AI at work: what employers and businesses in Czechia need to know about the AI Act and GDPR
Since 2 February 2025 businesses must support AI literacy. What this means for a small company, what not to paste into chatbots and how to set simple rules.
Do you use ChatGPT, Copilot or Gemini to write e-mails, translations or offers for clients? Then the EU Artificial Intelligence Act (AI Act) and the GDPR apply to you. For everyday use in a small business, a few sensible rules are enough.
Who the AI Act applies to
The AI Act is Regulation (EU) 2024/1689. It applies directly in all EU countries, including Czechia. A company or sole trader using an AI tool in the course of its business is a ‘deployer’ under the Regulation (Article 3(4)). The only exception covers natural persons using AI in a purely personal non-professional activity (Article 2(10)). Once you use AI for work, the exception no longer applies.
Duty 1: AI literacy (Article 4)
Since 2 February 2025, deployers must ‘take measures to support the development of AI literacy’ of their staff and other persons using AI on their behalf (Article 4(1) and Article 113(a)). Article 4 was amended by Regulation (EU) 2026/1744 of 8 July 2026: the duty is to support, and the Regulation expressly does not require a company to guarantee any specific level of knowledge of an individual.
Account is taken of people's technical knowledge, experience and education, the context in which they use AI and the persons affected by the results. The Commission and the Member States are to support small and medium-sized enterprises in meeting the duty; the Commission publishes practical examples (Article 4(2)).
Duty 2: GDPR, or what not to paste into a chatbot
When you paste a client's name, e-mail, birth number or contract into an AI tool, you are processing personal data. The General Data Protection Regulation applies (GDPR, Regulation (EU) 2016/679):
- Data minimisation: only data ‘limited to what is necessary’ for the purpose (Article 5(1)(c) GDPR). Replacing a name with ‘client A’ is often enough.
- Security: data must be protected against unauthorised processing, loss and destruction (Article 5(1)(f) GDPR).
- Special categories of data, such as health data, are protected more strictly (Article 9(1) GDPR). They do not belong in an ordinary chatbot.
- A provider processing data on your behalf must provide ‘sufficient guarantees’ (Article 28(1) GDPR). Before pasting company data, check whether it offers a data processing agreement and where it stores the data.
- Data may be transferred outside the EU only under the conditions of Chapter V GDPR (Article 44 GDPR).
- Staff may process personal data only on the controller's instructions, i.e. under your rules (Article 32(4) GDPR).
How to handle it in a small business: 5 steps
- List the AI tools your business uses and what for.
- Decide what must not be pasted into them: birth numbers, health data, whole contracts containing personal data.
- Explain briefly how AI works, that it can be wrong and that a person always checks the result.
- For tools that receive company data, check the data processing agreement and where the data is stored.
- Write the rules into a short internal policy and note when and whom you briefed. Under the GDPR this helps you demonstrate compliance (Article 5(2) GDPR).
Full text on EUR-Lex: