No, using ChatGPT is not automatically prohibited under the AI Act

Drafting a public social post and ranking job applicants are fundamentally different uses. Document purpose, input data, output and impact before assigning a risk level.

A general-purpose chatbot does not receive one permanent risk label for every customer. Your responsibility depends on how your organisation deploys it. A harmless writing aid can become a serious issue when employees paste medical records, client secrets or personnel files into it.

A usable policy says which tools are approved, which information may never be entered and when a person must verify the result. If the rule cannot guide a Tuesday afternoon decision, it is not finished.

Make the safe route easier than the unsafe one. Give employees an approved tool, a short list of prohibited data and a named person for questions. A thirty-page policy that nobody can find will not change behaviour.

A person clicking approve is not automatically meaningful oversight. The reviewer needs enough time, information and authority to disagree with the model. Record what they checked and what happens when confidence is low.

For decisions about applicants, employees, credit or essential services, build a route for correction and challenge. People affected by an AI-supported decision should not disappear into a loop between a supplier and your organisation.

Select the three most-used AI applications. For each, inspect the contract and privacy settings, test what the tool remembers, and ask the team for real prompts they use. This gives you a more honest picture than a questionnaire alone.

Then decide: approve the use, approve it with conditions, pause it pending investigation or stop it. Write down why. That simple decision log is the beginning of defensible AI governance.