Notion AI and the EU AI Act: A Deployer's Compliance Guide

Probably not high-risk. For a company deploying it, Notion AI is an embedded productivity assistant — drafting, summarising, translating, answering questions over your own workspace — built on a third-party general-purpose AI model. That activity matches none of the high-risk purposes in Annex III. In normal use it sits at minimal or limited risk, full stop.

This guide is for the deployer, not the model maker. The company that trained the underlying model carries the Chapter V GPAI obligations (Articles 51–55, in force since 2 August 2025); your duties are light — Article 4 AI literacy, light Article 50 transparency, and shadow-AI governance, plus a narrow path that could change the tier. The distinct problem with Notion AI is that it switches on inside everyday editing, so it spreads without a procurement decision.

---

Where Notion AI sits in the risk hierarchy

Ask the right question — not "is Notion AI high-risk?" but "is my organisation's use of it high-risk?" For most workspaces, no. Annex III (read with Article 6(2)) lists the high-stakes purposes that make a stand-alone system high-risk: employment, critical infrastructure, access to credit, education, essential services. Drafting a proposal or summarising a meeting note is none of those — in normal use Notion AI is a minimal-risk tool, the base tier the Act encourages rather than burdens.

The model obligations sit upstream. Under Articles 51–55, in force since 2 August 2025, the model provider carries the technical documentation, training-data summary, and copyright-policy duties. You benefit from that compliance but do not inherit it: role determines obligation, and yours is deployer.

---

What actually triggers an obligation (and what does not)

Minimal risk: everyday workspace use

This covers almost everything teams do — drafting, summarising, translating, Q&A over your own content, autofilling database properties — and carries no conformity assessment, no Article 11 technical documentation, no Annex IV file, no registration.

Limited risk: when AI output reaches third parties (Article 50)

Article 50 transparency bites only where output crosses to people outside your team. Article 50(1) requires telling people they are dealing with an AI system unless that is obvious — relevant where Notion AI powers an external-facing agent. Article 50(2) requires marking machine-generated content as artificially generated, with exceptions for clearly creative or assistive editing — relevant where AI-written articles appear on a Notion-built public site. These provisions have applied since 2 August 2026 (2 December 2026 for marking by generative systems already on the market); purely internal drafting never triggers Article 50.

The narrow path to high-risk — and why it rarely applies

High-risk arises only if a company deliberately repurposes Notion AI output into an Annex III use — wiring it into recruitment or selection screening (Annex III point 4(a)) or into decisions about people already in employment (Annex III point 4(b)). This is a build choice, not how the tool behaves out of the box. Even then, the Article 6(3) filter can take a narrow procedural use back out of scope where it merely improves a completed human activity without influencing the decision — though profiling of natural persons is always high-risk.

---

The three realistic duties for a Notion AI deployer

Article 4: AI literacy for the people who use it

Article 4 AI literacy has applied since 2 February 2025 and binds you regardless of risk tier. Staff should understand, at a level appropriate to their role, what the tool can and cannot do — that summaries can omit, that drafts can fabricate, that output should not be trusted blindly. A short acceptable-use note plus role-appropriate guidance satisfies this; no formal programme is required.

Article 50: disclosure where output is external

If any Notion AI output reaches third parties, add the disclosure — an interacting-with-AI notice, a machine-generated marking, or both. For purely internal drafting it does not apply, so scope the obligation to what it covers rather than inflating an internal tool.

Shadow-AI governance: the duty the Act assumes you already have

This distinguishes Notion AI from a chatbot you procure deliberately. Because it switches on inside everyday editing across the whole workspace, it spreads without a procurement decision — teams use it before anyone has classified it. Yet the Act assumes you know what AI you run, and both Article 4 literacy and any Article 50 disclosure depend on knowing where the tool is used and on what data. List Notion AI once in your inventory, scope which workspaces and data categories it may touch, and decide who can turn it on.

One data-governance caveat sits alongside these: GDPR applies independently of the AI Act, so confirm a lawful basis and a data-processing agreement before staff put personal or special-category data into prompts. For normal use, the whole footprint is an inventory entry, a literacy note, a disclosure rule for external output, and a switch-on policy.

---

Notion AI obligation map by use case

The table maps five common patterns to risk tier, triggered duty, and reference. Most land in minimal or limited risk; only the deliberately built employment-screening row reaches high-risk.

The tier column is the point: minimal and limited dominate, high-risk the outlier you construct on purpose.

---

Worked example: a 140-person company rolling out Notion AI

Marolla Studio, a 140-person product-design and consulting firm in Lisbon, turns on Notion AI across its workspace for drafting client proposals, summarising client calls, and powering a public Notion-built help centre with AI-generated articles, plus an AI Q&A widget for external clients.

Internal proposal drafting and call summaries are minimal risk; Article 4 literacy is the only duty. The public help centre triggers Article 50(2) content marking (in force since 2 August 2026); the external client Q&A widget triggers Article 50(1), the AI-interaction notice. No Annex III purpose is in play, so no high-risk obligations attach. The action list is short: an inventory entry, a one-page literacy note (Article 4), content marking and an interaction notice (Article 50), a data-processing agreement barring special-category data from prompts (GDPR Article 9 layer), and a decision on which workspaces may enable AI.

