Grammarly and the EU AI Act: A Deployer's Compliance Guide
Grammarly is a minimal-risk AI writing assistant under the EU AI Act. The real deployer duties: Article 4 literacy, data governance, and one narrow Article 50.
No. A company using Grammarly to draft and edit prose is not running a high-risk AI system, and over-classifying it wastes effort.
Grammarly is an AI writing assistant — grammar, spelling, tone suggestions, and generative rewriting — running on third-party general-purpose models, not a system Grammarly trains in-house to make a regulated decision. For ordinary writing the honest classification is minimal risk: no conformity assessment, no Article 49 registration, none of the Articles 8–15 or Article 16 provider stack. The one duty already in force is Article 4 AI literacy; a single narrow Article 50 scenario can also arise. This page covers exactly those duties, and resists manufacturing a high-risk hook where none exists.
Where Grammarly Sits in the EU AI Act Risk Hierarchy
The EU AI Act, Regulation (EU) 2024/1689, sorts obligations by what a system does, not by what it is called. Grammarly assists a human author who writes prose, edits wording, and asks for a rewrite. That activity does not land in any Annex III category in normal use: there is no recruitment scoring, no creditworthiness decision, no biometric identification, no essential-service triage.
Your role is deployer under Article 26. The underlying general-purpose model obligations (Articles 51–55) sit with the model provider behind the tool, not with you. For a company drafting emails, marketing copy, and internal documents, the practical position is:
- No conformity assessment and no technical documentation under Article 11.
- No Article 49 registration in the EU database, and no risk management system under Article 9.
- The only live obligation for every organisation: Article 4 AI literacy, in force since 2 February 2025.
- One narrow transparency duty under Article 50, covered below.
Everything else here is about doing those few things well — and about the GDPR and confidentiality exposure that is, in practice, the sharper risk.
Why Grammarly Is Not High-Risk in Ordinary Writing Use
Annex III is defined by use case, not tool type — Article 6(2)
Article 6(2) and Annex III define high-risk by use case. Annex III's eight headings cover biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration and border control, and the administration of justice. Assisting a human in writing prose maps to none of them.
Even near a regulated workflow, the Article 6(3) filter applies
Even where edited text eventually touches an HR or lending process, Article 6(3) filters out a system performing a narrow procedural or purely supportive task that does not materially influence the substance of a human decision. A recruiter who runs a rejection letter through Grammarly for tone has not let Grammarly decide the rejection. The assessment must be documented, but ordinary editing almost always lands outside high-risk.
The deadline you should plan against
Stand-alone Annex III high-risk obligations now apply from 2 December 2027, deferred from the original 2 August 2026 by the Digital Omnibus — adopted by the European Parliament (16 June 2026) and the Council (29 June 2026), published in the Official Journal on 24 July 2026 and in force since 27 July 2026. That said, if some future use of Grammarly ever did reach high-risk, plan against 2 December 2027.
The Article 25 trap
The one way ordinary use turns heavier is Article 25: a deployer becomes a provider if it puts its own name or trademark on the system, substantially modifies it, or changes its intended purpose to a high-risk use. Embedding Grammarly's rewriting inside your own branded product that drives a regulated decision crosses that line; drafting and editing your own documents does not. Do not over-classify — over-stating the risk burns scarce compliance time on a tool that warrants a short, proportionate control set.
Article 4 AI Literacy: The One Duty That Already Applies
Article 4 has applied since 2 February 2025. It requires that staff who use AI tools have a level of AI literacy appropriate to their role and the context in which the tool is used.
For Grammarly this is light but real. Users should understand that a generative rewrite can introduce factual errors or smooth over a nuance the author intended: a clause rewritten "for clarity" can change a contractual obligation; a softened paragraph can drop a qualifier that mattered.
Literacy here does not mean a formal course for every user. A short acceptable-use note, plus role-based guidance for staff who publish externally, is proportionate. What matters is that the measure exists and is recorded in the same register you use for other minimal-risk tools — Article 4 is an obligation you cannot satisfy retroactively once a misuse has caused harm.
Data Governance and Confidentiality Over the Text It Processes
The sharpest real-world exposure with Grammarly is not the AI Act tier. It is what leaves your perimeter in the text you submit for checking.
GDPR comes before the AI Act
A professional use that processes personal data needs a lawful basis (GDPR Article 6) and, for a processor relationship, a data-processing agreement and sub-processor coverage (GDPR Article 28) — controls consumer-tier accounts typically lack. Special-category data, such as health notes, disciplinary records, or trade-union membership, engages GDPR Article 9 and should not be pasted into a general writing assistant without a specific legal ground.
Confidentiality is a separate problem from privacy
Contract drafts, unreleased financials, and source code pasted in for a "tone" pass are business-secret leakage even when no personal data is involved. The AI Act is silent on that; your own confidentiality obligations are not.
The practical control is a data-handling policy stating which categories of text staff may not submit, paired with a preference for an administered business tier with retention and training-data controls. That same policy strengthens the Article 4 literacy record.
The One Place Article 50 Transparency Can Bite
Grammarly's grammar and tone corrections are not "AI-generated content" for Article 50 purposes. They assist a human author who remains the author of the text.
The relevant duty is Article 50(4): deployers of AI that generates or manipulates text published to inform the public on matters of public interest must disclose it as artificially generated — with an exception where a human retains editorial responsibility and review. The realistic trigger is narrow. You would have to use generative rewrite to produce substantively machine-written text, then publish it to third parties as if a human had authored it, in a public-interest context such as news commentary.
