Skip to content
EN

Do we have to tell customers and employees that we use AI?

GDPR and AILast updated 2 min read

Short answer

Yes, as a rule. Articles 13 and 14 GDPR require you to tell people which data you use, for what and who receives it – and an AI provider is a recipient. With automated decision-making, people must get meaningful information about the logic involved. The EU AI Act also requires that people can see they are talking to an AI, that deepfakes are labelled, that staff are told before high-risk AI is used in the workplace, and that people subject to decisions made with high-risk AI are informed.

Sample wording for applicants

"We use artificial intelligence to help us read applications. The AI does not see your name, your age or your gender. A member of our team decides who is invited to interview. You can always ask how your application was assessed."

Sample wording for a chatbot

"You are chatting with an AI assistant. It can make mistakes. Type 'agent' if you'd like to talk to a person."

What to do

  1. Update your privacy notice.Mention your use of AI, the purpose and the providers.
  2. Tell your staff.In the staff handbook, and before high-risk AI is put into use.
  3. Label chatbots.A short line at the top of the chat.
  4. Tell the people affected.For example, applicants: AI helps us read applications; a person decides.

What the law says

Articles 13 and 14 GDPR – information to be provided
Purpose, legal basis, recipients, transfers and automated decision-making.
Article 26(7) and (11) AI Act
Informing workers, and people subject to decisions made with high-risk AI.
Article 50 AI Act
Chatbots and deepfakes.

Questions and answers

Do we have to name ChatGPT?

You must state the recipients or categories of recipients. Many businesses name the provider directly – it builds trust.

Are there templates?

GoalCube has templates for informing staff, informing the people affected, chatbot wording and labelling AI content.

Sources

Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.

Be among the first.

We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.

Read next