Using GPAI models: roles and obligations

A practical guide for every organisation that uses general-purpose AI tools.

---

Who is a GPAI deployer?

A deployer (Art. 3(4)) uses an AI system under its authority in a professional context. “GPAI deployer” is a practical label here for users of systems based on general-purpose models; it is not a separate legal role with all Chapter V model-provider duties.

Examples

Scenario	Your company’s role
Employees use ChatGPT to draft emails	Deployer
Developers write code with GitHub Copilot	Deployer
Marketing generates copy in Claude	Deployer
Customer service deployed an AI chatbot	Deployer
HR screens CVs through an AI tool	Deployer
An accountant uses Copilot in Excel	Deployer

Deployer vs. Provider --- key distinction

An organisation is a deployer where it uses an AI system under its authority in a professional context (Art. 3 points 1 and 4). “GPAI deployer” here describes use of systems based on general-purpose models; it is neither a separate statutory role nor a label for every AI tool. Staff count, pricing tier or a personal device do not decide the role. Assess the actual use and Article 2 scope, including the personal, non-professional exception in paragraph 10.

When a deployer becomes a provider

A company developing or commissioning an AI system and supplying it under its name can be a provider under Art. 3(3), even without training the underlying model. Art. 25 specifically reallocates provider duties for high-risk systems in cases such as rebranding or substantial modification, and where a changed purpose makes a previously non-high-risk system high-risk. Assess the actual product and role; a logo change on any chatbot does not automatically trigger all high-risk duties.

---

Timeline --- What applies and when?

Date	What applies	Article	Status
2.2.2025	AI literacy	Art. 4	ALREADY IN EFFECT
2.2.2025	Prohibited practices	Art. 5	ALREADY IN EFFECT
2.8.2025	GPAI model provider obligations, governance and Chapter XII penalties except Art. 101; Art. 101 fines apply from 2.8.2026	Art. 53–55, Art. 113(b)	ALREADY IN EFFECT
2.8.2026	General applicability + transparency	Art. 50	ALREADY IN EFFECT
2.12.2026	New prohibited practices (non-consensual intimate deepfakes, CSAM)	Art. 5(1)(ba), (bb)	Upcoming
2.12.2026	Providers of generative systems placed on the market before 2.8.2026: compliance with Art. 50(2)	Art. 111(4)	Upcoming
2.12.2027	High-risk under Annex III --- including the Art. 26 obligations	Art. 6(2)	Upcoming
2.8.2028	High-risk under Annex I	Art. 6(1)	Upcoming

The high-risk dates were postponed by Regulation (EU) 2026/1744 (“Digital Omnibus on AI”, in force 27 July 2026) from the original 2.8.2026 and 2.8.2027 respectively. The postponement does not apply to GPAI model obligations --- those have applied since 2.8.2025; models placed on the market before that date have until 2.8.2027 under Art. 111(3).

The high-risk dates in the table concern Chapter III Sections 1–3 except Article 6(5). Assess Article 2 scope, particularly the limited Annex I Section B regime under paragraph 2 and possible further restrictions under paragraph 13, together with Article 111 transitions. Article 50 applies separately within its own scope.

Two common misunderstandings

1. Transparency already applies from 2 August 2026. Art. 4 (AI literacy) and Art. 5 (prohibited practices) have applied since 2.2.2025, and the rules for GPAI model providers since 2.8.2025. The transparency obligations in Art. 50 apply from 2.8.2026 --- sooner than most companies expect.

2. Art. 26 is not an obligation for everyone who uses ChatGPT. Article 26 governs the obligations of deployers of high-risk AI systems and applies only from 2.12.2027 (Annex III) or 2.8.2028 (Annex I). If you use ordinary GPAI tools to support your work, Art. 26 does not bind you today --- selected controls can still be useful as proportionate voluntary governance measures.

---

Article 26 --- Obligations of deployers of high-risk systems

Article 26 of Regulation (EU) 2024/1689 sits in Chapter III, Section 3 and applies to entities deploying high-risk AI systems. It applies from 2.12.2027 (Annex III) or 2.8.2028 (Annex I).

The eight areas below explain selected high-risk deployer duties. Apply them within their statutory scope and date. For ordinary office assistance, select proportionate controls based on risk and contractual requirements; customer audits differ and their acceptance cannot be guaranteed. The following blocks are shortened summaries; practical steps describe possible implementation, not statutory document names.

