largely free from product-specific duties under the AI Act. That does not make their use legally unrestricted: data protection, employment law, copyright, trade secret protection and general liability rules continue to apply.

The relevant question is therefore not the tool's marketing label but the concrete use case. The same system may be relatively unproblematic when drafting marketing copy but much more heavily regulated when used for recruitment or a safety-related decision.

Data protection, copyright and trade secrets

Whenever an AI application processes personal data, the company must establish a legal basis, purpose limitation, data minimisation and deletion rules. A data protection impact assessment may be required where the processing is likely to create a high risk for individuals. Employee data, customer profiling and systems used to assess or predict human behaviour are particularly sensitive. A use case that is permissible under the AI Act may still lack a lawful basis under the GDPR.

Generative AI also raises copyright questions. Companies need to consider whether protected material may be used as input, what rights exist in the output and whether generated content could infringe third-party rights. External publication should therefore not take place without an appropriate review.

Trade secrets are at risk where employees enter internal information into public or insufficiently protected tools. Protection requires contractual commitments from the provider, suitable technical settings and a clear internal policy. That policy should identify data categories that must not be entered and specify which approved enterprise tools are available for sensitive work.

Third-party AI: contracts and allocation of roles

Most companies do not build their own models but use AI functions supplied by external providers. That does not remove their responsibility. The first step is to identify the company's role under the AI Act and determine whether it is merely deploying the system as intended, making a substantial modification or offering it under its own name. That classification affects the scope of its obligations.

The provider agreement should state clearly whether prompts, uploaded files and usage data may be used for training or product improvement. Confidentiality, deletion, subprocessors, data location, security standards, availability, liability and support with regulatory requests are equally important. Where personal data is processed on the company's behalf, an Article 28 GDPR data processing agreement will also be required.

For business-critical use cases, the company should assess which documentation and information the provider makes available. Without sufficient detail on intended purpose, limitations, data processing and control options, the deployer may be unable to meet its own obligations.

A practical route to AI compliance

The process starts with a complete inventory of the AI systems actually in use, including tools adopted informally by individual teams. For each use case, the company records its purpose, data categories, user group, provider and potential impact. This provides the basis for classification under the AI Act and for deciding whether a data protection impact assessment, specific transparency or additional controls are required.

Provider terms, data processing, training use, confidentiality and liability are then reviewed. In parallel, an internal AI policy identifies approved tools, information that must not be entered and situations in which human review remains mandatory. Training should show permitted, practical ways of working rather than simply listing prohibitions. Defined ownership, an approval process and regular review turn these measures into an ongoing compliance framework.