Knowledge base
Short, practical answers on the EU AI Act and GDPR – written for managers who want to get it right without reading the law.
The EU AI Act explained
- The EU AI Act explained
What is the EU AI Act – and what does it mean for your business?
4 min readThe AI Act is the EU's law on artificial intelligence. Who it applies to, the four risk levels, the deadlines and what an ordinary business has to do.
- The EU AI Act explained
When does the AI Act apply? Every deadline after the Digital Omnibus
4 min readFrom the bans in 2025 to high-risk in December 2027: every date in the AI Act, as it stands after the Digital Omnibus (Regulation 2026/1744).
- The EU AI Act explained
Digital Omnibus: what did the EU change in the AI Act in 2026?
3 min readRegulation (EU) 2026/1744 delayed the high-risk rules, adjusted AI literacy and added new bans. Here are the changes and what they mean for you.
- The EU AI Act explained
The four risk levels in the EU AI Act – where does your use of AI fit?
2 min readThe EU AI Act risk categories: prohibited, high-risk, limited and minimal risk. See examples and requirements, and try classifying a use of AI yourself.
- The EU AI Act explained
Which AI is prohibited under Article 5 of the AI Act?
3 min readEmotion recognition at work, social scoring and manipulation are banned. Here is the full list, with examples from ordinary businesses.
- The EU AI Act explained
When is AI high-risk? Annex III explained for ordinary businesses
3 min readRecruitment, HR decisions, credit, insurance and education are high-risk under the AI Act. See the list, the exceptions and what to do from December 2027.
- The EU AI Act explained
What must we do when we use AI? Deployer obligations under the AI Act
3 min readIf you use AI at work, you are a deployer. Here are the duties for all AI and the extra requirements in Article 26 when the use is high-risk.
- The EU AI Act explained
Are we a provider or a deployer under the EU AI Act?
3 min readProvider vs deployer: if you use AI, you are a deployer. Build AI into your product or put your name on it, and you may become a provider. Find your role.
- The EU AI Act explained
How big are the fines under the AI Act and GDPR?
2 min readUp to €35 million or 7% of turnover for prohibited AI. See every fine cap in the AI Act and GDPR, and what applies to small businesses.
- The EU AI Act explained
The AI Act for small and medium-sized businesses – what do you actually need to do?
3 min readA practical AI Act guide for businesses with 1–250 employees: the five things to do, what can wait, and what has been made easier for SMEs.
- The EU AI Act explained
Does our chatbot have to say it is an AI? Article 50 explained
3 min readFrom 2 August 2026, people must be able to see that they are talking to an AI, and deepfakes must be labelled. The rules and a notice you can use.
- The EU AI Act explained
Who enforces the EU AI Act in Ireland, Malta and the EU?
5 min readWho enforces the EU AI Act in Ireland, Malta and the EU: the AI Office of Ireland, the DPC, Malta's MDIA and IDPC, and the EU AI Office. How it works.
- The EU AI Act explained
Human oversight of AI: what does the law require, and how do you do it?
3 min readHigh-risk AI needs human oversight: a person who understands it, can step in and can say no. What that looks like in practice – and how to document it.
- The EU AI Act explained
What is a FRIA, and do we need one?
2 min readA FRIA is a fundamental rights impact assessment under Article 27 AI Act. See who must do one, what it contains and how it differs from a DPIA.
- The EU AI Act explained
ChatGPT, Claude and Gemini as general-purpose AI models – what do the rules mean for users?
2 min readThe rules for general-purpose AI models apply to OpenAI, Anthropic, Google and Mistral – not to you as a user. But you still have duties of your own.
GDPR and AI
- GDPR and AI
Can we use ChatGPT, Claude or Copilot on personal data?
5 min readUsing AI on personal data can be lawful – with a legal basis, only the data you need and a provider agreement. How to keep the real names in the EU.
- GDPR and AI
How do we show that a human made the decision? GDPR Article 22 and AI
6 min readUsing AI on applicants or staff? A human must really decide. What GDPR Article 22 on automated decision-making and the EU AI Act require – and how to prove it.
- GDPR and AI
Can we send personal data to a US AI? International data transfers under GDPR
3 min readSending personal data to ChatGPT, Claude or Copilot in the US is a transfer out of the EU. The legal bases, the Data Privacy Framework and the safest route.
- GDPR and AI
Pseudonymisation or anonymisation – what's the difference, and what does GDPR require?
2 min readPseudonymisation vs anonymisation: pseudonymised data is still personal data; anonymous data is not. The 2025 EU court ruling, and what it means for AI.
- GDPR and AI
Do we need a data protection impact assessment (DPIA) before using AI?
2 min readIf you use AI to assess people, on sensitive data or at scale, the GDPR usually requires a DPIA. Here is when, what it must contain, and a template.
- GDPR and AI
Can we use AI on sensitive data such as health and religion?
2 min readHealth, religion, union membership, ethnicity and biometrics are special categories under the GDPR. The rules when AI is involved, and how to protect them.
- GDPR and AI
Can we put contracts, prices and customer lists into an AI?
2 min readPrices, contracts, customer lists and project names are trade secrets – but only if you protect them. Here is how to use AI without giving them away.
