Is it legal to use ChatGPT at work in the EU?
Yes. No EU law bans generative AI tools at work. What the law regulates is the data you put into them and some specific uses. Two regulations matter for a typical company: the GDPR, which applies whenever personal data is involved, and the EU AI Act, which sets duties for companies that use AI systems professionally. The risk for most companies is not the tool itself. It is staff using personal accounts on consumer plans, with customer or employee data, and no rules.
This article is practical guidance for owners and operations managers of companies with 10 to 250 people, checked against official sources on 7 October 2026. It is not legal advice. For a specific case, ask your DPO or a lawyer.
What does GDPR require when staff paste data into AI tools?
GDPR treats a prompt like any other processing of personal data. If an employee pastes a customer email, a CV or a payroll export into an AI tool for work, your company is the controller and the AI vendor is, at best, your processor. Seven obligations follow:
- A lawful basis (Article 6). Each use needs one, usually the contract with the customer or a legitimate interest you can document. "It saves time" is a reason, not a basis.
- A processor contract (Article 28(3)). Processing by a processor must be governed by a contract. With AI vendors this is the data processing agreement (DPA), and it is offered on business plans, not on personal ones.
- Data minimization (Article 5(1)(c)). Data must be limited to what is necessary. Remove names, ID numbers and contact details the task does not need before they reach the tool.
- Special categories (Article 9). Health data, union membership, biometric data and similar categories carry stricter conditions. Keep them out of general AI tools unless a documented assessment says otherwise.
- International transfers (Chapter V). Most AI vendors are US companies. Transfers are allowed to US companies certified under the EU-US Data Privacy Framework, whose adequacy decision the Commission adopted on 10 July 2023, or under contractual safeguards such as standard contractual clauses in the DPA.
- A data protection impact assessment when risk is high (Article 35). A DPIA is required for processing likely to result in a high risk, especially with new technologies. In Romania, ANSPDCP Decision 174/2018 lists operations where it is mandatory, including automated evaluation of people that leads to decisions with legal effects.
- Breach handling (Article 33). If personal data leaks through an AI tool, the breach must be reported to the authority without undue delay and, where feasible, within 72 hours.
The ceiling for the most serious GDPR infringements is EUR 20 million or 4% of worldwide annual turnover, whichever is higher (Article 83(5)). The more useful number for an SME is zero: zero personal data in tools that have no contract with you.
Is ChatGPT GDPR compliant? Consumer plans vs business plans
No tool is "GDPR compliant" on its own; your use of it is. What differs between plans is whether the vendor trains on your data, whether it signs a DPA and who controls retention. A paid individual plan, such as ChatGPT Plus, is still a consumer plan. This is what each vendor states on its official pages, checked on 7 October 2026:
| Tool and plan | Trains on your content by default? | Contract for GDPR | What the vendor states |
|---|---|---|---|
| ChatGPT Free and Plus (personal account) | Yes, unless the user opts out | No DPA; OpenAI offers its DPA for Business, Enterprise and the API | Content from services for individuals may be used to train models; Temporary Chat is not used for training (OpenAI) |
| ChatGPT Business, Enterprise and the API | No | DPA available | No training on business data by default; SOC 2 audit; Enterprise admins control retention (OpenAI) |
| Microsoft Copilot (personal Microsoft account) | Can be, unless the user opts out | Consumer terms | Conversation activity may be used for model training; users signed in with a work Entra ID account are excluded (Microsoft) |
| Microsoft Copilot Chat and Microsoft Copilot (work account) | No | Microsoft DPA, Microsoft acts as processor | Prompts and responses are not used to train foundation models; EU Data Boundary support (Microsoft) |
| Gemini app (personal Google account) | Can be, depending on the Keep Activity setting | Consumer terms | Human reviewers read a subset of chats; activity auto-deletes after 18 months by default; reviewed chats are kept up to 3 years (Google) |
| Gemini in Google Workspace (work account) | No | Cloud Data Processing Addendum | Prompts are customer data; not used to train models without the customer's permission (Google) |
The pattern is consistent across the three vendors: the same assistant is a different legal object depending on the account it is used with. The decision that matters is that work happens in company accounts on business plans, administered by the company, with the DPA signed. Vendors change these terms, so recheck the pages above before you rely on them.
What does the EU AI Act require from a small or mid-sized company?
Under the AI Act, a company that uses an AI system under its authority for professional purposes is a deployer. A company that builds an AI system and puts it on the market is a provider, with heavier duties. A company whose staff use ChatGPT, Copilot or Gemini is a deployer. The timeline, as published by the European Commission and checked on 7 October 2026:
| Date | What applies | Status |
|---|---|---|
| 1 August 2024 | The AI Act enters into force | Done |
| 2 February 2025 | Prohibited practices and the AI literacy obligation | In force |
| 2 August 2025 | Rules for general-purpose AI models (providers such as OpenAI, Google, Microsoft) | In force |
| 2 August 2026 | The Act becomes generally applicable, including the transparency rules of Article 50 | In force |
| 2 December 2027 | High-risk systems in the Annex III areas, such as recruitment and credit scoring | Scheduled |
| 2 August 2028 | High-risk AI built into products covered by Annex I | Scheduled |
The high-risk dates above are the result of the Digital Omnibus on AI. The Commission proposed it on 19 November 2025 to delay high-risk obligations, and it is no longer a proposal: it was adopted as Regulation (EU) 2026/1744 of 8 July 2026 and entered into force on 27 July 2026. It moved the Annex III high-risk date from 2 August 2026 to 2 December 2027, rewrote the AI literacy article and added new prohibitions on AI that generates non-consensual intimate content or child sexual abuse material. Summaries written before July 2026 describe the old dates.
For a typical company of 10 to 250 people that uses AI for office work, four points apply:
- AI literacy (Article 4). Deployers must take measures to support the AI literacy of staff who operate or use AI systems on their behalf, taking into account their knowledge and the context of use. Since the 2026 amendment, the Act states that this does not require guaranteeing any specific level. A short, recorded training on your policy and the tools you allow is a reasonable measure.
- Prohibited practices (Article 5). Among them: using AI to infer the emotions of people in the workplace, except for medical or safety reasons. Some HR and call center monitoring tools are marketed with exactly this feature.
- Transparency (Article 50). If you deploy emotion recognition or biometric categorization, you must inform the people exposed. If you publish AI-generated deepfakes, or AI-generated text meant to inform the public on matters of public interest without human editorial review, you must disclose it. Customer-facing chatbots must be designed so people know they are talking to an AI.
- High-risk uses (Annex III). AI used to recruit or select people, to decide promotions or terminations, to allocate tasks or to monitor and evaluate staff, or to assess the creditworthiness of individuals, is high-risk. Deployers must use such systems according to the instructions, assign competent human oversight and, before using one at work, inform workers' representatives and affected workers (Article 26). These rules apply from 2 December 2027.
Fines for prohibited practices reach EUR 35 million or 7% of worldwide annual turnover; for an SME, each AI Act fine is capped at whichever of the two amounts is lower (Article 99). Drafting emails, summarizing documents, translating or writing code with a general assistant is not high-risk.
Who enforces GDPR and the AI Act in Romania?
GDPR is enforced by ANSPDCP, the National Supervisory Authority for Personal Data Processing. Nothing about the AI Act changes that: a GDPR breach involving an AI tool is handled by ANSPDCP today.
For the AI Act, a Romanian government memorandum proposed ANCOM as the national market surveillance authority and single point of contact, with sectoral authorities alongside it: ASF and the National Bank of Romania for high-risk AI in financial services, ANSPDCP for certain high-risk biometric and law enforcement systems, and others such as the consumer protection authority and the Labour Inspectorate in their fields. In its statement of 24 July 2026, ANCOM said the national implementing law was still being drafted and that authorities can verify and sanction AI Act breaches only after it enters into force. As of 7 October 2026 we found no adopted implementing law. The obligations apply regardless; only national enforcement is pending.
What should a one-page AI usage policy contain?
An AI usage policy is a short internal document that tells staff which AI tools they may use for work, with which data and under which checks. One page is enough if it answers these ten points:
- Approved tools. Name them, with the plan: for example, ChatGPT Business or Copilot Chat on company accounts. Everything else is not approved for work data.
- Accounts. Work is done only in company accounts. No personal accounts, no browser extensions that send page content to an AI service unless approved.
- Data classes. What may go in (public information, internal drafts without personal data), what may go in only with approved tools (customer and employee data, minimized), and what never goes in (special category data, passwords, card numbers, trade secrets you are bound to protect).
- Minimization. Remove names and identifiers the task does not need before pasting.
- Human review. AI output is a draft. A named person checks facts, figures and tone before anything leaves the company.