(1) Technical and organisational measures --- Art. 26(1)

Deployers of high-risk AI systems shall take appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use.

What this means in practice:

• Read the Terms of Service and documentation for each AI tool
• Follow the limits and recommendations of the provider (acceptable use policy)
• Do not use AI tools for purposes for which they are not intended
• Create an internal AI Acceptable Use Policy (AUP) defining permitted and prohibited uses

(2) Competent persons for oversight --- Art. 26(2)

Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.

What this means in practice:

• Designate specific persons responsible for AI in your organisation (need not be full-time)
• Give them authority and support, not just responsibility --- without it, oversight is a formality
• Ensure role-appropriate competence and training for oversight (Art. 26(2)); Art. 4 requires measures supporting literacy development, not one mandatory course or certificate
• Recommended: CTO/CISO plus heads of departments that actively use AI
• Document competences and completed training

(3) Relevance of input data --- Art. 26(4)

To the extent the deployer exercises control over the input data, it shall ensure that input data is relevant and sufficiently representative in view of the intended purpose.

What this means in practice:

• Use relevant, representative input data under your control; assess lawful processing, minimisation, purpose and security before entering personal or confidential information
• Define rules for what data may and may not be fed into AI
• Pay particular attention to GDPR --- personal data in prompts constitutes processing
• Create a data classification: public / internal / confidential / strictly confidential plus rules for AI

(4) Monitoring AI operation --- Art. 26(5)

Summary of Art. 26(5): monitor operation according to the instructions and, where relevant, inform the provider under Art. 72. If there is reason to consider that use according to the instructions may present a risk under Art. 79(1), inform the provider or distributor and the market surveillance authority without undue delay and suspend use. Report a serious incident immediately, first to the provider, then to the importer or distributor and the market surveillance authorities. If the provider cannot be contacted, Article 73 applies by analogy.

What this means in practice:

• Regularly check the quality of AI outputs (accuracy, hallucinations, bias)
• Record incidents --- when AI provided incorrect, misleading or harmful output
• Establish a process for escalation (who resolves it, how quickly, who is notified externally)
• Where there is reason to consider that use according to the instructions may present a risk under Art. 79(1), suspend use and follow Art. 26(5).
• Recommended: quarterly review of AI output quality

(5) Obligation to inform employees --- Art. 26(7)

Deployers that are employers shall, before putting into service or using a high-risk AI system at the workplace, inform workers’ representatives and the affected workers that they will be subject to its use.

What this means in practice:

• Inform employees that AI tools are used in the organisation
• Communicate which tools they are and what they are used for
• If AI affects decisions about employees (performance reviews, planning), inform them in advance
• Consult with trade unions / employee representatives (if applicable)
• Recommended: internal announcement plus FAQ document

(6) Retention of logs — Art. 26(6)

For relevant high-risk systems, retain automatically generated logs under your control for a period appropriate to the intended purpose, at least six months unless other applicable EU or national law provides otherwise.

• Identify the events the system actually generates and which logs you control.
• Do not interpret this as a duty to archive every office-assistant prompt and response.
• Define retention, access, minimisation and deletion for personal data in logs.
• Verify the actual product’s export, administration and retention settings; a free or enterprise label does not prove compliance.

(7) Input to the DPIA --- Art. 26(9)

Deployers shall use the information provided under Article 13 to comply with their obligation to carry out a data protection impact assessment under Art. 35 GDPR.

Note the exact wording: Art. 26(9) does not itself create a DPIA obligation --- that comes from GDPR. The AI Act merely requires you to use the provider’s documentation when carrying it out.

What this means in practice:

• Screen for processing likely to result in high risk under GDPR Art. 35, including large-scale special-category processing or systematic extensive evaluation with significant effects; large scale alone is not a universal trigger
• Particularly relevant for: AI in HR, customer service, marketing personalisation
• For standard GPAI use (internal assistance without personal data), a DPIA is typically not required
• In case of doubt, consult your DPO / GDPR specialist

(8) Cooperation with supervisory authorities --- Art. 26(12)

Deployers shall cooperate with the relevant competent authorities on any action those authorities take in relation to the high-risk AI system.

What this means in practice:

• Provide information about your AI deployment on request
• Maintain documentation so that it can be presented (inventory, AUP, logs, training records)
• Prepare for the possibility that the authority may request access to logs, documentation, contracts

Where the duty to inform people subject to AI decisions comes from

The obligation to inform natural persons that they are subject to the use of a high-risk AI system that makes or assists in decisions about them is in Art. 26(11) --- not Art. 50. It covers Annex III systems and applies from 2.12.2027.

