Where can I use AI, and where do I need to be careful?

Everyday uses: go ahead, with care

Many valuable uses of AI are ordinary office work: drafting emails and reports, summarising long documents, searching your own knowledge, translating, preparing meeting notes and analysing spreadsheets. Under the EU AI Act, uses like these carry no specific duties beyond supporting your staff's AI literacy (Article 4) and the transparency rules where they apply.

The risks here are practical rather than legal: wrong answers, and data pasted into the wrong tool. Use approved business tools, follow your data rules, and have a person check anything that leaves the building.

Would it help to sort your planned AI uses into go, careful and stop? Book a free AI Value Briefing and we will look at it with you.

What is banned in the EU

Article 5 of the EU AI Act bans these practices, in plain words:

• Manipulating people with hidden or deceptive techniques in ways likely to cause significant harm.
• Exploiting people's age, disability or social or economic situation in ways likely to cause significant harm.
• Scoring people on their social behaviour or personal traits, leading to unfair treatment.
• Predicting that someone will commit a crime based only on profiling or personality traits.
• Building facial recognition databases by scraping images from the internet or CCTV.
• Inferring emotions of people at work or in education, except for medical or safety reasons.
• Using biometrics to deduce race, political opinions, union membership, religion, sex life or sexual orientation.
• Real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions.
• From 2 December 2026, creating realistic intimate images of a real person without consent, or child sexual abuse material.

High-risk areas: allowed, with conditions

Annex III of the EU AI Act lists high-risk uses. For businesses, the main ones are:

• Recruitment and work: screening applications, evaluating candidates, and decisions on promotion, dismissal or task allocation.
• Credit: assessing creditworthiness or credit scores (fraud detection is excluded).
• Insurance: risk assessment and pricing for life and health insurance.
• Education: admission, grading and proctoring tests.
• Critical infrastructure: safety components for digital infrastructure, road traffic, water, gas, heating and electricity.

These uses are allowed, but the people using them must give oversight to trained staff, keep logs, inform workers' representatives before use at work, and tell people when such a system is used in decisions about them. Similar areas attract attention outside the EU too; see our article on US rules.

Sensitive data needs extra care

Under the EU General Data Protection Regulation (GDPR, Article 9), some personal data is "special category" data: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify someone, health data, and data about sex life or sexual orientation. Processing it is only allowed under specific conditions.

Before putting this kind of data into any AI tool, check with your data protection officer. Often a task can be done with made-up or anonymised examples instead.

Customer-facing AI: be open

In the EU, Article 50 of the AI Act asks that people know when they are talking to an AI system, unless it is obvious, and that deepfakes are disclosed. A short line such as "You are chatting with an AI assistant; a person can take over" is a sensible habit wherever you operate. Give customers an easy way to reach a person.

This is general information, not legal advice.

Goes deeper in our free AI Field Guide: 9. Checking AI output before you use it, 10. Data safety: what never to paste, and other rules, 26. Guardrails and permissions: what AI may and may not do. Ask for these guides.