The EU AI Act: what companies must anticipate

The EU Artificial Intelligence Act (AI Act) governs AI with a risk-based approach: the riskier the use, the stronger the obligations. For most companies using consumer AI assistants, the issue isn't being a “provider” under the regulation, but using AI responsibly — transparency, human oversight, and protecting the data that flows through. Anonymizing data before sending it remains a robust habit, whatever the regulatory detail.

A risk-based approach

The AI Act classifies AI systems by risk level, from prohibited uses to high-risk uses (subject to strict obligations), down to limited or minimal risk. General-purpose AI models have their own obligations, notably around transparency.

• Unacceptable risk: certain uses are prohibited.
• High risk: enhanced obligations (documentation, oversight, robustness).
• Limited risk: transparency obligations (disclose it's AI).
• Minimal risk: the majority of everyday uses.

Provider or deployer: which are you?

The regulation distinguishes, among others, the one who develops/places a system on the market (provider) from the one who uses it professionally (deployer). A company that merely uses an AI assistant is generally a deployer: its obligations focus on compliant use, transparency and data protection.

What you can prepare now

1. 1Map your AI uses and the data they handle.
2. 2Document a usage policy (transparency, human oversight).
3. 3Minimize the data sent to third-party services (anonymization at the source).
4. 4Connect AI Act and GDPR: data protection is a common foundation.

Whatever your role, sending less sensitive data to AI services reduces your risk surface. ONYRI Sanitize anonymizes that data in the browser before anything is sent: a simple move, aligned with the minimization spirit shared by the GDPR and the AI Act.