---

Article 50 --- Transparency obligations (from 2.8.2026)

Article 50 is the only article in Chapter IV. Its scope is not limited to high-risk systems: it can also apply to ordinary GPAI deployments, depending on the role, intended use and outputs.

The key to understanding it is the split of roles. Each paragraph targets someone different:

Paragraph	Who it binds	What it requires
(1)	Providers	Systems intended to interact directly with people must be designed so the person knows they are communicating with AI --- unless that is obvious from the context
(2)	Providers of AI systems, including general-purpose AI systems	Mark synthetic audio, image, video or text outputs in a machine-readable format and make them detectable as artificially generated or manipulated, subject to paragraph 2
(3)	Deployers	Inform natural persons exposed to an emotion recognition or biometric categorisation system
(4)	Deployers	Disclose artificial generation or manipulation of deepfakes, and of text published to inform the public on matters of public interest, subject to paragraph 4
(5)	Both	Provide the information clearly and distinguishably at the latest at the first interaction or exposure, in line with accessibility requirements

What this means for you as a deployer

A deployer assesses its own duties under Article 50(3) and (4), and how information must be given under paragraph 5. Paragraphs 1 and 2 address system providers. Checking the supplier and configuration helps manage risks; you may separately also meet the system-provider definition in Art. 3 point 3 or the conditions of Art. 25.

Situation	Who addresses it	Example implementation, according to context
Website chatbot	Provider (para. 1); you contractually and via configuration	”You are communicating with an AI assistant. To connect with a human, type ‘operator’.”
Voice bot on a phone line	Provider (para. 1); you contractually and via configuration	”This call is being handled by the AI assistant of company XY.”
Marketing video meeting the deepfake definition	Deployer under Art. 50(4)	Appropriate disclosure; assess the actual content, not every synthetic avatar as automatically a deepfake
AI article on public affairs without editorial review	You (para. 4)	“This text was artificially generated.”
Emotion recognition at work	First assess the Art. 5(1)(f) prohibition	Ordinary attendance monitoring is not made lawful by a notice. Art. 50(3) disclosure concerns permitted uses, including a valid medical/safety exception

Ordinary correspondence and Article 50

An ordinary internal email or proposal drafted with AI is not, merely for that reason, text published to inform the public on a matter of public interest under Article 50(4). This does not remove the provider’s separate Article 50(2) marking duty or other applicable transparency duties. Assess the actual content and context, including any deepfake.

Machine-readable marking and the transitional deadline

The marking required by Art. 50(2) must be machine-readable and detectable; visible text alone may not fulfil that function. Metadata or watermarking are possible technical approaches. Solutions must be effective, interoperable, robust and reliable as far as technically feasible, taking account of content characteristics and limitations, costs and the generally acknowledged state of the art.

Art. 111(4) --- transitional deadline of 2.12.2026

Providers of AI systems, including general-purpose AI systems, that generate synthetic content and were placed on the market before 2.8.2026 have until 2.12.2026 to comply with Art. 50(2).

Two clarifications that are easy to get wrong:

• The provision says only “placed on the market” --- not “placed on the market or put into service”.
• The deadline sits in Art. 111(4) (transitional provisions), inserted by Regulation (EU) 2026/1744 --- you will not find it in Art. 50.

Exceptions

• Law enforcement — paragraphs 1, 2, 3 and 4 contain separate statutory exceptions with different conditions. Paragraph 1, for example, retains the duty for systems available to the public for reporting crimes; paragraph 3 does not include prosecution. A law-enforcement purpose alone is not a blanket exemption.
• Assistive editing --- Art. 50(2) does not apply where the AI performs an assistive function for standard editing or does not substantially alter the input data or its semantics
• Artistic and satirical works --- for evidently artistic, creative, satirical or fictional works, the Art. 50(4) obligation is limited to appropriate disclosure that does not hamper the display or enjoyment of the work (it is not a full exemption)
• Editorial responsibility --- AI text on matters of public interest need not be disclosed where it underwent human review or editorial control and a person holds editorial responsibility for its publication

Code of practice and Commission guidelines

Regulation (EU) 2026/1744 replaced Art. 50(7): the Commission now encourages and facilitates codes and assesses their adequacy for paragraphs 2 and 4. The Commission opinion of 8 July 2026 considers the final code an adequate tool. Adherence alone is not conclusive proof of compliance; actual implementation and assessment by the competent authorities still matter.

