ChatGPT, the OpenAI API and who is responsible.

The question arrives in two very different forms, and they have different answers. "Our staff use ChatGPT - does the AI Act apply to us?" is usually a small problem. "We built our product on the OpenAI API - are we a provider?" is a real one. This page separates them, because conflating the two is how teams end up either panicking or ignoring something they shouldn't.

If your staff just use ChatGPT

Using ChatGPT the way you'd use a search engine or a word processor - drafting, summarising, brainstorming - makes you a deployer of an AI system under Article 3(4), and almost always a deployer of a minimal risk one. The heavy Chapter III obligations do not attach.

What does attach, today:

• Article 4 - AI literacy. Enforceable now. You must ensure staff using AI systems have a sufficient level of AI literacy for their role. What that actually requires.
• Article 5 - prohibited practices. Also live. Most relevant here: emotion inference in the workplace is prohibited, not merely regulated. If someone has wired an LLM into staff monitoring, that's the exposure.

Nothing about internal ChatGPT use makes you a provider. OpenAI is the provider of ChatGPT. You are downstream, and GDPR is the more pressing question - what your staff are pasting into it - not the AI Act.

If you built on the OpenAI API

Here the answer changes. Shipping a feature to your users that runs on GPT under the hood makes you the provider of that feature, even though the model is OpenAI's. You put it on the market under your own name; that is what Article 3(3) turns on.

Two separate questions follow, and teams routinely merge them:

The first is what everyone worries about and rarely applies. The second is what actually applies and is rarely discussed. Where the GPAI line sits · Provider vs deployer in full.

What the API does not remove

Article 50 disclosure. If your GPT-powered feature talks to users, it must say it's an AI system at first interaction. OpenAI's terms don't discharge this for you - it's a duty on the provider of the system the user is actually interacting with, which is yours. Article 50, in detail.

Classification by what your product does. The Act classifies your system by its intended purpose, not by whose weights are underneath. A GPT-powered CV screener is high-risk under Annex III point 4 exactly as much as one you trained yourself.

Content marking. Article 50(2) requires AI-generated output to be marked machine-readably. For plain API output this generally sits with the model provider - but if you generate, assemble or re-encode media yourself, verify rather than assume.

When you would cross into being a GPAI provider

Fine-tuning does not automatically do it. What can: substantial retraining that materially changes the model's general capability, or repurposing it into a new task domain. Prompt engineering, RAG, and light in-domain fine-tuning ordinarily keep you downstream. The four factors that decide it are set out on the Article 53 page.

If you do cross the line, the obligations are OpenAI-scale: technical documentation, a copyright policy, a public training-data summary, and cooperation with the AI Office. This is worth knowing before a retraining project, not after.

The short version

• Staff using ChatGPT → deployer, minimal risk, do Article 4 literacy and check Article 5
• Product built on the API → you're the provider of your feature; classify it on what it does
• Article 53 GPAI duties → OpenAI's, unless you substantially retrain
• Article 50 disclosure → yours, live now, if it talks to users

Frequently asked questions

Does using ChatGPT make my company subject to the EU AI Act?

Using ChatGPT as a workplace tool makes you a deployer of an AI system, almost always a minimal risk one. The heavy Chapter III obligations do not attach. What does apply now is Article 4 AI literacy for staff using it, and Article 5, which prohibits practices such as emotion inference in the workplace.

Am I a provider if I build my product on the OpenAI API?

Yes - of your own feature. Shipping an AI feature under your own name makes you the provider of that AI system under Article 3(3), even though the underlying model is OpenAI's. That is separate from being a general-purpose AI model provider under Article 53, which calling the API does not make you.

Does using the OpenAI API give me Article 53 GPAI obligations?

Almost certainly not. Calling the API, prompting, retrieval augmentation and light in-domain fine-tuning keep Article 53 duties - the training-data summary, copyright policy and technical documentation - with OpenAI. Substantial retraining that materially changes the model's general capability, or repurposing it to a new task domain, can move that line.

Do I still need to disclose that my GPT-powered feature is AI?

Yes. Article 50(1) requires the provider of the system the user interacts with to say it is an AI system at first interaction. That is you, not OpenAI, and it has been enforceable since 2 August 2026.

Is a GPT-powered CV screener high-risk?

Yes. The Act classifies a system by its intended purpose, not by whose model runs underneath. CV screening sits in Annex III point 4 and profiles individuals, which also closes the Article 6(3) exemption.

Which AI model does Reglynn use?

Reglynn reports are generated by an AI system built on Anthropic's Claude, running Reglynn's own question set and risk logic, and delivered automatically. Reglynn classifies itself as a Limited Risk AI system under Article 50 of the EU AI Act and discloses AI involvement wherever it occurs, including in its chat assistant. Our own self-assessment is published at reglynn.eu/our-ai-act-status.