AI rules for companies — EU and Slovenia in one place
Which rules apply to your company when you use or build AI, from when, and what to do. Every regulation with its status (in force, coming, proposal), deadlines, plain-language examples and official sources — plus free tools to comply.
What applies to us?
Tick your situations — you get your obligations sorted into “applies now”, “coming with deadline” and “recommended”, with links to the rules and tools. Your choice stays in this browser.
Tick everything that applies to your company:
Tick at least one situation to see your obligations.
The four things that apply to almost every company now
Measures that build the AI skills of staff who use AI (Art. 4 AI Act). No certificate needed; supervision from 2 Aug 2026.
No prohibited AINo emotion recognition of employees, social scoring or manipulation — banned since 2 Feb 2025.
TransparencyChatbots must say they are AI; deepfakes must be labelled — since 2 Aug 2026.
Personal dataGDPR: legal basis and processing agreement before personal data goes into AI; DPIA for AI that evaluates people.
What’s new
Full timeline →- Digital Omnibus (data): the Council agrees its negotiating position — it keeps today’s GDPR definition of personal data. Still a proposal; GDPR applies unchanged. Digital Omnibus (data)
- Slovenia: the Government approves an amendment to the Consumer Protection Act (online purchases, green claims, repairs) — still a bill. Consumer Protection Act (ZVPot-1)
- The Commission consults on AI and copyright until 3 Nov 2026. Copyright and AI
- AKOS publishes guidance on providers’ duty to mark AI-generated audio, images, video and text (Art. 50(2)). AI Act
- Data Act: new connected products must give users access to their data by design. Data Act
- Cyber Resilience Act: manufacturers must now report exploited vulnerabilities and severe incidents to ENISA. Cyber Resilience Act
- GDPR and cookie changes from the Digital Omnibus: still negotiating, no Council mandate — GDPR applies unchanged. Digital Omnibus (data)
- ChatGPT designated a very large online search engine under the DSA. Digital Services Act
- AI Act transparency duties apply: chatbots must say they are AI, deepfakes must be labelled. AI Act
- Digital Omnibus on AI in force: AI literacy becomes an obligation of effort, high-risk rules postponed to Dec 2027 / Aug 2028. Digital Omnibus on AI
- Final Code of Practice on marking and labelling AI-generated content published (voluntary guide for Art. 50). AI Act
- Slovenia adopts its National AI Strategy 2030. National AI Strategy 2030
Everything in one place
Roles, all bans, high-risk areas with examples, transparency, general-purpose AI, AI literacy, what the 2026 Omnibus changed.
→SloveniaZIUDHPUI, who supervises what, ZMed-1, ZVOP-2, ZInfV-1, employment law, the national AI strategy, sandbox and funding.
→All 26 regulationsAI Act, GDPR, Data Act, NIS2, CRA, DORA, product liability, platform work, DSA, copyright … with filters.
→Timeline — 57 datesEvery deadline from 2018 to 2030 in one list, with today marked.
→10 industry guidesHR, finance, health, marketing, retail, public sector, education, manufacturing, software, professional services.
→38 questions and answersChatGPT at work, personal data, chatbots, employees, developers, fines, supervision in Slovenia.
→Free tools
Which risk level your AI uses fall into.
Start the check →🗂️ AI registerList AI tools and uses, get warnings, export to Excel.
Open the register →🎓 AI literacy courseStaff training: 10 lessons, quiz and certificate.
Start the course →📄 AI usage policyA one-page policy for your team.
Create a policy →💬 AI notice generatorChatbot greeting, deepfake labels, privacy clause, “how we use AI”.
Generate notices →🔎 AI vendor questionnaireQuestions to send before you buy, with red flags.
Check a vendor →🛡️ AI impact assessmentDPIA and fundamental rights template with a worked example.
Open the template →🔒 Does AI use our data?Business plans of ChatGPT, Copilot, Gemini, Claude, Mistral compared.
See the comparison →🖨️ One-page summary for managementKey obligations and deadlines — print or save as PDF.
Open the summary →🧹 Clean before AIHides personal data before you paste text into AI — 17 languages, local.
Open the tool →Our free tool replaces names, national and tax IDs, IBANs, addresses and company names with labels such as [PERSON_1] on your own computer before you use ChatGPT, Claude, Gemini or Copilot — then puts the real data back into the answer. 17 languages, uploads nothing, also as a Chrome extension.
10-step checklist for adopting AI
Your progress is saved in this browser only.
Free AI usage policy — generator
Fill in three fields and download a one-page policy for your team.
This template is a starting point, not legal advice. Adapt it to your company and have it reviewed if needed.
# Artificial intelligence usage policy — [COMPANY] Effective: 07/11/2026 · Person responsible for AI: [CONTACT] ## 1. Purpose We use AI tools to work faster and better while protecting client data, trade secrets and trust. This policy applies to all employees and contractors. ## 2. Approved tools Only these tools may be used for work, with company accounts: - ChatGPT (Business / Enterprise) - Microsoft Copilot (work) New tools must be approved by [CONTACT] before first use. ## 3. Data — what we NEVER enter - personal data of clients, employees or partners (names, ID numbers, addresses, health data …), - confidential client information and trade secrets, - passwords, API keys and other credentials, - non-public financial data and contracts, except in tools explicitly approved by [CONTACT]. Allowed: public information, anonymised content, your own drafts without sensitive data. ## 4. Humans stay accountable - A person reviews every AI output before use — especially facts, numbers, sources and legal statements. - AI does not make decisions about people (hiring, evaluation, credit) without a human. - The employee who delivers the work is responsible for it. ## 5. Transparency - We tell customers when they are interacting with AI (e.g. a chatbot). - AI-generated images, video or voice showing real people or events are labelled. ## 6. Training Everyone using AI at work completes basic AI training (AI literacy under the EU AI Act) and refreshes it yearly. ## 7. Incidents If you enter sensitive data by mistake or notice a wrong or harmful output, report it immediately to: [CONTACT]. ## 8. Review This policy is reviewed every 6 months or when a new tool is introduced.
Official sources
- EUR-Lex — AI Act, Regulation (EU) 2024/1689
- EUR-Lex — Digital Omnibus on AI, Regulation (EU) 2026/1744
- European Commission — AI Act Service Desk
- European Commission — AI literacy: questions and answers
- Official Gazette — ZIUDHPUI (in Slovenian)
- Information Commissioner of Slovenia — AI (in Slovenian)
- AKOS — single point of contact for AI
General information, not legal advice — consult a lawyer for borderline cases. Regulations reviewed on 2 Nov 2026.