• The Code of Practice on Transparency of AI-generated Content (10 June 2026) is voluntary. Measure 1.1 uses an “AI” icon, with a specified language exception and provision for equivalent labelling. The words generated or modified are encouraged. The regulation itself does not prescribe one mandatory icon.
• Commission guidelines on Art. 50 (20 July 2026, C(2026) 5054 final) --- non-binding. Only the Court of Justice of the EU can give an authoritative interpretation. The linked C(2026) 5054 final and its annex record approval of draft content; the cover communication envisages later formal adoption once all language versions are available. This identifies the linked version and does not establish that no later adoption exists.

AI agents and Art. 50(1)

Under the Commission guidelines, AI agents fall within Art. 50(1) where they are capable of interacting with natural persons. They must disclose both their artificial nature and the person on whose behalf they act --- including in complex multi-agent architectures and at key steps (authorisation, reporting, validation).

---

DPA requirements --- Contracts with AI providers

A GDPR Article 28 processing agreement is required where the supplier processes personal data on your behalf. For non-personal confidential data, agree appropriate confidentiality and security terms. Identify independent-controller and processor roles before choosing the contract.

Starting points for checking contractual terms

Check the specific service, account and contractual relationship. These links are navigation starting points; they do not establish that every product or plan includes the same agreements or safeguards.

Supplier	Where to check terms
OpenAI	Policies and terms
Anthropic	Terms
Microsoft	Trust Center
Google	Cloud terms
GitHub	Customer terms

What to check in the processor agreement

GDPR Article 28 sets the mandatory minimum. A binding contract or other legal act must set out the subject matter and duration, nature and purpose of processing, data types, categories of data subjects, and the controller’s rights and obligations. Paragraph 3 also covers documented instructions including transfers (with the specified legal exception), confidentiality, Article 32 security, other processors, assistance with individuals’ rights and Articles 32–36, deletion or return at the controller’s choice, information and audits. The processor must also flag instructions infringing the relevant data-protection rules. Written form includes electronic form (paragraph 9).

The following checks help assess a particular AI service; they do not replace the complete statutory contract terms:

Area	What to check	Legal connection
Purpose and instructions	Which operations the processor performs on your behalf and on whose instructions	Art. 28(3)
Security	Appropriate measures according to risk, such as access controls, encryption and incident response	Art. 28(3)(c), Art. 32; not an unconditional requirement for the same solution everywhere
Processing locations and transfers	Whether third-country transfers occur and how Chapter V conditions are met	Art. 28(3)(a), Art. 44; GDPR does not generally require all data to be hosted in the EU
Audits	Compliance information and provision for audits, including inspections	Art. 28(3)(h)
Other processors	Prior specific or general written authorisation; with general authorisation, notice of changes and an opportunity to object	Art. 28(2) and (4)
Personal-data breach reporting	The processor notifies the controller without undue delay after becoming aware of the breach. The controller notifies the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware, unless the breach is unlikely to risk individuals’ rights and freedoms; notification after 72 hours includes reasons for the delay	Art. 33(1) and (2)
End of processing	Delete or return all personal data at the controller’s choice and delete copies, unless retention is legally required	Art. 28(3)(g)
Training and service settings	Whether data is used for training, for which purpose, under which supplier role, and with what retention	Check product, contract and settings; pricing tier alone does not decide

Check the actual service

Before approving an AI service, verify its current plan, contract, training/data-use settings, retention, subprocessors, transfer safeguards and administration. A paid licence is not a universal legal requirement and does not by itself establish compliance. Restrict uses for which the required safeguards are unavailable.

---

Practical steps --- Implementation checklist

Phase 1: Inventory (Week 1)

• Map all AI tools used in the organisation (formal and informal)
• Identify who uses them, for what purpose and how often
• Classify usage: internal assistance / customer contact / decision-making about persons
• Flag deepfakes and AI text informing the public on matters of public interest; assess Art. 50(4) exceptions
• Check existing DPAs and contracts with AI providers
• Identify Shadow AI --- tools used without management’s knowledge
• Document results in the AI inventory

Phase 2: Documentation (Week 2)

• Create an AI Acceptable Use Policy (AUP) --- what is permitted, what is prohibited
• Define an approval process for introducing new AI tools
• Define necessary events and retention by purpose, risk and law; apply Art. 26(6) only to relevant high-risk logs under your control
• Prepare a notification for employees about AI deployment (the Art. 26(7) standard)
• Define data classification in relation to AI (what may/may not go into a prompt)
• Document persons responsible for AI oversight (the Art. 26(2) standard)
• Set up labelling of AI content for the public (Art. 50(4)) --- who approves it and how

