The AI Act and professional firms: what changes for people using AI tools

The AI Act — Regulation (EU) 2024/1689 — is mostly aimed at whoever develops or distributes AI systems, not at whoever uses them to draft a letter or summarise a case file. But whoever uses them has responsibilities too, and it's a point that often goes unnoticed in professional firms: the obligation isn't only on whoever builds the model, it also falls on the organisation putting it to work on real data.

A risk-based framework

The regulation classifies AI systems by risk level: unacceptable (banned), high, limited, minimal. A general-purpose writing assistant — ChatGPT, Claude or Gemini used to rephrase a text — does not normally fall under high-risk systems. But risk doesn't depend only on the tool: it also depends on what you feed it. Sending a document with a client's health, judicial or financial data to an external service is a decision that needs to be made consciously, regardless of how the system itself is classified.

Where the AI Act meets the GDPR

The two regulations talk to each other. The AI Act does not replace GDPR obligations on personal data processing: it sits alongside them. An AI system used lawfully from an AI Act standpoint can still involve processing of personal data that needs to be managed under the GDPR — legal basis, notice, any agreement with the provider. Both assessments are needed, not one instead of the other.

What someone using AI every day can actually do

• Know which data is actually leaving the organisation when pasting text into an AI chat, and verify it — don't assume it.
• Prefer, where possible, sending text that has already had identifying data removed: it lowers both GDPR risk and exposure if the provider ever has an incident.
• Keep track of when and how AI is used on client documents: it's the basis for any later review, internal or from an authority.

This is exactly the problem obscurIA solves upstream: before text reaches ChatGPT, Claude or Gemini — through the built-in chat or pasted by hand — it passes through a check that replaces personal data with placeholders, and the organisation consciously decides what goes out and what stays on the computer.