The counterfactual makes the boundary concrete. If Marolla later wired Notion AI output into automated CV ranking for its own hiring, that single use would become Annex III point 4(a) high-risk and pull in Article 26 deployer duties and an Article 27 Fundamental Rights Impact Assessment — a new, deliberate system, not the rollout described, which stays a half-day inventory-and-policy exercise rather than a conformity-assessment project.

---

Deadlines and penalties — proportionate, not alarmist

The in-force dates here are settled. Article 4 AI literacy and the Article 5 prohibitions apply since 2 February 2025; GPAI obligations (Articles 51–55) since 2 August 2025; Article 50, including content marking, since 2 August 2026 (2 December 2026 for generative systems already on the market).

High-risk timing matters only as a contingency. The Digital Omnibus defers the stand-alone Annex III high-risk deadline to 2 December 2027; it was adopted by the European Parliament on 16 June 2026 and the Council on 29 June 2026, was published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026. The deferral is fixed calendar dates, not the standards-linked "stop the clock" of the Commission's November 2025 proposal.

Article 50 transparency and most deployer-obligation breaches carry fines up to €15 million or 3% of total worldwide annual turnover, whichever is higher (Article 99(4)). Prohibited-practice breaches under Article 5 reach €35 million or 7% of total worldwide annual turnover, whichever is higher (Article 99(3)). Supplying incorrect or misleading information to authorities carries up to €7.5 million or 1% of total worldwide annual turnover, whichever is higher (Article 99(5)). For SMEs and start-ups, each fine is capped at the lower of the percentage or the fixed amount (Article 99(6)). For minimal-risk use there is no fine exposure beyond getting the light Article 50 disclosure right.

---

How Confir helps

List Notion AI in Confir's AI register and answer the intake questions about role, use case, data types, and audience. The deterministic, rule-based engine — no model inference, no hallucination — derives the tier (minimal, Article 50 limited, or the rare Annex III path) and the matching obligation checklist, stating in plain language the rule that fired. The output is a dated, reproducible record of your classification reasoning.

---

Frequently asked questions

Is Notion AI high-risk under the EU AI Act?

No, not in normal use. For a deploying company Notion AI is an embedded productivity assistant — drafting, summarising, Q&A over your own workspace — and that activity matches none of the high-risk purposes in Annex III (Article 6(2)). It almost always sits at minimal or limited risk. It would only become high-risk if you deliberately wired its output into an Annex III use, such as automated recruitment screening (Annex III point 4(a)). The general-purpose model obligations (Articles 51–55) belong to the model provider, not to you as the deployer.

What does a company actually have to do to use Notion AI compliantly?

For ordinary workspace use the footprint is light. Meet Article 4 AI literacy, in force since 2 February 2025, with a short role-appropriate note on what the tool can and cannot do. Apply Article 50 transparency only where AI output reaches third parties — an interacting-with-AI notice or machine-generated marking. List Notion AI once in your AI inventory and decide which workspaces may enable it. Below the AI Act, confirm a lawful basis and data agreement under GDPR before personal data enters prompts. No conformity assessment or technical documentation is required at minimal risk.

When does Article 50 transparency apply to Notion AI output?

Only when the output reaches people outside your team. If Notion AI powers a customer-facing agent, Article 50(1) requires telling users they are interacting with an AI system unless it is obvious. If you publish AI-generated content — for example articles on a Notion-built public help site — Article 50(2) requires marking it as artificially generated, with exceptions for assistive editing or clearly creative work. These transparency and content-marking provisions have applied since 2 August 2026 (2 December 2026 for generative systems already on the market). Purely internal drafting and summarising do not trigger Article 50 at all.

Why is shadow-AI governance the real risk with Notion AI?

Because Notion AI is enabled across the whole workspace and switches on inside everyday editing, it spreads without a procurement decision — teams use it before anyone has classified it. The Act assumes you know what AI you run: Article 4 literacy and any Article 50 disclosure both depend on you knowing where the tool is used and on what data. Listing Notion AI in your AI inventory, scoping which workspaces and data categories it may touch, and deciding who can enable it turns an invisible tool into a governed one. This is good practice rather than a high-risk obligation.

Could using Notion AI ever make us a high-risk deployer?

Only if you build it into an Annex III purpose. The realistic example is feeding Notion AI output into recruitment or selection of candidates, which is Annex III point 4(a), or into in-employment decisions under point 4(b). That is a deliberate new system, not how Notion AI behaves out of the box. If it ever applied, deployer duties under Article 26 and a Fundamental Rights Impact Assessment under Article 27 would attach. The Article 6(3) filter can still take a narrow procedural use out of scope, but profiling of natural persons is always high-risk.

What are the deadlines and penalties we should plan against?

Article 4 AI literacy and the Article 5 prohibitions have applied since 2 February 2025; general-purpose AI obligations since 2 August 2025; Article 50, including content marking, since 2 August 2026. High-risk stand-alone deadlines are settled: the Digital Omnibus defers them to 2 December 2027, adopted by the European Parliament and Council in June 2026, published in the Official Journal on 24 July 2026 and in force since 27 July 2026. Article 50 and deployer breaches carry fines up to €15 million or 3% of worldwide turnover (Article 99(4)); SMEs are capped at the lower figure (Article 99(6)).

---

Related guides

• build your AI system inventory
• detect shadow AI across your workspace
• what limited risk means under Article 50
• Article 50 transparency obligations
• Microsoft 365 Copilot under the EU AI Act