Phase 3: Training (Week 3)

• Measures supporting literacy for staff and other persons operating AI on your behalf, tailored to roles, experience, context and affected persons (Art. 4)
• Specific training for active AI tool users --- prompt engineering, security, limitations
• Training for management --- governance, responsibility, compliance
• Documentation of training completion (attendance sheet, certificate)
• Knowledge verification (quiz, test, practical demonstration)
• Plan refreshers when tools, roles or risks change; annual review is a recommended internal cadence, not a fixed Art. 4 interval

Phase 4: Contractual arrangements (Week 4)

• Conclude Article 28 agreements with suppliers acting as your processors
• Migrate from free tier to enterprise licences (where relevant)
• Check whether providers use data for model training
• Verify whether the provider satisfies Art. 50(2) --- and by when (transitional deadline 2.12.2026)
• Verify geographic location of data processing (EU preference)
• Check sub-processors for each provider

Phase 5: Monitoring (Ongoing)

• Set up regular AI inventory review (quarterly)
• Track incidents and near-misses (poor AI outputs, data leaks)
• Update the AUP as new tools and regulations emerge
• Conduct AUP compliance audits (spot checks)
• Monitor changes in provider terms (ToS updates)
• Prepare documentation for potential supervisory audits

---

GPAI vs. High-Risk --- When you need more

Using a general-purpose tool does not itself establish high-risk status. For decisions about people, assess the precise intended purpose against Article 6 and Annex III, including Article 6(3); not every such decision is high-risk. Product safety uses require the Annex I and sectoral analysis.

Comparison of obligations

“Recommended” identifies a governance option, not a legal obligation or guarantee of acceptance in a customer audit. Each control needs a defined purpose and proportionate implementation. GPAI is not a separate risk category; the ordinary-assistance column below assumes non-high-risk use. Assess each provision’s scope and applicable dates separately.

Obligation	Other non-high-risk use	Ordinary non-high-risk GPAI assistance	Relevant high-risk use
AI literacy (Art. 4)	Yes	Yes	Yes
Compliance with the prohibitions (Art. 5)	Yes	Yes	Yes
AUP / internal policy	Recommended	Recommended	A possible implementation; Art. 26(1) requires appropriate measures for use according to instructions, not a document called an AUP
DPA with provider	If supplier is your processor	If supplier is your processor	If supplier is your processor
Logging	Proportionate governance	Proportionate governance	Art. 26(6): relevant automatic logs under control; appropriate period, at least 6 months unless other law provides otherwise
Informing employees	Recommended	Recommended	Yes (Art. 26(7))
Transparency (Art. 50)	According to purpose/output/role	According to purpose/output/role and exceptions	According to purpose/output/role and exceptions
DPIA	If GDPR Art. 35 is triggered	If GDPR Art. 35 is triggered	If GDPR Art. 35 is triggered; use Art. 13 information under Art. 26(9)
Human oversight by designated persons	No	Recommended	Yes (Art. 26(2))
FRIA	No	No	Yes (Art. 27 --- only certain entities)
Risk Management System	No	No	Yes (Art. 9 --- provider)
Conformity Assessment	No	No	Yes (provider)
System and operator registration	Provider relying on Art. 6(3), under Art. 49(2)	The same if Art. 6(3) applies	Provider under Art. 49(1); a public-authority deployer or person acting on its behalf under paragraph 3. Annex III point 2 uses national registration (paragraph 5); paragraph 4 governs restricted database sections

---

Most common mistakes

1. “GPAI doesn’t apply to us, we don’t have our own AI”

Not having your own AI model does not itself exclude duties. Work use of ChatGPT, Copilot or Claude, including a free plan or personal phone, requires assessing whether the organisation uses the system under its authority. Lack of internal approval is not an automatic exemption. Determine provider and deployer roles from the actual activity.

2. “We have an NDA, that’s enough”

An NDA protects confidentiality of information between two parties. An NDA is not a DPA. A Data Processing Agreement (DPA) is a specific contractual document required by GDPR (Art. 28) that addresses the processing of personal data. An NDA does not replace an Article 28 agreement where that agreement is required.