- GDPR and AI
What legal basis do we have for using AI on personal data?
2 min readAI doesn't need a new legal basis, but the use must fit the purpose the data was collected for. Here are the usual bases and the test for a new purpose.
- GDPR and AI
Do we have to tell customers and employees that we use AI?
2 min readTelling customers and staff about AI use: what GDPR requires in your privacy notice, what the EU AI Act adds for chatbots and high-risk AI, plus sample wording.
- GDPR and AI
How do we handle access and erasure requests when data has been in an AI?
2 min readPeople can ask for access to and erasure of their data – including what has been in an AI. Here are the deadlines, and how pseudonymisation makes it easier.
- GDPR and AI
An employee pasted personal data into ChatGPT. What do we do now?
2 min readPersonal data sent to an AI service with no agreement in place can be a personal data breach. Here are the first steps and the 72-hour deadline.
ChatGPT, Copilot and other AI services
- ChatGPT, Copilot and other AI services
ChatGPT and GDPR: Can businesses use ChatGPT on personal data?
2 min readBusinesses can use ChatGPT, but only with the right plan, a data processing agreement and control over the data. The checklist, and how names stay in the EU.
- ChatGPT, Copilot and other AI services
Microsoft 365 Copilot and GDPR: Does your data stay in the EU?
2 min readMicrosoft 365 Copilot doesn't train on your data and is covered by the EU Data Boundary – with one important exception. Here is what to check.
- ChatGPT, Copilot and other AI services
Claude and GDPR: What should you check before using Claude on personal data?
2 min readClaude Team and Enterprise don't train on your data and include a DPA, but data is stored in the US. How to use Claude without names leaving the EU.
- ChatGPT, Copilot and other AI services
Which AI is best for personal data? ChatGPT, Claude, Copilot, Mistral and Gemini compared
2 min readTraining on your data, EU data residency, data processing agreements and custom connectors: the five big AI services side by side, checked by GoalCube.
- ChatGPT, Copilot and other AI services
Does the AI train on our data – and how do we switch it off?
2 min readDoes AI train on our data? Free plans may use your chats for training; business plans usually don't. What the big services do, and what to check.
- ChatGPT, Copilot and other AI services
Data processing agreement with your AI provider: what should you check?
2 min readIf an AI service processes personal data for you, you need a data processing agreement. Here is what it must cover, and the pitfalls typical of AI.
AI in practice
- AI in practice
AI in recruitment: What is allowed when AI reads CVs and applications?
2 min readAI for CV screening is high-risk under the AI Act, and GDPR requires a human decision. The rules, and what a fair hiring process with AI looks like.
- AI in practice
AI in HR: What can you use AI for in employee matters?
2 min readMeeting notes, absence, bonuses, rotas and monitoring: see what is minimal risk, high-risk and prohibited when AI is used on employees.
- AI in practice
AI in customer service: How to use AI on customer enquiries
2 min readAI can sort enquiries and draft replies in seconds. The rules for customer data, chatbots and decisions – and how your customers' names stay in the EU.
- AI in practice
AI for credit scoring and insurance: What does the AI Act require?
2 min readCredit scoring of individuals and life and health insurance pricing are high-risk. The requirements, FRIA, right to an explanation and fraud exception.
- AI in practice
AI in education: What can schools and training providers use AI for?
2 min readFeedback is low risk, while admissions, grading and exam proctoring are high-risk, and emotion recognition is prohibited. The rules for schools and courses.
- AI in practice
AI in clinics and care: How do you use AI on health data?
2 min readAI can help with admin and writing; diagnosis is a medical device. How clinics and care providers use AI without sending health data and names to the US.
- AI in practice
AI for contracts and procurement: How to use AI without giving your terms away
2 min readAI is good at finding deadlines and terms in contracts. What to watch out for: contact persons, confidentiality clauses, prices and project names.
- AI in practice
AI in marketing: What can you do with customer data, profiling and AI content?
2 min readPersonalised offers, segments and AI images: the rules on profiling, consent, labelling deepfakes and the ban on manipulation.
- AI in practice
AI in associations and clubs: Can we use AI on members and volunteers?
2 min readAssociations are controllers, just like businesses. The rules for using AI on member lists, volunteers and membership fees – and on the data that is sensitive.
Policy, training and inventory
- Policy, training and inventory
Article 4 AI Act: What does AI literacy require of small businesses?
5 min readArticle 4 of the AI Act applies to every business that uses AI at work. What you need to do, what the Digital Omnibus changed, and how to show it.
- Policy, training and inventory
AI policy for employees: What should it include?
3 min readAn AI policy tells staff which AI tools they may use, what for and with which data. The points it must cover, and a short template.
- Policy, training and inventory
What is an AI register, and do we need one?
2 min readAn AI register lists your uses of AI with purpose, data and risk. What it should contain, and why it is the foundation for the AI Act and GDPR.
- Policy, training and inventory
Shadow AI: what do we do when employees use AI without asking?
2 min readShadow AI: many employees use free AI tools with company data without management knowing. The risks, and how to bring it into the open without a ban.
- Policy, training and inventory
What should AI training for employees cover?
2 min readThe AI Act requires AI literacy, not a certificate. The topics a short course should cover, and how to document who has completed it.
GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.