The two obligations that actually concern you

For an SME using it with minimal or limited risk, the essentials come down to two points. Both are modest, and the second is very widely overlooked.

1. Transparency

If your customers are talking to a conversational agent, they must be able to understand that it is not a human. One sentence is enough: "You are speaking with an automated assistant. To talk to someone, press 0."

If you publish generated content, images, text, voices, that could be mistaken for authentic, it must be identifiable as such.

This is not just a constraint. A customer who finds out after the fact that they were talking to a machine feels deceived, and you lose far more than the time you saved.

2. Your teams' competence

This is the least-known obligation: organisations must ensure that the people using these systems on their behalf have a sufficient level of competence. This applies regardless of size, and for ordinary uses.

In practice, no certification is expected: serious awareness-raising, a written note on what can and cannot be done, and proof that it has been done.

What you need to write down, and which takes one page

• The tools that are allowed, and those that are not.
• What you never paste in: customer data, confidential information, health data.
• The review rule: nothing goes out without a human having read it.
• Who to contact if in doubt.

One page, dated, given to everyone. That puts you in compliance on the essentials and, above all, avoids the incident that costs dearly.

What changes in high-risk cases

If you use it for recruitment or credit, the bar is much higher: documented human oversight, informing the people concerned, keeping logs. At that stage, get professional support.