EU AI Act and GDPR: What Applies to Austrian SMEs
The AI Act is not on trial
Since 2 August 2026, the EU AI Act has applied directly to most companies. This reaches beyond AI developers, to companies that use AI in daily work: a chatbot on the website, AI images in the newsletter, ChatGPT or Copilot in the office, translation tools, or software-assisted screening of job applications.Many Austrian KMU miss this because the use feels incidental. That is exactly where the risk sits. The AI Act does not ask whether you are a tech company. It asks whether you use, provide, or deploy an AI system whose output reaches people. If you do, obligations apply. Two foundations have also been in force for more than a year, and both are surprisingly often overlooked: the prohibitions under Article 5, and the Article 4 duty that staff using AI have adequate AI literacy.
For management, one simple question matters: what do you actually need to do now, what costs time, and where is the real risk? The short answer: the AI Act mostly asks most KMU for clarity, labeling, and training. The GDPR asks for the harder background work: a legal basis, contracts with providers, a check of data flows to countries outside the European Economic Area (EEA), deletion, access requests, and purpose limitation, meaning the rule that data may only be used for the purpose it was collected for.
Two rulebooks, two different questions
The AI Act and the GDPR do not regulate the same thing, and the two checks run in parallel.
The AI Act asks: what does the system do, how risky is the use, and who needs to be told about it? It looks at the system’s function and its effect on the outside world. Is a person talking to a chatbot? Then you have to disclose that. Are you showing AI-generated content? Then transparency duties apply. Are you using AI in an area with real consequences, such as hiring? Then you are in a much stricter regime.
The GDPR asks something different: whose personal data is in this use, what are you processing it for, on what legal basis, with which provider, in which country, and with what rights for the people concerned? Its starting point is the data processing itself.
For a KMU, that is the practical core of it. Check only the AI Act, and you often solve the cheaper part: you label the chatbot, train the staff, and keep a list of your AI uses. Skip a proper GDPR check alongside it, and the more expensive problem stays open. A typical example: the chatbot carries a correct AI notice, but the data processing agreement with the provider is missing, or the data flow to a country outside the EEA is not properly regulated. You have then solved the visible problem and left the real liability risk standing.
In Austria, an institutional split adds to this. The Datenschutzbehörde (data protection authority) handles data protection, backed by the Austrian Datenschutzgesetz. For AI Act questions, the KI-Servicestelle at RTR-GmbH has been operating since 1 September 2024 as the first point of contact for companies. Which Austrian authority oversees which area is not yet finally settled. Check the current status with RTR before relying on any one authority’s jurisdiction.
Which risk class your use falls into
The AI Act works with four practical tiers: prohibited, high-risk, transparency, minimal.
Prohibited is the small but sharp category under Article 5. These prohibitions have applied since 2 February 2025. For an ordinary KMU, this tier mostly plays a negative role: certain clearly banned practices are simply off limits. It is a ban on use. No paperwork resolves it.
High-risk is the category that makes many companies nervous, but it catches only a smaller share of typical KMU use. Strict requirements apply here. The relief for you: almost everything a non-technical KMU uses in daily work lands in the transparency or minimal tier.
Transparency is the tier that has become concretely relevant for many KMU since 2 August 2026. Article 50 requires clear notices in certain cases. People must know they are interacting with AI when that is not obvious. In certain cases, they must also be able to recognize that content was artificially generated or manipulated.
Minimal is the large remainder. Use AI internally as a tool, say to draft a newsletter, phrase text, or collect ideas, and you often land in this zone. That does not mean the law has nothing to say. It only means the AI Act’s risk logic requires little or nothing specific. The GDPR can still apply in full if you process personal data.
For a first read on your own use, two questions usually suffice in a KMU.
First: does the AI decide something with significant effect on a person, on its own?
Second: does a person genuinely review the result before it counts?
Answer both questions honestly and you will sort most cases correctly. A translation tool for product text, an image generator for social media, or an email assistant sit far from high-risk in most cases. A chatbot on the website regularly falls into the transparency area. A genuine candidate pre-selection or hiring decision is the exception that does hit KMU: employment, worker management, and access to self-employment fall under Annex III. Anyone using AI there on its own to score or pre-select candidates needs to look very closely.
Timing matters here. The Digital Omnibus, an EU legislative package that pushed several deadlines back, means the obligations for stand-alone high-risk systems under Annex III only start on 2 December 2027. For high-risk cases under Annex I, meaning AI as a safety component in regulated products, the date is now 2 August 2028. That takes pressure off many companies. It does not, however, touch the transparency duties, prohibitions, and AI literacy requirement already in force.
What the GDPR additionally requires
The GDPR asks the questions that create real work. You need to check whether you are feeding personal data into the AI system at all. In a KMU, the honest answer is often: yes.
If your staff enter customer data, email content, application documents, support requests, or internal performance data into ChatGPT, Copilot, a chatbot, or a translation tool, you are processing personal data. You then need a legal basis first. Depending on the case, that is contract performance, legitimate interest, a legal obligation, or, in exceptional cases, consent. You have to name this basis specifically. “We’re working more efficiently now” is not enough.
Next comes the contract with the provider. If the AI provider processes data on your behalf, you need a data processing agreement. That covers the chatbot vendor, the newsletter tool with an AI feature, the translation service, or any SaaS provider handling text and prompts. Without that contract, a central piece of your data protection basis is missing.
The next point is data leaving the EEA. Many AI services run wholly or partly on infrastructure outside Europe. So read the contract documents and the provider’s transfer information: where does the data go, on what basis, and what additional safeguards are needed? Anyone who would rather not ask that question at all runs applications, databases, and agent runtimes on European servers from the start; our page on Claude in the Enterprise describes what that looks like.