3. “We’ll ban AI and be done with it”

Banning AI won’t solve the problem --- it will create a new one. Employees will use AI anyway, just covertly (Shadow AI). Shadow AI is worse than regulated AI because you have no visibility into what data enters the AI. A better strategy: regulate, train and monitor.

4. “IT will handle it”

AI governance is not an IT project. It concerns the entire organisation --- HR (training, informing employees), Legal (contracts, compliance), Management (strategy, accountability), Marketing (content transparency). IT handles the technical implementation, but the owner is company leadership.

5. “We’re a small company, it doesn’t apply to us”

The AI Act has no blanket small-company exclusion. Assess the actual role and Article 2 scope: Article 4 literacy and Article 5 prohibitions can apply regardless of size; Article 26 concerns relevant high-risk deployers under its conditions and applicable dates. The Act includes proportionate support and simplifications for eligible smaller entities, as well as the Article 99 SME and small mid-cap fine rules.

6. “The licence tier alone decides whether use is safe”

Approve a specific service, plan and configuration for a defined use. Check confidentiality, personal-data roles, training use, retention and access controls. Business or enterprise options may offer useful safeguards, but their name is neither a legal requirement nor proof that every processing activity is compliant.

7. “Art. 50 only concerns model builders”

Article 50(3) and (4) directly address deployers. When using a system that generates or manipulates deepfakes, assess disclosure under paragraph 4. The same applies to generated or manipulated text published to inform the public on matters of public interest. Apply that paragraph’s exceptions and limitations and paragraph 5’s information requirements. These rules apply from 2.8.2026; the Article 111(4) transition concerns only the provider duty under Article 50(2).

---

Penalties for non-compliance

Type of violation	Legal basis	Maximum penalty
Prohibited practices (Art. 5)	Art. 99(3)	EUR 35 million or 7% of global annual turnover
Obligations of deployers of high-risk systems (Art. 26)	Art. 99(4)(e)	EUR 15 million or 3%
Transparency obligations (Art. 50)	Art. 99(4)(g)	EUR 15 million or 3%
Incorrect, incomplete or misleading information in response to a request from a notified body or national competent authority	Art. 99(5)	EUR 7.5 million or 1%
AI literacy (Art. 4)	Art. 99(1) --- penalties set by the Member State	The AI Act sets no cap of its own

The higher of the two values applies. For SMEs including start-ups, Art. 99(6) applies the lower value instead; the new Art. 99(6a) (Regulation (EU) 2026/1744) does the same for small mid-cap enterprises --- but only for paragraphs 4 and 5, not for the prohibited practices in Art. 5.

Example: A company with EUR 50 million turnover breaches Art. 50. If it is neither an SME nor a small mid-cap enterprise, the cap is EUR 15 million --- the higher of EUR 15 million and 3% of turnover (EUR 1.5 million). If it is an SME, the lower value applies, i.e. EUR 1.5 million. This is where the most common error occurs: “or 3%” does not mean the percentage is automatically the one that counts.

Proportionality

The statutory maximum is not a forecast or an expected loss for an ROI calculation. Under Art. 99(7) the supervisory authority will consider the severity, duration, remedial measures and degree of cooperation.

---

Next steps

1. You have understood deployer obligations
2. -> Conduct an AI inventory
3. -> Classify risks
4. -> Review questions to assess your obligations

---

Sources

• AI Act full text (EUR-Lex) --- Regulation (EU) 2024/1689
• Digital Omnibus on AI (EUR-Lex) --- Regulation (EU) 2026/1744, adopted 8 July 2026, published 24 July 2026, in force 27 July 2026
• Article 26 --- Obligations of deployers of high-risk AI systems
• Article 50 --- Transparency obligations
• AI Act Article Index
• Commission guidelines on Art. 50 (C(2026) 5054 final, 20 July 2026) --- non-binding
• Code of Practice on Transparency of AI-Generated Content (10 June 2026) --- voluntary
• EDPB Guidelines on AI

---

Disclaimer

This content is for informational purposes only and does not constitute legal advice. For your organisation’s specific situation, we recommend consulting a qualified lawyer specialising in AI regulation and data protection.

What’s next?

Need help with GPAI compliance? Discuss the relevant system, legal roles and required evidence with us; the agreed scope determines which inventory, policy, training and monitoring work is included.

Discuss your situation | Self-Assessment

---

Content reviewed: 6 September 2026. Primary sources: AI Act — Arts. 3, 4, 25, 26, 50, 99, GDPR — Arts. 28, 33, 35.