The EU AI Act is no longer a distant regulatory milestone, it is an active compliance obligation. Prohibitions took effect from February 2025, transparency rules are being phased in through 2026, and enforcement bodies are already operational.
According to Theta Lake, for organisations that have rolled out AI-powered collaboration tools such as copilots, meeting summarisers and chatbots, the gap between current practice and legal requirement already exists.
The regulation applies a risk-based structure, sorting AI systems into prohibited, high-risk, transparency-obligated and minimal-risk tiers. Most workplace AI tools, including generative assistants embedded in platforms such as Microsoft Teams Copilot, Zoom AI Companion and Webex AI Assistant, fall under Article 50’s transparency requirements.
This means users must be told when they are interacting with AI, and any synthetic content must be clearly labelled.
Some HR and financial services use cases, including recruitment screening and performance evaluation, are classified as high-risk and face stricter obligations around conformity assessment, oversight and logging.
Recordkeeping presents a particular challenge. The Act does not set a fixed retention period, but it does require organisations to evidence that disclosures were made and oversight mechanisms were active.
That places AI-generated transcripts, summaries and copilot outputs in the same category as regulatory records, rather than disposable productivity by-products.
Compliance teams must reconcile this against GDPR’s data minimisation principles, alongside sector-specific rules such as SEC Rule 17a-4, FCA COBS and MiFID II, creating a multi-framework burden that a single retention policy cannot solve alone.
A practical governance path is built around four phases: first, a full audit of every AI tool active across the organisation’s collaboration stack, including shadow AI; second, automated, logged disclaimers delivered consistently across chat, voice and video; third, selective capture of AI interactions paired with automated PII redaction at the point of ingestion; and fourth, forensic-ready logging that supports policy violation detection, model drift monitoring and legal hold obligations extended to AI-generated content.
For compliance and digital workplace leaders, the message is straightforward: manual, inconsistent disclosure processes will not satisfy regulators, and neither blanket retention nor blanket deletion of AI records is defensible. The organisations best placed for supervisory scrutiny will be those that treat AI governance as core infrastructure rather than an afterthought.
Read the full Theta Lake post here.
Copyright © 2026 FinTech Global
The following investor(s) were tagged in this article.