AI in Business: Competencies, Customer Data, and Transparency Obligations

How to implement the principles of using AI tools and check obligations arising from the AI Act.

Status checked: November 2, 2026. We are not a law firm. This material is for informational and educational purposes only and does not constitute individual legal advice. Before implementing solutions, check current regulations and consult specific situations with a specialist.

First, Determine the Usage Method

List the tools used and their purposes: text preparation, customer service, document analysis, or decision support. Identify who is the provider and who uses the system, what data is input, and whether the outcome affects individuals. The obligations of the AI Act depend on the role of the entity, the type of system, and the context, not just the name of the tool.

AI Competencies

Article 4 of the AI Act applies from February 2, 2025. The European Commission describes the obligation to take action to ensure an appropriate level of competency among staff and individuals acting on behalf of the provider or entity using the system. The selection of actions depends on the knowledge of individuals and the context of use; it should not be automatically reduced to a single mandatory certificate.

Data and Confidentiality

Before transferring customer data or documents to an AI service, check the necessity, type of data, authorizations, provider conditions, roles under GDPR, and any potential data transfers. Particularly protected data and confidential information require additional caution. Not every service or data flow has the same legal qualification.

Transparency and Outcome

Article 50 provides specific transparency obligations for designated systems and situations; the Commission indicates the application date of August 2, 2026. Check specific exceptions and obligations of the relevant party. A human should verify the generated information before use, especially when it pertains to law, finance, or decisions affecting individuals.

Sample Principle for the Team

Before using a new tool, the employee reports the purpose and type of data. The responsible person checks the service conditions, available settings, any processing entities, and whether the data is necessary. The team should not input customer data or confidential agreements into an unapproved service simply because the tool is publicly available.

How to Check Responses and Roles

An AI response may appear convincing but contain incorrect sources, outdated regulations, or unauthorized conclusions. Prepare a procedure for verifying information from sources and designate a person responsible for the decision. If the company modifies, implements, or shares the system independently, its role and resulting obligations may differ from those of a regular user.

Dates and scope of EU obligations may change with amendments. Before implementing a high-risk system, biometric identification, or tools affecting employment, check the current text of the AI Act and obtain a specialist assessment. Do not assume that every AI function in the company is a high-risk system.

Action List

1. Compile a register of tools, applications, and providers.
2. Determine permitted and prohibited data in specific services.
3. Match training to the tasks and risks of the team.
4. Verify transparency and oversight obligations for specific applications.

Sources