Does the EU AI Act apply to us if staff only use ChatGPT?
Yes. The European Commission's Q&A on AI literacy asks exactly this question, whether a company whose employees use ChatGPT for writing advertisement text or translating needs to comply with Article 4, and answers yes: they should be informed about the specific risks, for example hallucination. Using a general-purpose chatbot for work makes your organisation a deployer of an AI system, and Article 4 attaches to the organisation. It does not matter that you did not build the tool, pay for it, or roll it out formally.
Why "we only use ChatGPT" is not an exemption
The AI Act defines a deployer as anyone using an AI system under their own authority in the course of a professional activity. A general-purpose chatbot is an AI system. A marketing executive using it to draft copy, a manager using it to summarise a report, or an assistant using it to translate an email are all using it under your authority. The organisation is the deployer, and Article 4 attaches to the organisation.
What "inform staff about specific risks" looks like
The measure is proportionate to the use. Nobody expects a training programme on model architecture for a team that writes emails. What the Commission's guidance points to is closer to this:
- an explanation of what the tool is and is not doing when it answers
- the specific failure modes for your tasks, with hallucination and confidentiality at the top
- what is fine to put into the tool and what must never be, given your data and your sector
- who to ask when something looks wrong
That set of points, delivered to the people who need it, with a note of who attended and when, is a measure you can show.
The part people miss: bundled AI
Most organisations that say "we only use ChatGPT" also use software that ships AI features by default. Recruitment screening, HR platforms, finance tools and customer service software increasingly include ranking, scoring or drafting features. You are a deployer of those too, whether or not anyone chose the feature. A tool inventory is the quickest way to find out what you are actually running, and it is the first thing we do in every workshop.
What is not required
No certificate: the Commission's Q&A says there is no need for one, and that an internal record of trainings and other initiatives is enough. No test: the Q&A says Article 4 does not entail an obligation to measure the knowledge of AI of employees. No guaranteed level: since Regulation (EU) 2026/1744 took effect on 27 July 2026, Article 4 states that it does not require providers or deployers to guarantee any specific level of AI literacy of any individual. What you keep is a record of what you did, and that record is what a regulator would ask to see.
Sources
- European Commission, AI literacy: questions and answers. The ChatGPT, hallucination, certificate and testing passages are quoted from this page.
- Regulation (EU) 2024/1689, the AI Act, Article 3(4) definition of deployer and Article 4.
- Regulation (EU) 2026/1744, the Digital Omnibus on AI.
This is general information about the EU AI Act, not legal advice. Enforcement is proportionate and case by case, and your sectoral regulator may issue guidance that applies to you.
