AI tools are put to use quickly, often faster than rules for them emerge: employees summarize documents with chat assistants, and business units test agents that answer emails or categorize tickets. This only becomes safe once four questions are answered. Which legal obligations apply? Which data may go where? How do we protect ourselves against manipulation? And who approves what?
The AI Act: what applies since when
The Artificial Intelligence Regulation (EU) 2024/1689, the AI Act for short, applies directly in all member states, including Austria. In July 2026, the EU amended it with the Digital Omnibus Regulation on AI, Regulation (EU) 2026/1744. The amendment has been in force since July 27, 2026. The timeline that follows:
- Since February 2, 2025: prohibitions of certain practices (Art. 5), such as social scoring or emotion recognition in the workplace, and the AI literacy obligation (Art. 4).
- Since August 2, 2025: obligations for providers of general-purpose AI models.
- Since August 2, 2026: general application, including the transparency obligations under Art. 50. People must be able to recognize that they are interacting with an AI system, and deepfakes must be disclosed.
- From December 2, 2026: new prohibitions for AI systems that generate non-consensual intimate depictions of real people or depictions of child sexual abuse. By then, providers of generative systems that were already on the market before August 2, 2026, must also mark their outputs in a machine-readable format (Art. 50(2)).
- From December 2, 2027: obligations for high-risk systems under Annex III, for example in recruitment and employment, education, or creditworthiness assessment. Originally, August 2, 2026, was planned for this.
- From August 2, 2028: obligations for high-risk AI in products under Annex I, for example in machinery or medical devices.
The amendment also reworded the AI literacy obligation: providers and deployers take measures to support the development of AI literacy among their staff, taking into account knowledge, experience, training, and the context of use. They do not have to guarantee a specific level of literacy (Art. 4 as amended by Regulation 2026/1744). In practice, nothing changes: if you use AI, you train your people according to their role and document it.
If you use ready-made AI systems under your own responsibility, you are a deployer, not a provider. A provider is whoever develops an AI system or places it on the market under its own name. The obligations depend on the role, so record it for each use case. For orientation in Austria, see the AI Service Center of RTR.
Data protection: the GDPR applies alongside it
The AI Act does not replace the General Data Protection Regulation. As soon as personal data flows into an AI tool, both apply side by side. In practice, five points are decisive:
- Purpose and legal basis: Every processing operation needs a specified purpose (Art. 5 GDPR) and a legal basis (Art. 6).
- Data processing agreement (DPA): If a cloud provider processes data on your behalf, a contract under Art. 28 is required. Clarify whether inputs are used for training and where the data is processed; Chapter V applies to transfers outside the EEA. Learn more under data processing agreement (DPA).
- Data protection impact assessment: It is mandatory where a high risk is likely, for example with the systematic evaluation of individuals (Art. 35).
- Automated decisions: Decisions with legal or similarly significant effects, for example on job applications, must not be based solely on automated processing, except under the conditions and safeguards of Art. 22.
- Transparency: Data subjects must be informed about the processing (Art. 13 and 14).
In its Opinion 28/2024, the European Data Protection Board set out when AI models can be considered anonymous and how legitimate interests are to be assessed as a legal basis. The glossary provides an overview of the regulation under GDPR.
Prompt injection: the risk that remains
Language models cannot reliably tell instructions and data apart. Prompt injection exploits this: attackers smuggle instructions into inputs or into content that the model processes, such as an email, a PDF, or a web page. The OWASP list of the top risks for applications built on large language models ranks prompt injection first in its 2025 edition (LLM01). The German BSI also describes direct and indirect prompt injections as risks of generative AI models.
It becomes critical as soon as a model does not just answer but acts: sends emails, reads files, changes tickets, or retrieves data. There is no complete technical solution. OWASP recommends several layers of protection:
- Limit permissions: An AI agent receives only the access it needs for its task (least privilege).
- Let people decide: A human approves consequential actions such as sending, payment, or deletion (human in the loop).
- Separate external content: Label external content and process it separately from instructions.
- Check outputs: Validate and filter responses against an expected format.
- Test attacks: Test applications specifically with attack examples before they go live.
On top of this comes the basic rule for every output: AI can sound convincing and still be wrong (hallucination). If you pass on results, check them.
Approvals: a lean process instead of uncontrolled growth
Blanket bans carry the risk that employees switch to private accounts, bypassing IT. A short, binding path that records what is allowed works better:
- Create an inventory: Which AI tools and use cases exist, who is responsible for them, and what is your role under the AI Act?
- Classify data: public, internal, confidential, personal. For each level, it is defined which tool may process it.
- Review and approve tools: contract and DPA, place of processing, use for training, sign-in with a company account and multi-factor authentication, logging.
- Classify the risk: rule out prohibited practices, identify high-risk areas such as personnel decisions, meet transparency obligations.
- Secure agents: minimal permissions, approval before consequential actions, tests against prompt injection, logs.
- Train and document: by role, with date and content.
- Review regularly: tools, features, and the legal situation change quickly.
AI governance describes the organizational framework for this. A suitable structure for risk assessment is the AI Risk Management Framework of the US standards institute NIST with its profile for generative AI (NIST AI 600-1).
Start with the benefit, not the tool
Security is easier when it is clear what AI is used for. With Atlas, TOMORIS captures areas, processes, and systems in a guided analysis, rates the individual steps by AI potential and feasibility, and derives prioritized use cases and a pilot roadmap from this. TOMORIS NEXT supports the implementation, and UNIVERSITY offers training on the safe use of AI.
Frequently asked questions
Does the AI Act also apply if we only use chat assistants?
Yes. If you use an AI system professionally under your own responsibility, you are a deployer. For typical office applications, this usually does not result in high-risk obligations, but it does entail AI literacy under Art. 4 and, depending on the use, transparency obligations under Art. 50. The GDPR applies in addition.
Have the high-risk obligations been postponed?
Yes. Since Regulation (EU) 2026/1744, they apply to systems under Annex III from December 2, 2027, and to AI in products under Annex I from August 2, 2028.
Do we need our own AI policy?
The AI Act does not prescribe a specific form. However, a short policy is the simplest way to record approvals, data levels, and responsibilities in a way everyone understands.
This article is a general overview as of October 25, 2026, and does not replace legal advice.
Sources
- Regulation (EU) 2024/1689 (AI Act), in particular Art. 4, 5, 50, and 113
- Regulation (EU) 2026/1744 (Digital Omnibus Regulation on AI), OJ L of July 24, 2026
- Regulation (EU) 2016/679 (General Data Protection Regulation), Art. 5, 6, 13, 14, 22, 28, 35, and Chapter V
- European Data Protection Board: Opinion 28/2024 on certain data protection aspects related to AI models
- OWASP Top 10 for LLM Applications 2025: LLM01 Prompt Injection
- BSI: Generative AI Models, Opportunities and Risks for Industry and Authorities, version 2.0 of January 17, 2025
- NIST: AI Risk Management Framework and NIST AI 600-1: Generative Artificial Intelligence Profile
- RTR: AI Service Center