Generative artificial intelligence can save hours on lookup, summarising and drafting tasks, but the company that uses it remains responsible for the data it puts in and for the decisions that come out. The opportunity is real when you know which tools are used, with what information and who reviews the result before it is applied.
Where it adds real value
AI performs best where the problem is finding and organising information that already exists. An engineering firm in Girona whose technicians lose time looking for procedures, or a hotel group in Andorra whose staff ask the same questions about internal protocols every season, are clear cases. It also helps to produce a first draft of an email, a quotation or a report that a person then reviews.
It performs worse, and this is where misuse concentrates, when it is asked for an exact figure without checking it or when the result is used directly to decide about people. A language model can give an answer that is well written and wrong. Our recommendation is that AI acts as a first reader and drafter, and that the final decision is taken by someone with a name.
The most common risk: AI that nobody has authorised
In our view, the most common risk in SMEs comes from spontaneous use, before the AI Act. A member of the team pastes a contract or a customer list into a public chat to summarise it, with the best of intentions. If that tool processes personal data on the company’s behalf, the provider acts as a processor, and the GDPR requires choosing it with sufficient guarantees and regulating the relationship by contract (Article 28). In Andorra, Llei 29/2021 (the qualified law on personal data protection) adds the conditions for international transfers (Articles 42 to 44) if the service is outside Andorra and the EU.
Banning everything rarely works. We find it more effective to offer an authorised tool, with a reviewed contract, and to accompany it with usage rules that fit on one page.
Inventory: which AI uses exist in the company
You cannot classify what you do not know, and the first step is to make a list. Ask each department, look at subscriptions and browser extensions, and do not forget the AI features that have arrived inside tools you already had (office suite, CRM, email). For each use, note:
| Question | Why it matters |
|---|---|
| Which tool and which provider, and where does it process the data? | Processor contract and transfers |
| Who uses it and for what task? | Defines who is accountable |
| What data goes in: personal, customer, confidential? | Sets the legal basis and the risk level |
| Do the results affect people (recruitment, evaluation, credit, access to a service)? | May be high risk under the Regulation |
| Is the output published or shown to third parties? | Transparency obligations |
| Is there human review before it is applied? | Avoids solely automated decisions |
The inventory is also the basis for answering a customer, an auditor or an authority.
How risk is classified under Regulation (EU) 2024/1689
The AI Act sorts uses into four levels, and most companies appear in it as deployers: they use a system that someone else has built.
- Prohibited practices (Article 5). They include subliminal or manipulative techniques that materially alter behaviour, social scoring of people, untargeted scraping of facial images from the internet and inferring emotions in workplaces and educational institutions, except for medical or safety reasons. Fines reach 35 million euros or 7% of worldwide turnover (Article 99(3)).
- High risk (Article 6 and Annex III). Among the areas in the annex are recruitment and the evaluation of candidates, decisions on working conditions, promotion or termination, access to education, creditworthiness assessment and the pricing of life and health insurance. Deployers must follow the instructions for use, assign human oversight to competent people, monitor operation, keep logs for at least six months and inform workers and the people affected (Article 26).
- Transparency (Article 50). People must know that they are talking to an AI system, and synthetic content must be identifiable. Deployers of a system that generates deep fakes must say that they are artificial, and those who publish generated text to inform the public on matters of public interest must disclose it, unless there is human review and editorial responsibility.
- Everything else. These uses have no specific obligations under this Regulation, but the GDPR applies to them and, for staff, so does the measure supporting AI literacy in Article 4.
Fines for breaching the obligations in Article 26 or Article 50 reach 15 million euros or 3% of worldwide turnover, and for SMEs the lower of the two amounts applies (Article 99).
Timetable in force at 25 October 2026
Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal of the European Union on 24 July 2026 and entered into force on 27 July. The dates, now, are these:
| Date | What applies |
|---|---|
| 2 February 2025 | General provisions and prohibited practices; Article 4 on AI literacy |
| 2 August 2025 | Governance, general-purpose models and the penalties regime (except Article 101) |
| 2 August 2026 | General date of application, including the transparency obligations in Article 50 |
| 2 December 2026 | New prohibitions on synthetic intimate images without consent and on child sexual abuse material; deadline for systems generating synthetic content already on the market to comply with Article 50(2) |
| 2 December 2027 | Obligations for the high-risk systems in Annex III |
| 2 August 2028 | Obligations for high-risk systems in regulated products in Annex I |
The Omnibus has also rewritten Article 4: it no longer asks to ensure a sufficient level of AI literacy, but to adopt measures to support it, without requiring a specific level from any person. A recruitment tool chosen today should be able to meet the high-risk obligations in a little over a year.
What applies to an Andorran company that offers services in the EU
The Regulation is not Andorran law, but being in Andorra does not leave a company outside it. It applies to providers placing AI systems on the market in the Union irrespective of where they are established (Article 2(1)(a)) and to providers and deployers in a third country where the output of the system is used in the Union (Article 2(1)(c)). A third-country provider of a high-risk system must appoint an authorised representative established in the EU before placing it on the market (Article 22).
Two typical examples. An Andorran hotel group that uses an AI chat to serve customers from France or Spain must make sure those customers know they are talking to an AI system. An Andorran agency that shortlists candidates for a Barcelona company with an AI tool should check whether the use falls under Annex III, because the results are used in the Union.
Spain has created its own supervisory agency, AESIA (the Spanish Artificial Intelligence Supervisory Agency; Real Decreto 729/2023). In Andorra, the framework we are aware of for personal data is Llei 29/2021, without prejudice to the GDPR where it applies (Article 3(2)).
Personal data remain under the GDPR and Llei 29/2021
AI does not create a separate space outside data protection. The GDPR recognises the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects the person (Article 22). Llei 29/2021 contains an equivalent right for Andorra (Article 25). In practice, if a tool proposes who receives an offer, a credit or an interview, a person must review it and be able to explain the decision.
Control: what to demand of any tool
Before contracting an AI assistant, it is worth having written answers to a few questions. Whether the company’s data is used to train other people’s models. Whether the tool respects the permissions that already exist, so that each person only sees what concerns them. Whether you can tell which documents each answer is based on. And where the service runs and where the data ends up.
We have an interest here and say so: MIA is a private corporate assistant and a BDR Group product. According to the product website, the company’s data does not train public models, access is defined by team, role or area using the company’s identity management, there is traceability of what the answers are based on, and it can be deployed in a private cloud, in a dedicated environment or on-premises. Whatever tools you choose, these are the questions you should ask any provider.
What to do now
- Ask the team which AI tools they use today and with what kind of information, and draw up the inventory.
- Write a one-page usage policy: what may be entered, what may not, and who reviews the results.
- Choose an authorised tool, with the processor contract reviewed, and check where the data is processed.
- Identify whether any use touches decisions about people (recruitment, evaluation, credit) and assign human review to it.
- If the output reaches EU customers, check transparency and organise basic training for everyone who uses it.
Frequently asked questions
If the team uses a public chat, am I breaking any rule?
It depends on what is entered. If personal data goes in without a contract with the provider or a basis for the transfer, there may be a breach of the GDPR or Llei 29/2021.
Does the AI Act already apply?
Yes, in part. The prohibited practices have applied since 2 February 2025 and the general date is 2 August 2026, with the transparency obligations. Those for the high-risk systems in Annex III apply from 2 December 2027, under the 2026 amendment.
Does an Andorran company have to comply with the EU AI Act?
Not as Andorran law, but yes when the output of the system is used in the European Union.
Can I use AI to select staff?
Yes, but Annex III treats such systems as high risk, with obligations from 2 December 2027. In addition, the right not to be subject to solely automated decisions already applies today.
Sources
- European Parliament and Council. Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), Articles 2, 4, 5, 6, 22, 26, 27, 50, 99 and 113 and Annex III. OJ L, 2024/1689, 12/7/2024. Accessed: 25/10/2026. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689
- European Parliament and Council. Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI), Article 1 (amendments to Articles 4, 5, 111 and 113). OJ L, 2026/1744, 24/7/2026. Accessed: 25/10/2026. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32026R1744
- Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 3, 22 and 28. OJ L 119, 4/5/2016. Accessed: 25/10/2026. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679
- Llei 29/2021, del 28 d’octubre, qualificada de protecció de dades personals (Qualified Law 29/2021 of 28 October on personal data protection), Articles 25 and 42 to 44. BOPA no. 119, 17/11/2021. Accessed: 25/10/2026. https://www.apda.ad/assets/pdf/CGL20211115_08_58_32.pdf
- Real Decreto 729/2023, de 22 de agosto, por el que se aprueba el Estatuto de la Agencia Española de Supervisión de Inteligencia Artificial (Royal Decree 729/2023 of 22 August approving the Statute of the Spanish Artificial Intelligence Supervisory Agency). BOE no. 210, 2/9/2023 (BOE-A-2023-18911). Accessed: 25/10/2026. https://www.boe.es/buscar/doc.php?id=BOE-A-2023-18911
Let’s talk about AI in your company
If you want to see how a private assistant can work with your company’s documentation, see the service page: MIA, the private corporate AI assistant