Ordinary marketing copy, internal memos, and human-edited drafts where a person owns the output do not cross that line. The provider-side content-marking duties under Article 50(2) — synthetic output marked in a machine-readable format — have applied since 2 August 2026 (generative systems already on the market before then have until 2 December 2026 under the Digital Omnibus), and sit with the generative-AI provider.
If in doubt, keep a human editorial owner on anything published externally. That satisfies the Article 50(4) exception and keeps you out of any provider-side marking debate.
Grammarly in Your Shadow-AI Inventory: A Worked Example
The table below contrasts three Grammarly use patterns against their EU AI Act treatment, the live obligation, and the deadline.
| Use pattern | Risk treatment | Live obligation | Deadline |
|---|---|---|---|
| Internal drafting and editing | Minimal risk | Article 4 literacy only | In force since 2 February 2025 |
| Public-interest text that is substantively machine-generated and published as human | Limited risk | Article 50(4) disclosure / human-editor exception | Provider marking since 2 August 2026 (2 December 2026 for systems already on the market) |
| Editing inputs to a regulated HR or credit decision | Assess under the Article 6(3) filter — almost always still not high-risk | Document the assessment | High-risk deadline 2 December 2027 (Digital Omnibus deferral, adopted) |
The worked example. Meridian Freight, a 600-person EU logistics company, runs an expense audit and finds Grammarly installed on 140 endpoints that nobody approved. Staff use it to tidy customer emails, internal reports, and supplier letters. It is textbook shadow AI — but it is not high-risk.
The resolution is measured in hours, not in a conformity programme. Meridian registers Grammarly once in the AI inventory, classifies it as minimal risk with an Article 4 literacy note, attaches a data-handling rule barring customer personal data and contract text, and assigns an owner. That is the entire response.
Note the penalty calibration so nobody panics. Most deployer and transparency breaches sit at €15 million or 3% of total worldwide annual turnover, whichever is higher (Article 99(4)); supplying incorrect information to authorities sits at €7.5 million or 1% (Article 99(5)); companies meeting the SME definition are capped at the lower of the two under Article 99(6).
How Confir Helps
Add Grammarly to the register and Confir's engine runs the same two-step intake it uses for every tool: an Article 5 prohibited-practice check first, then Article 6 / Annex III scoping. For ordinary writing use, the engine returns minimal risk with the Article 4 literacy item and a data-governance prompt — not a manufactured high-risk finding. The rationale is written in plain language tied to the specific Article, so a reviewer can see exactly why Grammarly classified as minimal, and the Article 6(3) reasoning if a borderline use was entered.
The logic is deterministic and rule-based — no model inference, no hallucination — so the same intake yields the same finding. That makes the classification audit-defensible, and fast to apply across a batch of shadow-AI tools in one sitting.
Frequently Asked Questions
Is Grammarly high-risk under the EU AI Act?
No. Grammarly is an AI writing assistant for grammar, tone, and generative rewriting, and ordinary editorial use maps to no Annex III category under Article 6(2). It is minimal risk for a deployer — no conformity assessment, no Article 49 registration. Even where edited text feeds an HR or lending process, the Article 6(3) filter generally excludes a tool performing a narrow, supportive task that does not influence the substantive decision. The one obligation already in force is Article 4 AI literacy, which has applied since 2 February 2025.
What do we actually have to do to use Grammarly compliantly?
Three proportionate things. First, satisfy Article 4 AI literacy (in force since 2 February 2025) — staff should understand that generative rewrites can alter meaning or introduce errors. Second, govern the data: set a policy on what categories of text staff may not submit, and prefer an administered business tier with proper GDPR controls. Third, register Grammarly once in your AI inventory and record the minimal-risk classification. That is a few hours of work, not a conformity programme.
Does Article 50 transparency apply when we use Grammarly?
Only in a narrow case. Grammar and tone corrections assist a human author and are not AI-generated content. Article 50(4) attaches a disclosure duty to AI-generated or AI-manipulated text published to inform the public on matters of public interest — and even then it exempts content where a human retains editorial responsibility and review. So if you keep a human editor who owns externally published copy, the duty does not bite. Provider-side content-marking under Article 50(2) has applied since 2 August 2026; under the Digital Omnibus, generative systems already on the market before then have until 2 December 2026.
What is the real risk — the AI Act tier or the data we paste in?
The data, in most cases. The AI Act tier for Grammarly is minimal, but the text you submit can carry personal data (GDPR Article 6 lawful basis, Article 28 processor terms) or special-category data (GDPR Article 9), and consumer-tier accounts often lack the contractual controls a business tier provides. Confidentiality is separate from privacy: contract drafts, financials, or source code pasted for editing are business-secret leakage even with no personal data involved. Govern this with a clear data-handling policy.
Could using Grammarly ever turn us into a provider?
Only if you go beyond editorial use. Under Article 25 a deployer becomes a provider if it puts its own name or trademark on the system, substantially modifies it, or changes its intended purpose to a high-risk use — for example, embedding generative rewriting inside your own branded product that influences a regulated decision. Drafting and editing your own documents does none of this. The general-purpose model obligations behind the tool (Articles 51–55) sit with the model provider, not with you.
What penalties apply if we get Grammarly governance wrong?
Exposure is modest because the obligations are light. Most deployer and transparency breaches sit at up to €15 million or 3% of total worldwide annual turnover (Article 99(4)); supplying incorrect information to authorities is up to €7.5 million or 1% (Article 99(5)). Companies meeting the SME definition get the lower-of cap under Article 99(6). In practice, the bigger financial risk from a writing assistant is a GDPR breach or a leaked confidential document, not an AI Act fine for a minimal-risk tool.
Related guides
- build your AI system inventory
- ChatGPT classified by use, not by name
- limited-risk obligations explained
- Article 4 AI literacy requirements
- detecting shadow AI in your organisation
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →