Knowledge · 19 September 2026
AI tools and personal data
Employees paste applicants’ CVs, customer e-mails and the content of contracts into language models — in most companies without a rule, without a contract with the provider and without management knowing about it.
When the provider is a processor
If the tool processes personal data on your behalf, you need a contract under Article 28 and you need to know where the data is stored.
The legal basis is missing
An applicant’s consent to the processing of their CV does not, as a rule, cover pasting it into a third-party tool.
A ban is not the answer
A blanket ban gets worked around. What works is a clear rule, an approved tool and training — and training is also the simplest way to show the measures to improve AI literacy that Article 4 of the AI Act requires (what applies today).
Legal position verified as of 20 October 2026. With legal content, an outdated article is worse than none — if you find a discrepancy, write to us at info@iosec.eu.
Tell us what you are dealing with.
Thirty minutes with a consultant who knows your industry. The output is a one-page summary with a recommended approach and an indicative scope — we send it to you even if we do not reach an agreement.