Writer Under the EU AI Act: Minimal Risk, With Two Caveats

Minimal risk. That is where Writer, the enterprise generative-writing platform, sits for almost every team that uses it — because enterprise content generation is not an Annex III high-risk use case.

The two caveats are narrow and predictable. First, Article 50 transparency attaches only when Writer's output goes out customer-facing or published — not when staff draft internal documents. Second, GDPR governs whatever personal data you put into the platform, regardless of risk tier. Behind both sits the rule that decides everything in this regulation: you classify by use, not by tool. This page walks that classification and shows where the two caveats actually land.

---

What Writer Is — and Who Carries What

Writer is a generative AI platform aimed at enterprises, built on its proprietary Palmyra family of large language models (including reasoning and industry-specific variants). It offers an assistant, an agent-building studio, a company Knowledge Graph that grounds generation in an organisation's own data to reduce invented output, and a governance stack — SSO, role-based access, audit logs, observability. Teams use it to draft documents, generate internal content, build internal agents, and standardise on a brand voice.

Two roles under the Act:

• Writer is the provider of the AI platform and of the Palmyra GPAI models. It carries the GPAI obligations (Article 53 for all GPAI providers; Articles 51, 52, 55 if a model is classified systemic-risk) and the product-side duties, including giving deployers the information they need to comply.
• Your organisation is the deployer (Article 26). Your duties scale with use — and for general writing and productivity work, the scope is minimal.

"Is Writer high-risk?" is the wrong question. The Act has no list of high-risk tools; it has a list of high-risk uses (Annex III). A drafting and productivity platform is not on it.

---

Why Writing and Productivity Use Is Minimal Risk

Annex III's eight high-risk areas are biometrics, critical infrastructure, education, employment, essential private and public services, law enforcement, migration, and justice. Drafting reports, generating internal documentation, summarising material, building an internal knowledge assistant — none of these is an Annex III use case.

That keeps the baseline at minimal risk: no Article 11 technical documentation, no Article 43 conformity assessment, no Article 49 registration. Where teams should pause is only if they wire Writer into a genuinely high-risk workflow — for example, generating the substantive content of decisions that screen job applicants (Annex III point 4) or evaluate students (Annex III point 3). It is the workflow, not the writing tool, that would carry the high-risk classification then — and that is an unusual deployment, not the default.

---

Caveat One: Article 50 — Only When It Goes Out

Internal drafting triggers no transparency duty. The Article 50 regime is about what reaches other people:

• If Writer powers a customer-facing chat agent, Article 50(1) requires you to tell users they are interacting with an AI system unless it is obvious. This applies from 2 August 2026.
• If you publish AI-generated synthetic content, Article 50(2) puts a machine-readable marking duty on the provider (Writer), and Article 50(4) requires the deployer to disclose deepfakes and certain public-interest synthetic text. The content-marking and watermarking obligations carry a 2 December 2026 application date — note this is earlier than the general Article 50 date.

A draft a person edits and signs off before it leaves the building is not "published synthetic content" in the sense the marking duty targets. The line is publication, not generation. A breach of Article 50 sits in the €15,000,000 or 3% tier (Article 99(4)); SMEs and start-ups get the Article 99(6) lower-of cap.

---

Caveat Two: GDPR on the Data You Enter

This is the caveat that applies to everyone, every day. Whatever you type into Writer — or let its Knowledge Graph ingest — can include personal data, and GDPR then applies regardless of AI Act tier.

You need a lawful basis (GDPR Article 6) and, in practice, a data processing agreement with Writer covering the data your team submits. Do not feed special-category data (GDPR Article 9 — health, ethnicity, religion, trade-union membership, and so on) into prompts or the Knowledge Graph without a specific legal ground. Set a data-handling policy that tells staff which categories of information they may not submit, and review it when you add new use cases or connect new data sources. Writer's enterprise governance controls (access controls, audit logs) help you enforce that policy, but they do not replace having one.

Alongside GDPR, Article 4 AI literacy has applied to all AI since 2 February 2025. Staff using Writer should understand, at a level appropriate to their role, what the platform can do and where it can be wrong — generative output can read as authoritative while being incorrect, so a human verifies before anything consequential goes out.

---

Worked Example: A 120-Person SaaS Company

Vindkraft Software AS, a 120-employee B2B SaaS company, ~€22M turnover, rolls Writer out across product, marketing and support. Product managers draft internal specs; marketing drafts blog posts; support builds an internal answer assistant on the Knowledge Graph; and one team wires Writer into a customer-facing help chat.