After that come data-subject rights and deletion. If someone requests access, you need to be able to say which data you process in which system. If deletion is requested, you need to work out what sits in the source system, in the AI tool, in logs, and in exports. Without a register and clear processes, this fails in daily practice. The same applies to purpose limitation. You cannot dump application documents into a general tool and later reuse them to train internal patterns or for other purposes just because it is technically convenient.
One relief belongs here: you should already have most of this in place. If your contracts with service providers and your privacy notice are up to date, a large part of this work is already done, and the AI Act adds less on top than it first appears to.
The practical examples are unremarkable, and that is exactly why they are dangerous:
A website chatbot: under the AI Act, you label the interaction as AI. Under the GDPR, you check the legal basis, the privacy notice, the data processing agreement, retention periods, log data, and the provider’s data flow.
AI images in the newsletter: under the AI Act, transparency can be relevant, especially for realistic or manipulative content. Under the GDPR, as soon as real people or personal data appear in the material, check origin, rights, and purpose.
ChatGPT or Copilot in the office: under the AI Act, you train staff under Article 4. Under the GDPR, you set out which data is allowed in prompts, which is not, and on what contractual basis the provider processes data.
Candidate pre-selection: under the AI Act, a possible high-risk area under Annex III. Under the GDPR, you are processing especially sensitive data, need a solid legal basis, must inform the people concerned clearly, and document the whole process.
The dates, sorted by what you need to do now
First the dates already in force, then the later special cases.
| Date | What applies | Applies to you if |
|---|---|---|
| 2 February 2025 | Prohibitions under Article 5; AI literacy under Article 4 | You use AI systems and staff work with them |
| 2 August 2025 | Obligations for providers of general-purpose AI models, the oversight structure, the penalty framework | You are yourself a provider of such AI models |
| 2 August 2026 | The AI Act applies generally; transparency duties under Article 50 | You deploy AI toward people or run a chatbot |
| 2 December 2026 | Grace period: Article 50(2), machine-readable labeling of older generative systems | You provide a generative system placed on the market before August 2026 |
| 2 December 2027 | Obligations for stand-alone high-risk systems under Annex III | You deploy or provide Annex III cases on a stand-alone basis |
| 2 August 2028 | High-risk under Annex I: AI as a safety component of regulated products | You place a regulated product with an AI safety component on the market |
There is a common misreading of the December date worth clearing up: the Digital Omnibus did not push back the general start of the transparency duties. Since 2 August 2026, people still need to be told when they are talking to AI or seeing AI-generated content. The grace period to 2 December 2026 covers only the machine-readable labeling of synthetic content under Article 50(2), and only for generative systems placed on the market before 2 August 2026.
Your first five steps
Record every AI use in the company. Ask each department: where does AI actually run here? Capture chatbots, office assistants, translation, marketing tools, image generators, HR software, and website plugins. The goal is a simple list with purpose, provider, data types, and the person responsible. Effort: half a day to a full working day.
Sort each use into three columns: risk tier, data involved, outward effect. Check for each entry: does this fall under transparency or minimal, is personal data involved, and do customers, applicants, or staff see the result? Flag HR topics separately right away. Effort: half a day.
Label first, train second. Clearly labeling the website chatbot and adding notices wherever people interact with AI or see AI content takes one to two hours. Training is the bigger item: staff using AI need clarity on which data is allowed, which inputs are forbidden, prompt practice, and escalation. Article 4 has been in force since 2 February 2025, well ahead of the August 2026 milestone. Effort: labeling a few hours, training one to two days.
Check the data protection basis for every relevant service. Collect the data processing agreement, the privacy notices, the list of sub-processors (the providers your own provider uses), the retention periods, and the details on data flows outside the EEA. Decide the legal basis for each use. Budget this step in weeks: most of it is waiting on provider replies. Most KMU bring in a data protection consultant or an AI-focused law firm for this step, and that is the right call. If you cannot document a use, treat it as still open.
Set internal use rules with simple, binding guardrails. Define which data may never go into external AI tools, who approves what, when a person must review the result, and how access or deletion requests work organizationally. Set up a separate review step for HR applications and any case with a significant effect on people. Effort: one to two days.
What you do not need to do
As an ordinary KMU in the transparency tier, you do not need to appoint an AI officer. You do not need to buy a certification. You also do not need to build a heavy management system just for AI if your daily use is mainly chatbots, office assistants, translation, and marketing tools.
Nor do you need to wait for a supposedly later general start date. Right now, that is an expensive excuse. The December misreading shows it well: the grace period to 2 December 2026 is often wrongly applied to all transparency duties. That is wrong. The core duty, telling people that they are talking to AI or seeing AI-generated content, has applied since 2 August 2026.
The regulation has teeth, and you should know the scale. Article 99 of the AI Act sets fines of up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, up to EUR 15 million or 3% for the remaining obligations, and up to EUR 7.5 million or 1% for false statements to authorities. What matters for you is paragraph 6 of the same article: for KMU, the lower of the two amounts applies. The figures scale to your size and, for a KMU, stay in a range a business can survive. The real risk is paying a fine that could have been avoided.
Nor do you need to ban every tool immediately. A blanket ban sounds decisive but rarely solves the problem. What you need is visibility, clear limits, training, and solid data protection groundwork. For most KMU, that is structured and running within a few days, once management makes it a clear priority.
The starting point is a plain, honest inventory of what runs where. Once you know where AI already runs in your company today, you can work through almost every obligation in the right order: label and train visibly first, then close the data protection basis for each use properly.
If you would rather not run this inventory alone, we run it with you and classify every use we find in a single pass. Write to us about what is already running in your company.
This article offers practical orientation and does not replace legal advice.
