{"id":13098,"date":"2026-08-24T08:57:23","date_gmt":"2026-08-24T06:57:23","guid":{"rendered":"https:\/\/mybox.com\/help\/?post_type=manual_kb&#038;p=13098"},"modified":"2026-08-24T08:57:31","modified_gmt":"2026-08-24T06:57:31","slug":"ai-regulation-for-businesses-how-new-rules-affect-products-data-and-employees","status":"publish","type":"manual_kb","link":"https:\/\/mybox.com\/help\/en\/knowledgebase\/ai-regulation-for-businesses-how-new-rules-affect-products-data-and-employees\/","title":{"rendered":"AI Regulation for Businesses: How New Rules Affect Products, Data, and Employees"},"content":{"rendered":"\n<div class=\"translation-block translation-block-merged\">\n<p class=\"wp-block-paragraph\">AI regulation matters for businesses when they use systems that work with personal data or generate content for customers and employees. An AI model is a system trained with data and machine learning techniques to perform specific tasks. It learns patterns, relationships, and rules from training data, then uses that knowledge to analyze new information, make predictions, or generate content. <a href=\"https:\/\/mybox.com\/help\/knowledgebase\/what-is-an-ai-model-core-operational-architectures-and-lifecycle-mechanics\/\">Learn more about AI models<\/a>.<\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_86 ez-toc-wrap-left counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/ai-regulation-for-businesses-how-new-rules-affect-products-data-and-employees\/#When_does_an_AI_system_create_a_regulatory_obligation\" >When does an AI system create a regulatory obligation?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/ai-regulation-for-businesses-how-new-rules-affect-products-data-and-employees\/#How_AI_models_affect_products_and_services\" >How AI models affect products and services<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/ai-regulation-for-businesses-how-new-rules-affect-products-data-and-employees\/#What_businesses_should_check_before_deployment\" >What businesses should check before deployment<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/ai-regulation-for-businesses-how-new-rules-affect-products-data-and-employees\/#Why_transparency_and_human_oversight_matter\" >Why transparency and human oversight matter<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/ai-regulation-for-businesses-how-new-rules-affect-products-data-and-employees\/#Working_with_AI_suppliers\" >Working with AI suppliers<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/ai-regulation-for-businesses-how-new-rules-affect-products-data-and-employees\/#AI_use_by_employees\" >AI use by employees<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/ai-regulation-for-businesses-how-new-rules-affect-products-data-and-employees\/#When_to_obtain_legal_or_specialist_advice\" >When to obtain legal or specialist advice<\/a><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"When_does_an_AI_system_create_a_regulatory_obligation\"><\/span>When does an AI system create a regulatory obligation?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The key starting point is the data and the activity involved. GDPR, the General Data Protection Regulation, governs how personal data is collected, processed, stored, and protected. It applies to organizations that process the personal data of people located within the European Union. GDPR came into effect on May 25, 2018. <a href=\"https:\/\/mybox.com\/help\/knowledgebase\/what-is-gdpr-and-why-must-your-website-be-compliant\/\">Read more about GDPR and website compliance<\/a>.<\/p>\n\n\n\n<\/div>\n\n<div id=\"mybox-2831451750\" class=\"mybox-content mybox-entity-placement\"><div class=\"early-access-banner-inpost\">\r\n  <div class=\"banner-left-inpost\">\r\n    <div class=\"icon-box-inpost\">\r\n      <img decoding=\"async\" src=\"https:\/\/mybox.com\/help\/wp-content\/uploads\/2026\/02\/square-info-icon.svg\" alt=\"Info\">\r\n    <\/div>\r\n    <div class=\"text-box-inpost\">\r\n      <span class=\"label-inpost\"><span class=\"translation-block translation-block-banner-text\">Early access<\/span><\/span>\r\n      <h4><span class=\"translation-block translation-block-banner-text\">Still need help?<\/span><\/h4>\r\n      <p><span class=\"translation-block translation-block-banner-text\">Contact our customer service team.<\/span><\/p>\r\n    <\/div>\r\n  <\/div>\r\n\r\n  <div class=\"banner-right-inpost\">\r\n    <a href=\"https:\/\/panel.mybox.com\/helpdesk2\/v\/list\/\" class=\"banner-button-inpost\"><span class=\"translation-block translation-block-banner-text\">Message us<\/span><\/a>\r\n  <\/div>\r\n<\/div><\/div>\n\n<div class=\"translation-block translation-block-merged\"><p class=\"wp-block-paragraph\">This means that an AI project needs particular care when it uses information that relates to people. The same consideration applies whether the system is an internal tool or a customer-facing service. A chatbot, copilot, automated decision system, or generative AI feature may use an AI model to analyze information, make predictions, or generate content. If personal data is part of that process, the business must account for how that data is collected, processed, stored, and protected.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_AI_models_affect_products_and_services\"><\/span>How AI models affect products and services<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Adding an AI model to a product changes how the product handles information. The model may receive data as input, identify patterns in that data, and return a prediction, analysis, or generated response. The product team therefore needs to understand what information enters the system and what the system produces.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For a chatbot, this may involve customer messages. For a copilot, it may involve information supplied by the employee using the tool. For automated decisions, the model may analyze information and produce a prediction or recommendation. For customer-facing generative AI, the model may generate text or other content in response to user input. These uses should be assessed through the GDPR principles of collecting, processing, storing, and protecting personal data when such data is involved.