Compliance briefing
Does my company really have to do nothing about AI?
A short, honest overview of which obligations actually apply when a company uses AI — and which don't. Meant as guidance, not a sales pitch.
What actually applies
| Obligation | Who | When | What it means |
|---|---|---|---|
| GDPRData protection | Every company processing personal data | always | Employees who put customer or personal data into an unapproved AI tool process it with no legal basis, no data-processing agreement and no record. |
| AI Act · Art. 4AI literacy | Everyone who uses AI — no exception | since 02 Feb 2025 | Staff must have sufficient AI literacy — a basic grasp of the opportunities and risks of the tools they use. |
| AI Act · Art. 5Prohibitions | Everyone | since 02 Feb 2025 | Certain practices are banned — e.g. emotion recognition in the workplace or social scoring. |
| AI Act · Art. 50Transparency | Anyone running chatbots or publishing AI content | from 02 Aug 2026 | Label chatbots as AI; visibly mark AI-generated or AI-edited content. |
| AI Act · High-riskAnnex III | Only for a high-risk use case | from 02 Dec 2027 | Human oversight, logging, informing affected people. Triggered e.g. by AI in recruiting (see below). |
| ConfidentialityProfessional & contract law | Firms under client or contractual confidentiality | always | Putting client or customer data into an AI tool can breach confidentiality and trade-secret obligations — independent of the GDPR. |
The point many miss
The AI Act has transition periods. The GDPR does not.
It applies to every processing of personal data — from the moment someone copies a customer name, an email address or a contract into an AI tool. This is the duty that hits every company immediately — regardless of size, industry or AI-Act risk tier.
The usual trigger isn't the regulator, but the first customer or auditor who asks for evidence.
High-risk — for whom, really
Broadly affected
HR & worker management. Recruiting and CV screening, but also promotion, task allocation and performance monitoring of employees.
Industry-specific
Creditworthiness (anyone assessing credit or lending) and insurance pricing (life / health).
Not high-risk
Support chatbots and lead qualification — only the transparency duty (Art. 50) applies here, not the high-risk regime.
From 02 Dec 2027 — what applies then
02 Dec 2027 doesn't suddenly make every company high-risk. But from then on the deployer duties for high-risk AI are live — and the most common way to slip into that category is AI in HR: recruiting, promotion, task allocation or performance monitoring.
The heaviest part (the conformity assessment) sits with the tool's provider; a company using AI there becomes a high-risk deployer and must then, operationally:
- Ensure human oversight — a competent person supervises the system.
- Follow the instructions — run the system as the provider specifies, not off-purpose.
- Monitor operation and suspend it on anomalies.
- Keep logs ≥ 6 months — the automatically generated records.
- Inform affected people when AI co-decides about them.
- Inform employees & works council before workplace deployment.
In practice, from an operator's view — the same duties map onto three views in Qadar AI Shield:
Which AI tools are in use — and with what data?
Discovery
Govern or block AI company-wide, monitor operation and suspend on anomalies.
Policies
Log and evidence usage — records kept for at least 6 months.
Audit Log
What this means in practice
For most companies the question isn't “Are we regulated?” but: Do we know which AI tools our team uses — and with what data? And could we prove it if someone asked? Usually the honest answer is no.
That gap — real-time visibility, policy enforcement and an audit log over AI usage — is exactly what Qadar AI closes. Not because a law forces it, but because you can't control what you can't see.
Qadar AI Limited · DIFC, Dubai
www.qadar.ai · [email protected]
This document is for guidance and is not legal advice. Regulatory statements as of July 2026, EU AI Act as amended by the Digital Omnibus (adopted; publication in the EU Official Journal pending at the time of writing). Deadlines may change. Seek legal counsel for a binding assessment of your specific case.