Classifying each use:

• Internal specs and the support knowledge assistant — minimal risk. The only live obligations are GDPR on any personal data entered and an Article 4 literacy baseline.
• Marketing blog posts that get published — minimal risk, with a limited-risk overlay. From 2 December 2026 the published synthetic content must carry the Article 50 marking, applied by Writer, plus a short disclosure where a piece is wholly AI-generated.
• The customer-facing help chat — limited-risk transparency. From 2 August 2026 it must disclose it is an AI system; Vindkraft adds the line now.

No Annex III exposure, no conformity assessment, no registration. The work that matters: a GDPR data-handling policy covering what staff may submit, the two Article 50 disclosures, and a literacy record. The high-risk question only arises if a team later builds Writer into an HR-screening or student-assessment flow — which Vindkraft does not.

---

How Confir Helps

Add Writer to your register in Confir and the rule-based engine asks how each team uses it — internal drafting, published content, a customer-facing agent, or a decision flow — and derives the tier from those answers rather than the brand. It confirms the minimal baseline, surfaces only the Article 50 disclosures that apply, flags the GDPR data-handling requirement, and records the Article 4 literacy obligation. If a use ever crosses into an Annex III workflow, the engine raises the full deployer stack for that specific system. Same intake, same finding, every rule legible.

---

Frequently Asked Questions

Is Writer high-risk under the EU AI Act?

No, not for ordinary use. Enterprise writing and productivity — drafting documents, generating internal content, building a knowledge assistant — are not Annex III use cases, so Writer sits at minimal risk for a deployer. There is no conformity assessment, no Article 11 technical documentation, and no EU-database registration. The classification only changes if you build Writer into a genuinely high-risk workflow, such as generating the content of decisions that screen job applicants or evaluate students. Classify by use, not by tool.

When does Article 50 apply to Writer output?

Only when output goes customer-facing or gets published. If Writer powers a customer-facing chat agent, Article 50(1) requires you to disclose that users are interacting with AI, from 2 August 2026. If you publish AI-generated synthetic content, Article 50(2) puts a machine-readable marking duty on Writer and Article 50(4) requires you to disclose deepfakes and certain public-interest text — with a 2 December 2026 application date for content marking. Internal drafts a person edits and signs off do not trigger these duties.

What are my GDPR obligations when using Writer?

GDPR applies to any personal data you type into Writer or let its Knowledge Graph ingest, regardless of AI Act risk tier. You need a lawful basis (GDPR Article 6) and a data processing agreement with Writer. Do not submit special-category data (GDPR Article 9 — health, ethnicity, religion, trade-union membership) without a specific legal ground. Set a data-handling policy telling staff which information they may not enter, and use Writer's access controls and audit logs to enforce it.

Do I have to deal with the GPAI obligations for Palmyra?

No. Writer builds and provides the Palmyra models, so the GPAI obligations sit with Writer: Article 53 for all GPAI providers, and Articles 51, 52 and 55 if a Palmyra model is classified systemic-risk. As a deployer of the Writer platform, those are not your duties. Your responsibilities are the Article 50 transparency overlay on published or customer-facing output, GDPR on the data you enter, and the Article 4 literacy baseline.

Could using Writer in HR or education make it high-risk?

It could make that specific workflow high-risk — not Writer in general. If you wire Writer into a system that generates the substantive content of decisions screening job applicants (Annex III point 4) or evaluating students (Annex III point 3), that decision system can be high-risk, and the full deployer stack applies to it. That is an unusual deployment. Drafting an internal HR policy document or a training handout with Writer is ordinary minimal-risk use and carries no such weight.

What does Article 4 AI literacy require for Writer users?

Article 4 has applied to all AI since 2 February 2025. It requires that staff who use Writer have a level of AI literacy appropriate to their role — understanding what the platform can do, where it can produce incorrect output, and why a human must verify generated content before anything consequential is published or acted on. It does not require a formal certification for every user; a short, role-appropriate briefing and a record that it happened is the proportionate response for an SME.

What penalty applies if I get the transparency duties wrong?

Breaches of Article 50 transparency duties fall in the €15,000,000 or 3% of total worldwide annual turnover tier, whichever is higher (Article 99(4)). For an SME or start-up, Article 99(6) caps the fine at the lower of the two figures. The top €35M/7% tier is reserved for Article 5 prohibited practices, which enterprise writing does not engage. Because most Writer use is minimal risk, the realistic exposure is limited to the transparency and GDPR layers.

---

Related guides

• minimal-risk AI under the EU AI Act
• limited-risk AI and transparency duties
• Article 50 transparency obligations
• Article 4 AI literacy requirements
• GDPR and EU AI Act crosswalk
• how to classify your AI by risk
• AI system inventory management