Guide

Data protection and AI compliance and the EU AI Act: labeling requirement

The transparency obligations of the EU AI Act have been in effect since August 2026. What this means in practice for AI compliance, who is affected, and what actually needs to be done in implementation.

Request assessment ↗Data protection and AI compliance

Quote upon request3 to 5 weeksStatus 2026

In short

The transparency obligations under Article 50 of the EU AI Act have been in effect since August 2026: anyone communicating directly with an AI system must be able to recognize it. We build in the labeling as standard. For AI compliance, this means: labeling is mandatory, not optional, and applies regardless of company size — a sole proprietorship is just as affected as a corporation. What matters is purpose and risk, not the number of employees.

01 — Legal situation

EU AI Act: what applies

Since August 2026, the transparency requirements from Article 50 of the EU AI Act apply: Anyone communicating directly with an AI system must be able to recognize it. We build in the labeling as standard.

The AI Act doesn't distinguish by company size: A sole proprietorship with an AI system in customer contact is affected just as much as a corporation. What matters is purpose and risk, not headcount.

There's also the obligation to ensure adequate AI competence for the people working with it. That's not an examination requirement, but it should be documented — a training session with a participant list is the simplest proof.

02 — Data protection

What GDPR requires

As soon as personal data is processed — and that happens faster than expected, for instance as soon as someone enters a name or phone number — the usual obligations apply: name the legal basis, define the purpose, maintain data minimization, define retention periods, inform data subjects.

In practice, this means for data protection and AI compliance: a data processing agreement with each involved service provider, checking where processing takes place, a documented deletion period, and an understandable section in the privacy policy. Three things are almost always missing in practice: the defined deletion period, the notice at the point where the data is collected, and clarification of whether the provider uses the data for its own training.

A data protection impact assessment is only required when there's likely high risk — not for most projects of this type. The review itself should still be documented so that if questions arise, it's clear why it was omitted.

03 — Risks

What can go wrong

The system answers incorrectly. Containable by having it work exclusively from verified content and escalate when uncertain rather than guess. This is a configuration decision, not a property of the technology.
The effort is underestimated. Most common reason: unclear starting situation. An honest assessment of the current state before the proposal prevents this more reliably than any buffer.
No one maintains it. The biggest risk of all — and the most easily avoidable.
Data protection gaps. Almost always arise from missing deletion deadlines and unclear responsibility, rarely from the technology itself.
Vendor lock-in. Avoidable if access credentials, data, and documentation contractually remain with the client.

04 — Questions

Frequently asked questions

Does this also apply to sole proprietorships?

Yes. The AI Act doesn't distinguish by company size, but by purpose and risk. Anyone with a chatbot on their website is affected — regardless of whether one or a hundred people work in the business.

Is a verbal agreement within the team sufficient instead of a written policy?

No, in case of dispute or audit, only what is documented counts. A brief written policy also protects new team members who never heard the verbal agreement.

How often does the inventory need to be updated?

Whenever a new tool is introduced or the purpose of an existing one changes. An annual review as a minimum interval makes sense, even without a specific trigger.

Do we need a data protection impact assessment?

Not generally. It becomes necessary when the processing is likely to pose a high risk to data subjects — such as extensive profiling. For an FAQ chatbot on a website, it's usually not required. We review this case by case and document the result in writing.

What if we use multiple AI tools from different providers?

Each tool is assessed individually — provider, data processing, and risk class differ. The usage policy summarizes the results so no one has to look up each tool separately.

What does the EU AI Act specifically require of us?

For most businesses, it comes down to two things: transparency and competence. Transparency means people must recognize when they're speaking with an AI system or seeing AI-generated content — this has been in effect since August 2026. Competence means the people deploying such systems are adequately trained to do so. Both are documentable and achievable with manageable effort.

Do AI-generated texts need to be labeled?

For content that is published and synthetically generated or substantially modified, yes. Purely internal use — research, drafts, summaries — typically does not trigger this obligation.

05 — Next

Data protection and AI compliance by region

Next step

Send us a few sentences about your project.

We read every inquiry ourselves and respond personally. No sales team, no callback form into the void.

Send inquiry ↗ office@pipeline-solutions.at OR +43 681 207 64 203