What do AI Act terms mean when an SME uses ChatGPT, Copilot or Gemini? This Legal Stones glossary defines them as we use them in the guides. It does not reproduce the statutory text and it does not classify a specific case. The source of the regulation is Regulation (EU) 2024/1689 on EUR-Lex. Supervision in Spain sits with AESIA. Where personal data is involved, the data protection reference is the AEPD.

What is the AI Act?

It is Regulation (EU) 2024/1689. It sets a framework for the development, placing on the market and use of AI systems in the European Union. It does not treat every tool the same: it distinguishes uses and roles. Using ChatGPT does not classify the company by itself.

What does Article 4 say?

Article 4 sets a duty to adopt measures to support AI literacy. It applies to providers and deployers of AI systems: first determine whether the organisation falls into those categories. It is not an official certificate, a single official EU course, or an obligation of individual result.

What does Article 50 say?

Certain AI systems are subject to transparency duties. It depends on the system and the context. A customer-facing chatbot is a typical signal that a review is warranted. It is not automatic. Using ChatGPT, Copilot or Gemini at work does not classify the company by itself.

What is a high-risk system?

It is a category in the regulation for certain systems listed in its annexes, for example some uses in recruitment or credit scoring. Using ChatGPT to draft text does not, by itself, place the company in the high-risk category. Whether a specific system falls there requires review. The 2026 Digital Omnibus postpones part of the high-risk duties; it does not postpone the regulation as a whole.

What is a provider?

Under the AI Act, the provider is the party that develops an AI system or places it on the market. Most SMEs that only use ChatGPT, Copilot or Gemini do not develop the model. Using the tool does not automatically make them providers.

What is a deployer?

A deployer uses an AI system in a professional activity, even if a third party developed it. Many SMEs that use a third-party tool may be in that role. It is not automatic: it depends on the system and the use. It is worth determining in the specific case.

What is Shadow AI?

It is the use of ChatGPT, Copilot, Gemini or other tools that the company has not inventoried or governed. It includes personal accounts. It is not a legal classification. It is a signal that visibility is missing. Guide: Shadow AI in an SME.

What about client data in ChatGPT, Copilot or Gemini?

Pasting a client email, contract or spreadsheet may involve processing of personal data and requires review. A free personal account is not the same as a company plan with a data processing agreement. The AEPD guide Adecuación al RGPD de tratamientos que incorporan Inteligencia Artificial is a reference, not a classification of the case. Guide: ChatGPT with client data.

What is AI literacy?

It means measures so that people who use AI understand the use, the data and when to ask. Article 4 does not establish an official European certificate or a single official course. Legal Stones training is at Curso AI Act and is explained in AI literacy and Article 4.

What is an AI Legal Assessment?

It is Legal Stones’ main service. First it looks at which tools the team uses, for what, and what information goes in. Then, if needed, the analysis and what to review, regulate or correct. It starts with five free questions. It is not a legal opinion and it is not a certificate. The AI Act does not require a document with that name for every SME.

Where is the ChatGPT use checklist for SMEs?

The ChatGPT use checklist for SMEs is a Legal Stones method for writing down tools, uses and data. It is not an AI Act rule and it is not a certificate.

Sources

This page links those sources. It does not reproduce the statutory text and it does not classify a specific case.