EU AI Act: list where your company already uses AI

People hear "EU AI Act" and jump straight to fear, policies, or "does this even apply to us?"

That is the wrong first move.

Because in most real companies, AI is already in the work. Not as a formal project. As ordinary habits.

Someone drafts customer emails in ChatGPT. A document tool starts summarizing contracts. The CRM offers "smart" next steps. An employee pastes a supplier PDF into an assistant because it is faster than reading it twice. A vendor turns on a feature and nobody holds a meeting about it.

That is how AI enters most real companies. Not through a strategy deck. Through ordinary work.

If you run a business in construction, logistics, trades, legal, manufacturing, or property, this probably already happened. You may not call it an AI program. You still have AI in the workflow.

And if you cannot name where it sits, every deeper AI Act conversation is fog.

The first mistake is waiting for a perfect map

A lot of owners freeze here.

They wait for a full policy. Or a lawyer memo. Or a clean answer to "does this regulation apply to us?"

Those things can matter later. They are a bad starting point.

You cannot manage what you cannot see. And right now, in many companies, AI use is half-visible. It lives in personal accounts, browser tabs, vendor defaults, and "just this once" shortcuts.

Make a short list of where AI is already used.

Not a 40-page policy. A list.

What counts as "AI in the business"

Keep this practical. If it helps a person produce text, decisions, summaries, rankings, or recommendations with little manual work, put it on the list.

Examples that usually belong on the list:

• ChatGPT, Claude, Gemini, Copilot for email, offers, reports, or translations
• AI features inside Office, Google Workspace, Notion, or similar tools
• Helpdesk or chatbot replies to customers
• CRM or ERP "suggestions"
• Recruiting tools that screen CVs
• Meeting notetakers that summarize calls
• Image or voice tools used for marketing or documentation
• Any vendor feature labeled smart, auto, assist, or AI

You do not need perfect legal labels yet. You need honesty about usage.

Do this in 15 minutes

Open a note. Write five lines. For each one, fill what you can:

1. Where it is used (customer email, quoting, internal search, HR, accounting)
2. Which tool or vendor
3. What information goes in (customer names, prices, contracts, photos, nothing sensitive)
4. What comes out (draft reply, summary, score, recommendation)
5. Who checks it before it matters

Five rows is enough for a first pass. You are not building a compliance archive. You are turning fog into a picture.

Why this matters before any deeper rule talk

Once the list exists, better questions appear on their own:

• Are we putting customer data into tools we do not control?
• Does anyone check AI output before a customer sees it?
• Is the same task done three different ways by three different people?
• Would the company notice if one person's ChatGPT account disappeared tomorrow?

Those are operating questions. They are useful even if you never open a legal text.

I work with businesses that want AI to help without creating silent mess. The pattern is almost always the same: the tool is not the first problem. Visibility is.

What not to do this week

• Do not copy a generic "AI policy" from the internet and call it done.
• Do not ban every tool in panic, then watch people use them on private phones anyway.
• Do not start with fines, fear headlines, or a 50-page checklist.
• Do not assume "we only use ChatGPT sometimes" means nothing important is happening.

Start with the list.

The point of this series

This is the first piece in a short series for people who run real businesses, not for lawyers and not for AI labs.

Next pieces get more concrete: what changes when rules treat different uses differently, who is responsible when you only use a vendor tool, and how to run a simple inventory properly.

For now, one action is enough.

List five places AI already touches your work.

If you only do that, you are already ahead of most companies that are still arguing about AI in the abstract.

If the list already shows real mess (customer data in random tools, no owner, no check before send), you do not need another generic policy PDF. You need a structured next step.

Official sources

P01 stays practical. When you want the primary texts, use these official EU pages:

• Regulation (EU) 2024/1689 — Artificial Intelligence Act (EUR-Lex)
• European Commission AI Act overview
• AI Act Service Desk / Single Information Platform
• Official implementation timeline

The Act applies progressively. Check the current timeline before you treat any date as fixed in your head.

This is practical orientation, not legal advice. Specific obligations depend on the system, the use, and the facts of your business. Start from the official AI Act text and the Commission resources, not from random blog summaries.