Using LLMs Under GDPR and the EU AI Act: A Practical Checklist

Using LLMs under GDPR and the EU AI Act comes down to a handful of concrete tasks: know what personal data flows into the model, have the right contracts with your providers, control where data is stored and for how long, tell people when they are dealing with AI, and work out which AI Act risk category your use case falls into. This checklist is written for business owners and developers shipping chatbots, assistants and automations in the EU, and it reflects the AI Act timeline as amended in 2026.

This is not legal advice. It is a practical engineering checklist from a software team. Laws, guidance and deadlines change, and your obligations depend on your specific facts. Confirm your approach with a qualified data protection or legal adviser.

GDPR and the EU AI Act: how they fit together

• The GDPR applies whenever you process personal data — including prompts, chat logs, uploaded documents and anything your model outputs about a person.
• The EU AI Act (Regulation (EU) 2024/1689) regulates AI systems and general-purpose AI models based on risk, whether or not personal data is involved.

Most businesses that plug an LLM into a product are deployers under the AI Act (you use an AI system under your authority) and controllers under the GDPR (you decide why and how personal data is processed). The model vendor is typically your processor for API traffic and the provider of the general-purpose AI model. If you build and sell an AI system under your own name, you may also be a provider of that system, which carries more obligations.

AI Act timeline (as of September 2026)

The AI Act entered into force on 1 August 2024 and applies in stages. A “Digital Omnibus” amendment, which entered into force in July 2026, postponed the high-risk deadlines. Key dates:

Date	What applies
2 February 2025	Prohibited AI practices banned; AI literacy obligation (Article 4)
2 August 2025	Obligations for providers of general-purpose AI models; governance and penalties framework
2 August 2026	Transparency obligations (Article 50), such as telling people they are interacting with an AI system and disclosing deepfakes
2 December 2026	Marking of AI-generated content for generative systems already on the market before 2 August 2026
2 December 2027	High-risk obligations for Annex III use cases (e.g. employment, education, credit scoring, essential services)
2 August 2028	High-risk obligations for AI in products covered by existing EU product legislation (Annex I)

The Omnibus also softened the wording of the AI literacy duty, but did not remove it. Check the European Commission’s AI Act policy page for current guidance.

Step 1: Classify your use case by AI Act risk

The AI Act sorts AI uses into broad tiers:

1. Prohibited — for example, manipulative techniques causing significant harm, social scoring, certain biometric categorisation, and emotion recognition in workplaces and schools (with narrow exceptions).
2. High-risk — AI used in listed sensitive areas such as recruitment and worker management, access to education, creditworthiness, essential public and private services, and safety components of regulated products.
3. Transparency obligations — chatbots, AI-generated or manipulated content, emotion recognition and biometric categorisation that are not prohibited.
4. Minimal risk — most other uses, such as spam filtering or internal drafting help, with no specific AI Act obligations beyond AI literacy.

Checklist:

• List every place you use an LLM (customer chatbot, internal assistant, document triage, CV screening, etc.).
• For each, note whether it could fall in a prohibited or high-risk area. CV screening, candidate ranking and credit decisions are red flags that need specialist review.
• Record your conclusion and reasoning. You will want it later.

Step 2: Map the personal data

• What personal data enters prompts? Names, emails, customer records, health information, HR data?
• Does any of it fall into special categories (health, ethnicity, religion, trade union membership, biometrics, sex life)? That needs a stronger legal basis and extra safeguards.
• What is your legal basis for each purpose (contract, legitimate interests, consent, legal obligation)? If legitimate interests, document the balancing test.
• Update your records of processing and privacy notice to mention AI processing and the providers involved.
• Can you minimise? Strip or pseudonymise identifiers before sending text to the model when the task does not need them.

Step 3: Contracts with LLM providers

• Sign the provider’s data processing agreement (DPA). Major API providers offer one for business accounts; consumer chat apps often do not cover business use.
• Confirm in writing whether your API data is used for training. Business API terms commonly say it is not by default, but check your specific plan and settings.
• Review the sub-processor list and how you will be notified of changes.
• Check international transfers. If data goes outside the EEA, confirm the mechanism: an adequacy decision (for the US, the EU–US Data Privacy Framework for certified companies), or Standard Contractual Clauses with a transfer impact assessment. Note that a challenge to the Data Privacy Framework is pending before the EU Court of Justice, so have a fallback.
• Make sure staff are not pasting customer data into personal accounts of consumer AI tools. Provide an approved alternative.

Step 4: Data residency and hosting

• Decide where prompts, outputs, logs and embeddings are stored and processed. Several providers and cloud platforms offer EU data residency options for some services; confirm which features are covered.
• For sensitive data, consider self-hosted or open-weight models on EU infrastructure you control. Our guide to open-weight LLMs you can self-host covers options.
• Remember the vector database in a RAG system holds copies of your documents. It needs the same protection as the source systems. See private RAG for business.

Step 5: Retention and deletion

• Set a retention period for chat logs and prompts, and enforce it automatically.
• Understand the provider’s retention of API inputs and outputs (for abuse monitoring, for example) and whether shorter or zero-retention options exist for your account.
• Make sure you can find and delete a person’s data across logs, databases and vector indexes when they exercise their rights.
• Do not fine-tune models on personal data unless you have assessed this carefully; removing a person’s data from trained weights is not practical.

Step 6: Transparency to users

• Tell people clearly when they are interacting with an AI system, unless it is obvious from context. For customer-facing chatbots this is an AI Act Article 50 obligation from 2 August 2026.
• Label AI-generated images, audio or video that could be mistaken for real, and meet the marking requirements for generated content that apply to providers.
• Explain in your privacy notice what the AI does with personal data, which providers are involved and how long data is kept.
• Offer a route to a human for important matters.

Step 7: Automated decisions and DPIAs

• If an LLM makes or heavily shapes decisions with legal or similarly significant effects on people (hiring, credit, access to services), GDPR Article 22 rules on automated decision-making may apply. Keep a meaningful human in the loop.
• Run a Data Protection Impact Assessment (DPIA) for new, large-scale or sensitive AI processing. Many regulators treat innovative technology and profiling as triggers.
• For potential high-risk AI Act uses, start preparing now for risk management, logging, human oversight and documentation, even though the deadline moved to December 2027.

Step 8: Security and AI literacy

• Protect API keys, restrict access to logs, and encrypt data at rest and in transit.
• Defend against prompt injection: do not give an LLM tools or data access beyond what the task needs, and require confirmation for destructive actions. Our web app security checklist covers the application side.
• Give staff who use or operate AI systems practical training: what data they may share, how to check outputs, and when to escalate.
• Write a short internal AI use policy listing approved tools.

Key takeaways

• Identify your role: usually controller (GDPR) and deployer (AI Act).
• Classify each use case by AI Act risk; treat HR, credit and essential-service uses with extra care.
• Sign DPAs, confirm no-training terms, and check international transfer mechanisms.
• Choose where data lives, set retention periods and make deletion possible across logs and vector stores.
• Disclose AI interactions to users — this has applied since 2 August 2026.
• High-risk obligations now start 2 December 2027 (Annex III) and 2 August 2028 (Annex I); use the time to prepare.
• Get qualified legal advice for your specific situation.

Building compliant AI systems

We design LLM applications with privacy built in: EU hosting where required, minimised prompts, retention controls, audit logs and clear user disclosures. If you need a system where documents never leave your infrastructure, our private RAG service is a good starting point. Contact us to discuss your requirements — and bring your legal adviser’s questions along.