Is what I do with AI legal?

Working with AI on my own systems and on clients' systems, I've asked myself a lot of legal questions, and none of them were answered by a ten-minute video. Here I go over the ones that have genuinely come up and how I've dealt with them, without legalese and with two warnings up front: I'm not a lawyer, this is general information rather than legal advice, and I work in Spain, so the legal examples and bodies I mention are Spanish (under EU rules that apply more widely). Reviewed in September 2026.

The first serious doubt came with a client who asked me to have the assistant summarise their customers' emails to prioritise replies. I had the document open and my hand on the mouse to paste it into the chat when I thought: "wait, am I allowed to do this with other people's data?". I didn't paste it. I went off to read.

Since then I've been piling up down-to-earth questions and answers. I'll say it clearly and without drama: I'm not a lawyer. I'm telling you how I've handled it and in which cases I've preferred to ask someone who is.

What you'll find here are well-framed questions and some practical rules. What you won't find is advice for your specific case; that has its own section at the end of the article.

The short answer to the question in the title, and to whether it's legal to use AI in general: yes. Using these tools in your work or in your company is legal and doesn't require any special permission.

What the law regulates is how you use them: what data you give them, what decisions you use them for and what you do with what they generate. Something being legal doesn't mean it has no consequences.

There are three fronts that organise the rest of the article:

1. Data protection, the GDPR, as soon as you put in information about people.
2. The European AI law, which bans some uses and demands more for others.
3. Copyright, on who owns what's generated.

And a fourth that almost nobody looks at: each tool's terms of use.

Personal data is any information that can identify a person: a name, an email, a phone number, an address, a purchase history, a number plate. Much more than you'd think. A customer's email complaining about an order is full of it.

The question of whether you can use ChatGPT with customer data without breaching the GDPR (or Claude, or whichever) has an answer: you can, but not just any old way. The GDPR, the European data protection regulation, requires any use of personal data to have a legal basis, for people to be informed and for it to be done with safeguards. It's Regulation (EU) 2016/679, applicable since May 2018, and in Spain it's supplemented by Organic Law 3/2018.

It's worth knowing who plays which role. The controller decides what the data is used for: in my projects, almost always the client. The processor handles it on their behalf: me, and also the model provider. When personal data is involved, I go over five things: the legal basis, the processing agreement with each provider, whether the data leaves the European Union (international transfers), how long it's kept and whether the use is high-risk enough to call for an impact assessment.

There's a very widespread confusion: believing it's enough to turn off the option that lets your conversations be used to train the model. It helps, but it doesn't solve everything. The data still leaves your company and is still processed somewhere else.

How I do it:

• I remove names and anything identifying before pasting anything. "Client A" works just as well for almost everything.
• I use business plans with a data processing agreement when I need to work with real data. That agreement is the document stating what the provider can and can't do with what you send it.
• I take the most sensitive material to local models, on my own machines, with Ollama, LM Studio or llama.cpp. I use it for private individuals' documents and for anything involving employee data. It performs worse than a big cloud model, but nothing leaves the house.

That client's case ended like this: emails first go through a local model that replaces names, email addresses and phone numbers with labels; only the cleaned-up text goes to the big model for the summary. On top of that, the client updated their privacy policy to explain the use.

And a clear limit: if health or financial data is involved, talk to a data protection specialist before putting it into any tool.

The European AI law, the AI Act, is Regulation (EU) 2024/1689 and it applies in phases, not all at once. What reassured me most when reading it: for a small business using ordinary tools it asks little, but not nothing. It came into force on 1 August 2024 and distinguishes between the provider, who develops the system and places it on the market (OpenAI, Anthropic and the like), and the deployer, who uses it in their activity. My clients and I are the latter, and that role carries a good deal less.

What applies to you if you only use a chat, an assistant or a customer chatbot:

• Not using it for prohibited purposes, such as manipulating people or social scoring.
• Supporting your people in learning to use it with judgment.
• Being transparent when someone is talking to an AI or receiving content generated by one.

In 2026 a reform, the so-called Digital Omnibus, pushed back the high-risk rules, which include uses such as recruitment, to December 2027, and softened the training obligation: it now speaks of supporting that training, not guaranteeing a level (checked in September 2026). And one thing that confuses a lot of people: you don't have to register or ask permission to use a chat.

Where what I do fits in: the customer service chatbots I've set up for two clients. Transparency applies there: the chatbot says from the first message that it's an automated assistant, and there's a simple way to talk to a person. I don't do anything that makes decisions about people, like screening CVs, and if I'm ever asked to, it will be with someone who knows at my side.

This law keeps changing. The reference body in Spain is the Spanish Agency for the Supervision of Artificial Intelligence (AESIA).

Two questions get mixed up here that are worth separating. One: is what it generates mine? Two: does it look too much like something that already belongs to someone else?

On the first, what I've understood about the copyright of what AI creates: what's generated without a noticeable human creative contribution is usually not protected, because most laws, including Spain's, protect works created by people. If you wrote one sentence and the machine did everything else, it's hard to claim it as your own work. Whether you can use it is another matter, and often you can. And the more you put in (choosing, combining, retouching, rewriting), the more of your own contribution there is. But the answer depends on the case, the country and what the contract with the tool says; there's no single rule.

On the second: a famous character, a brand, a photographer's photo or an artist's highly recognisable style. The machine giving it to you doesn't mean you can use it.

My case: I write the blog texts with the assistant's help, but I review, rewrite and sign them myself; I use generated images as illustration and never imitating a specific artist or with other people's logos. For clients, I explain in writing which part is generated. I apply it to a logo and product photos in My business images, made with AI.

It's ground that's still being decided in courts and legislation. Caution.

Every tool states what you can do with what it produces and what it does with your data, including whether you use it for commercial purposes. I work with Claude, OpenAI, DeepSeek, GLM, Kimi and MiniMax, and for all of them I checked three things: whether I can use what's generated commercially, whether they use my conversations for training and how to turn that off, and where they process the data. I noted it down with a date in a spreadsheet and I still need to go over it again, because these terms change.

Be careful with providers from outside the European Union. A verified example: DeepSeek's privacy policy says it stores the information it collects on servers located in the People's Republic of China (checked in September 2026), and the Italian data protection authority blocked its app in January 2025. That's why I don't work with client data on DeepSeek, GLM, Kimi and MiniMax in the cloud; if I want to use those models with something sensitive, I run them locally.

The ones I apply, each with its reason:

• I never paste passwords, keys or health data into a chat. Once it's out, I don't control where it ends up.
• Client data, only in business accounts with a processing agreement. That's what gives guarantees in writing.
• The most sensitive material stays local. If it doesn't leave, you don't have to justify where it went.
• I tell the client when AI is involved in what I deliver. One line in the proposal is enough; I'd rather they hear it from me.
• I review everything generated before publishing it. If it goes out under my name, the responsibility is mine, not the model's.
• I note down which tool I use for what. If someone asks one day, I want to be able to answer.

There are cases where a blog article, this one included, isn't enough: sensitive data, decisions about people (hiring, firing, granting credit), a brand or a lot of money at stake, or a specific question about your company. I did it once, with a consultation with a lawyer specialising in data protection over that client's emails, and it saved me a lot of going round in circles. Reading helps you ask the right questions, but it doesn't replace someone who knows your case.

If you want to go to the source, the official texts of the GDPR and the AI law are on EUR-Lex, the website of the Official Journal of the European Union, and the Spanish Data Protection Agency (AEPD) publishes practical guides on processing involving AI. They're drier than this article, but they're what counts.