Do I need to document ChatGPT and similar tools I use?
Even if your company has not officially introduced an AI system, employees may already use tools such as ChatGPT, Copilot or Gemini. In that case, it is important to know where AI is used, with exactly which data and in which processes.
Artificial intelligence is increasingly entering everyday life and company operations. It is not used only in large technology systems, but also in tools for writing, translation, data processing, customer support, marketing, sales, e-commerce and administration.
Most small or medium-sized companies will not need a large legal document only because employees use ChatGPT, Copilot, Gemini or similar tools. However, it is wise to perform a basic internal check: which AI tools are used, who uses them, in which processes and with which data.
The EU AI Act distinguishes roles such as providers, who develop or place AI systems on the market, and deployers, who use AI systems in their own operations.
The first step is usually not a complex legal analysis, but a simple record and clear internal rules. The company should know whether employees use AI for public texts, internal documents, client communication, data analysis or decision-making, and whether personal data may be entered into AI tools.
The EU AI Act uses a risk-based approach. Low or minimal-risk systems have fewer requirements, while high-risk AI systems require stricter control, documentation, oversight and responsible use. Special rules also exist for general-purpose AI models, mostly for providers of such models.
Therefore, the real question is not: “Do we use ChatGPT?” The better question is: “What do we use it for, who uses it, which data do we enter and can the result affect other people?”
This is why basic documentation is useful: a list of AI tools, descriptions of use, types of data entered, basic employee rules and a person responsible for oversight.
Not sure whether the EU AI Act applies to your company?
If you use AI tools in marketing, sales, administration or other internal processes, you may already have regulatory obligations.
Contact us for a short free check and find out which steps you should take.