Does the EU AI Act Apply to ChatGPT?

It applies to OpenAI as the provider. It also applies to you, as the person using it, and the duties are completely different. Most of the confusion comes from mixing the two up.

Ask whether the EU AI Act applies to ChatGPT and you get two answers, both correct, because there are two parties involved and the Act treats them separately.

OpenAI is the provider. It built the model and placed it on the market. You are the deployer. You use it under your own authority, for your own purposes. That distinction decides almost everything that follows.

What the Act asks of OpenAI

Since 2 August 2025, providers of general-purpose AI models carry documentation duties, a copyright policy obligation, and a requirement to publish a summary of the training data. From 2 August 2026, providers of generative systems also have to mark their synthetic output in a machine-readable way, so that a machine can tell the content was artificially generated.

Systems that were already on the market before 2 August 2026 were given until 2 December 2026 to get that marking in place. None of that is your problem. It is the model maker’s.

Does the EU AI Act apply to ChatGPT when you are the one using it

Yes, and here is where people come unstuck. Article 50 puts duties on deployers (you using ChatGPT) that have nothing to do with what OpenAI does or does not do.

If you put a chatbot in front of customers, you have to tell them they are talking to a machine, unless that is obvious to a reasonably observant person. If you publish a deepfake, you disclose it. If you publish AI-generated text to inform the public on a matter of public interest, you disclose that too, unless a person reviewed it and a named individual holds editorial responsibility for it.

Your vendor’s compliance is not your compliance. OpenAI meeting its obligations does nothing for yours.

We have heard people assume that because they use a large, well-resourced provider, the duty is handled upstream. It is not. The deployer duties in Article 50(1), (3) and (4) belong to the deployer, and they have applied since 2 August 2026 with no grace period at all.

What most ChatGPT users actually have to do

Does the EU AI Act apply to ChatGPT in a way that changes your week? For an ordinary business drafting copy, summarising documents or answering email with AI assistance, the honest answer is that the list is short.

Nothing, for internal work. Using AI to draft an internal memo, summarise a meeting or tidy your own notes triggers no disclosure duty. The Act is about what reaches other people.

Disclosure, for a customer-facing bot. If customers interact with it directly, you must say so.

Disclosure or human review, for published content. AI-generated text published to inform the public on matters of public interest either carries a label or goes through human review with a named person taking editorial responsibility.

Training, for your staff. The AI literacy duty in Article 4 has applied since 2 February 2025. If your people use AI at work, you owe them enough understanding of it to use it sensibly.

What about pasting client data into it

This is where most companies have an actual problem, and it belongs to GDPR rather than the AI Act. Putting a client’s personal data into a consumer AI account, with training enabled, is a processing decision you made and need a basis for. We covered what that looks like in practice with a company that built around the issue.

The AI Act and GDPR run alongside each other. Neither replaces the other, and the data question usually arrives first because clients ask about it.

Does the EU AI Act apply to ChatGPT outside the EU

Does the EU AI Act apply to ChatGPT if your company sits outside the Union? The Act reaches providers placing a system on the EU market wherever they are established, and providers and deployers in third countries where the output of the system is used inside the Union.

So a studio in Toronto producing AI-assisted campaign copy for a client in Dublin is producing output used in the Union. Where the output lands matters more than where you are registered, and the client’s own obligations push the question down the supply chain anyway.

Who actually asks

The question of whether the EU AI Act applies to ChatGPT rarely arrives from a regulator, at least not first. When we asked 53 companies, 59% had already been asked about their AI use by a client, a customer or a partner. Only 9% had changed anything because of the AI Act itself.

The question arrives in a procurement form or a security review, with a return date on it, and it usually reads something like: what AI do you use, who is responsible for it, and does a person check the output. Half the companies we asked keep no written record of any of that.

So the practical answer to whether the EU AI Act applies to ChatGPT in your business is this: it applies, the duties are lighter than you fear, and the thing that will actually cost you time is being unable to evidence any of it when a client asks.

What to do about it

Write down what you use and who owns each tool. Keep a record when a person signs off AI-assisted work that goes out. Both are a morning’s work the first time and minutes a week after that.

(For free), that is what Art50 keeps: an inventory of the AI you use with a named person against each line, and sealed records of human review that anyone can check from a link, without an account. The free plan covers twenty records a month and an inventory item, no card.

If you want to know exactly which obligations reach you, the obligations checker settles it in about a minute, and the EU AI Act timeline shows which deadlines have already passed.

Figures come from The Human Behind It, our October 2026 study of 53 companies. Art50 provides evidence, not legal advice. The full text of Article 50 and the Commission’s guidance on the transparency obligations are both worth reading.