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_businesses_should_check_before_deployment\"><\/span>What businesses should check before deployment<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A practical review should begin with the system&#8217;s purpose and data flow. The following questions help define the compliance work:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>What task will the AI model perform?<\/strong> Record whether it will analyze information, make predictions, generate content, or support another defined task.<\/li>\n\n\n\n<li><strong>What information will the system receive?<\/strong> Identify whether the inputs include personal data relating to people in the European Union.<\/li>\n\n\n\n<li><strong>How will the information be processed?<\/strong> Establish how the AI feature uses the input to produce an answer, prediction, recommendation, or generated content.<\/li>\n\n\n\n<li><strong>Where is the information stored?<\/strong> Review the points at which personal data is stored and the controls used to protect it.<\/li>\n\n\n\n<li><strong>What does the user need to understand?<\/strong> Make the role of the AI feature clear to the people who provide information or receive generated content, especially where the feature is customer-facing.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Why_transparency_and_human_oversight_matter\"><\/span>Why transparency and human oversight matter<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">AI models learn from training data and apply learned patterns to new information. Their output is therefore produced through analysis of data rather than through a simple fixed rule. Businesses should make the model&#8217;s role clear within the product and identify how people interact with its output.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Human review is especially relevant when an AI output influences an employee, customer, or other person. A business should define who reviews the output and what happens when the result needs correction. The level of review should reflect the role of the AI feature in the product and the type of information it handles.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Working_with_AI_suppliers\"><\/span>Working with AI suppliers<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When an outside supplier provides the AI model or service, the business still needs to understand how its information is handled. The supplier&#8217;s role should be considered as part of the product&#8217;s data flow. Before deployment, confirm what information is sent to the service, how that information is processed, where it is stored, and how it is protected.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This review is important for chatbots, copilots, automated decisions, and generative AI features because each can process information supplied by customers or employees. A supplier assessment should also establish how the business can explain the system&#8217;s use to affected people and how concerns or incorrect outputs are handled.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"AI_use_by_employees\"><\/span>AI use by employees<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Employees may use AI models to analyze information, generate content, or support their work. The business should set clear boundaries for the information employees enter into these systems. Those boundaries should reflect the organization&#8217;s responsibility to protect personal data that it collects, processes, and stores.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Employee-facing AI tools should also have a defined purpose. A system used to generate content has a different function from one used to make predictions or support automated decisions. Naming the purpose helps the business review the data involved, explain the tool&#8217;s role, and decide where human review is needed.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"When_to_obtain_legal_or_specialist_advice\"><\/span>When to obtain legal or specialist advice<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Legal or specialist advice is appropriate before deployment when the AI feature processes personal data, affects customers or employees, supports an automated decision, or relies on an external AI supplier. Advice is also useful when the business cannot clearly describe what data enters the system, how it is processed, where it is stored, or how it is protected.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A documented review should be completed before the AI feature becomes part of a product or workplace process. The review should connect the model&#8217;s purpose with its data use and the safeguards applied to that data. This gives the business a clear basis for deciding whether the planned use is ready for deployment.<\/p>\n<\/div>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"template":"","format":"standard","manualknowledgebasecat":[42],"manual_kb_tag":[],"class_list":["post-13098","manual_kb","type-manual_kb","status-publish","format-standard","hentry","manualknowledgebasecat-miscellaneous"],"_links":{"self":[{"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb\/13098","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb"}],"about":[{"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/types\/manual_kb"}],"author":[{"embeddable":true,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/users\/1"}],"version-history":[{"count":1,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb\/13098\/revisions"}],"predecessor-version":[{"id":13100,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb\/13098\/revisions\/13100"}],"wp:attachment":[{"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/media?parent=13098"}],"wp:term":[{"taxonomy":"manualknowledgebasecat","embeddable":true,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manualknowledgebasecat?post=13098"},{"taxonomy":"manual_kb_tag","embeddable":true,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb_tag?post=13098"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}