DeepL Under the EU AI Act: Machine Translation Is Minimal-Risk
DeepL machine translation is minimal-risk under the EU AI Act — translation is not an Annex III use. The real layer is GDPR and confidentiality.
DeepL — machine translation and writing assistance — is a minimal-risk use under the EU AI Act, Regulation (EU) 2024/1689. Translating text is not one of the high-risk uses in Annex III, so no high-risk obligations attach. For most organisations the real considerations are not the AI Act at all, but GDPR and confidentiality.
Why translation is minimal-risk
Article 6(2) makes a system high-risk only where its purpose sits in Annex III — and translation is not on that list. It does not decide anyone's job, credit, or access to a service. So DeepL is minimal-risk, with no mandatory AI Act obligations. The Act's one cross-cutting duty, Article 4 AI literacy (in force since 2 February 2025), applies: staff should understand that machine translation can mistranslate, especially for legal or safety-critical text, and have important translations reviewed.
The real layer: GDPR and confidentiality
When you paste personal data or confidential material into a translation tool, GDPR applies regardless of the AI Act tier: you need a lawful basis and, typically, a data processing agreement with the provider. Check which DeepL tier you use — business and API tiers carry a DPA and stronger data controls. Do not feed special-category data (GDPR Article 9) or confidential client material into a free consumer tier without checking the terms. This is an information-governance question the AI Act leaves to the GDPR.
When could translation touch the AI Act more?
Two edges. If translation output is embedded in a customer-facing chatbot, the chatbot (not the translation) may carry an Article 50(1) disclosure that the user is interacting with AI. And if a translation feature is built into a genuinely high-risk system — say, translating content within an Annex III process — the classification attaches to that system, not to DeepL. On its own, translation stays minimal.
Provider or deployer?
You are a deployer under Article 26; DeepL is the provider of the translation system and carries any GPAI obligations for its underlying models. The Article 25 flip would require you to substantially modify or rebrand it into your own product, or repurpose it into a high-risk use.
Timeline and penalties
Article 5 prohibitions and Article 4 literacy are in force since 2 February 2025; GPAI since 2 August 2025; Article 50 transparency from 2 August 2026 (relevant only at the chatbot edge). High-risk Annex III is not engaged by translation itself. Penalties under Article 99 (€35M/7%, €15M/3%, €7.5M/1%, with the Article 99(6) SME cap) bite only where an obligation exists — which, for plain translation, they do not.
Worked example: a 50-person legal-services firm
Verrcken & Vos, a 50-person legal-services firm, uses DeepL to translate documents across EU jurisdictions. The classification is minimal-risk under the AI Act — Article 4 literacy and a reminder that machine translations of legal text need a human review. The substantive control is GDPR: the firm uses DeepL's business tier with a DPA and forbids pasting client personal data into the free web tool. The AI Act adds little here; the data-protection discipline is the point.
How Confir helps
Confir records DeepL as a minimal-risk tool, notes the Article 4 literacy duty, and flags the GDPR and confidentiality controls that actually govern translation inputs — plus the chatbot edge where Article 50 could apply. The engine is deterministic and rule-based.
Frequently asked questions
Is DeepL high-risk under the EU AI Act?
No. Machine translation is not an Annex III use case, so DeepL is minimal-risk. The Act imposes no mandatory obligations on it beyond Article 4 AI literacy. The more important considerations are GDPR and confidentiality of what you put into it.
Can we paste personal data into DeepL?
That is a GDPR question. You need a lawful basis and usually a data processing agreement with the provider; business and API tiers typically include a DPA, while free consumer tiers may not. Avoid special-category data without checking the terms. The AI Act tier does not change these obligations.
Does DeepL trigger Article 50 transparency?
Not on its own. Article 50 can apply where translation sits inside a customer-facing chatbot — the chatbot carries the disclosure that the user is interacting with AI. Plain document translation has nothing to disclose.
Could DeepL be part of a high-risk system?
Only if it is embedded in one. If a translation feature operates inside an Annex III process, the high-risk classification attaches to that system, not to DeepL. Used on its own for translation, it stays minimal-risk.
Who carries the GPAI obligations?
DeepL, as the provider of its models, under Articles 51–55 — not you as a deployer. Your duties are Article 4 literacy and your GDPR controls.
Related guides
- How AI risk classification works
- Article 50 transparency obligations
- Article 4 AI literacy
- Provider versus deployer roles
- Build your AI system inventory
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →