Rules & Security

Rules and rights when you use language models in Europe

The European Union regulates these systems, and the rules already reach people and companies that only use chatbots and models, not just the ones that build them. The guides in this section explain what Regulation (EU) 2024/1689 requires and from when, what its transparency article means for a website with a chatbot or machine-written content, and what you can control and demand when you use ChatGPT. Every claim links to the primary text, such as the regulation on EUR-Lex, the European Commission's guidance or OpenAI's own privacy pages, and carries the date we checked it. We are not lawyers and none of this is legal advice: it is a map of what the sources say.

Where to start

1. Regulation (EU) 2024/1689 timeline is the best overview. The Regulation applies in stages: prohibited practices and staff literacy since February 2, 2025, rules for general-purpose models since August 2, 2025, and most other rules, including transparency, since August 2, 2026. The 2026 Digital Omnibus (Regulation (EU) 2026/1744) moved the high-risk obligations to December 2, 2027 for the systems of Annex III and August 2, 2028 for those of Annex I. The guide also lists the fines: up to 35 million euros or 7% of turnover for prohibited practices and up to 15 million euros or 3% for most other obligations.
2. Article 50 of Regulation (EU) 2024/1689 explained covers the duties that touch most websites. Providers must design chatbots so people know they are talking to a machine unless it is obvious, and must mark generative models output in a machine-readable format. Deployers must disclose deepfakes and label machine-generated text published to inform the public on matters of public interest, unless it has human review or editorial control and someone holds editorial responsibility. Systems already on the market before August 2, 2026 have until December 2, 2026 for the marking duty.
3. Is ChatGPT safe? covers privacy in practice: on individual plans OpenAI says it may use your conversations to train its models unless you switch off "Improve the model for everyone", Business, Enterprise, Edu and API content is not used for training by default, and deleted chats are removed within 30 days. For people in the EEA the controller is OpenAI Ireland Limited, and the guide lists the rights you can exercise.

• What is prompt injection? explains the attack that tops OWASP's 2025 list for LLM applications, the difference between direct and indirect injection, and why the UK NCSC says it can only be reduced, not fixed.
• Open-Weight Model Licenses: Gemma, Qwen, Muse, Llama compares the licenses of Gemma 4, gpt-oss, Qwen3.8, DeepSeek V4, Muse and Llama 4, including revenue thresholds and the EU clause in Llama 4.

Which rules apply to you

Think of three situations. If you are an individual using an assistant, your main questions are about data: what is kept, what is used for training and how to delete it. Our ChatGPT guide answers those, and the pricing guides record the data settings of each plan, for example in Claude pricing. If you run a website, a shop or a newsletter, your questions are about transparency: whether your chatbot must say it is a machine, and whether content you publish needs a label. If you put a model into a product or a business process, you also need to know your role (provider or deployer), whether any of your uses falls in a high-risk category, and what staff training is expected. The staff literacy duty already applies to organizations that use these systems: since February 2, 2025 providers and deployers must take measures to support the staff literacy of their staff, and the 2026 amendment says this does not require guaranteeing a specific level for any individual.

What the rules do not tell you

The Act sets duties, and the details of how to meet them are still being clarified in guidance and technical standards. We therefore separate what the regulation says from what the Commission's guidance says and from our own reading, and we mark the points where the sources are silent. We do not give a verdict on whether a given product is compliant, and we do not summarize national laws that vary between member states. When a decision has legal weight for you, such as a fine, a contract or a regulated sector, ask a qualified professional and use these guides to prepare the conversation.

How these guides stay current

This is one of the fastest-moving topics on the site. The Digital Omnibus changed the calendar in 2026, and guidance from the Commission keeps arriving. Each guide has a review date and lists what may change, and we correct a guide as soon as a primary source does. If you notice a point that is out of date, tell us through the contact page and we will check it against the source.

What to read next

If you are deploying an assistant that talks to customers, read agents for business, which pairs the cost and risk analysis with the EU duties. To understand why the labeling and verification duties exist, see why model hallucinations happen.