- Disclosure. When customers talk to an AI system, they are told. AI-generated images or video that could pass as real are labelled.
- Prohibited uses. No emotion inference on staff or customers. No AI screening of candidates or evaluating employees without a separate, documented decision.
- Vendor checks. A signed DPA, training disabled or excluded by contract, a known retention period and a lawful transfer mechanism, recorded for each approved tool.
- Training. Every user completes a short session on this policy before getting access, and the session is recorded. This is your AI literacy measure.
- Owner and incidents. One person owns the policy, reviews it every six months and is the contact if data is pasted where it should not be.
Which AI tools are risky, and what should you do about each?
| Tool type | Risk | What to do |
|---|---|---|
| Consumer chatbot on a personal account (free or paid individual plan) | High for personal and confidential data: possible training on content, no DPA, no company control | Do not allow it for work data. Offer an approved business alternative so people have no reason to use it. |
| Business plan of a chatbot on company accounts | Low to medium, depending on the data | Sign the DPA, check retention and admin settings, train users, apply minimization. |
| AI built into your existing suite (Copilot in Microsoft 365, Gemini in Workspace) | Low to medium; it sees what the user can already see | Fix file permissions first, because the assistant inherits them. Then enable it for groups that need it. |
| Meeting transcription and AI note-takers | Medium: records participants, including people outside the company | Inform participants, define retention, keep it off for HR and sensitive meetings. |
| Customer-facing chatbot on your website | Medium: AI Act transparency, GDPR for what visitors type | Say clearly that it is an AI, limit what it can see, log conversations with a retention period, update the privacy notice. |
| AI in HR: CV screening, performance evaluation, task allocation | High: Annex III high-risk from 2 December 2027, DPIA likely | Treat it as a separate project: legal review, DPIA, human oversight, informing workers' representatives before use. |
| Custom AI workflows built on a model API | Depends on design | Use the API under the vendor's DPA, document data flows and retention, minimize before the model, test the output before production. |
How we help
Most companies we talk to already use AI, mostly through personal accounts nobody approved. Our AI integration work starts with the questions in this article: which data leaves the company, where the model runs, who sees the outputs and what GDPR requires. The answers are written into a data flow and retention document your DPO can review, before anything is built.
If you are not sure where AI belongs in your processes yet, our Diagnosis maps the candidates, ranks them and drops the ones that should not be automated. Sometimes the honest answer is a business plan, a one-page policy and a training session, and no project at all.
Summary
- Using ChatGPT, Copilot or Gemini at work is legal; putting personal data into consumer accounts is the problem.
- GDPR needs a lawful basis, a DPA with the vendor, minimized inputs, a lawful transfer mechanism and, for high-risk processing, a DPIA.
- Business plans of ChatGPT, Microsoft Copilot and Gemini do not train on your data by default and come with a DPA; personal plans do not offer this.
- The AI Act already requires deployers to support staff AI literacy and bans emotion inference at work; transparency rules apply since 2 August 2026.
- High-risk duties, such as AI in hiring, apply from 2 December 2027 after Regulation (EU) 2026/1744.
- In Romania, ANSPDCP enforces GDPR; ANCOM has been proposed for the AI Act, and the national implementing law was still pending on 7 October 2026.
Sources
- GDPR, Regulation (EU) 2016/679, EUR-Lex, accessed 7 October 2026
- AI Act, Regulation (EU) 2024/1689, EUR-Lex, accessed 7 October 2026
- Digital Omnibus on AI, Regulation (EU) 2026/1744, Official Journal, accessed 7 October 2026
- AI Act: regulatory framework and timeline, European Commission, accessed 7 October 2026
- AI Act Service Desk: Articles 4, 5, 26, 50, 99 and Annex III, European Commission, consolidated text, accessed 7 October 2026
- EU-US data transfers, European Commission, accessed 7 October 2026
- ANSPDCP Decision 174/2018 on mandatory DPIAs, accessed 7 October 2026
- Artificial Intelligence Act in Romania, ANCOM, 24 July 2026, accessed 7 October 2026
- Enterprise privacy at OpenAI and How your data is used to improve model performance, OpenAI, accessed 7 October 2026
- Enterprise data protection in Microsoft Copilot and Privacy FAQ for Microsoft Copilot, Microsoft, accessed 7 October 2026
- Generative AI in Google Workspace Privacy Hub and Gemini Apps Privacy Hub, Google, accessed 7 October 2026
