Summary
Primer d.o.o. uses AI in five places and in all of them it is a deployer: it uses systems that others built. Four uses carry light obligations that are already due and take a few days to cover. One, screening job applications, falls in a high-risk area and needs its own preparation before December 2027.
Do first: adopt the AI-use policy and record who has read it; put the disclosure text on the website chatbot; label realistic AI images. Plan: the recruitment tool, with the supplier and a lawyer.
AI tool inventory
| Tool and use | Who uses it | Role | Risk | What applies |
|---|---|---|---|---|
| General AI assistant (business subscription): e-mails, summaries, translations | about 25 staff | deployer | minimal | AI literacy (Art. 4). GDPR: no client personal data without a processing agreement. |
| Website chatbot from a SaaS supplier: answers customer questions | customers | deployer | transparency | People must be told they are talking to AI (Art. 50). Check the supplier's setting, add our text. |
| Candidate ranking in the recruitment platform | HR, 2 people | deployer | high-risk area | Employment is in Annex III. Deployer duties from 2 Dec 2027: human oversight, logs, informing candidates. |
| AI-generated images for social media and the newsletter | marketing, 1 person | deployer | transparency | Realistic images of people, places or events must be labelled as AI-generated (Art. 50). |
| Invoice data extraction in the accounting software | accounting, 6 people | deployer | minimal | AI literacy (Art. 4). A person checks the booking, as today. |
Role and risk class depend on the use, not on the product. The same assistant used to decide about people would move up a class, which is why every row states what the tool is used for.
Gap list and next steps
| # | Gap | Since | Action | Effort |
|---|---|---|---|---|
| 1 | No written rules for using AI; nobody knows who was trained | 2 Feb 2025 | Adopt the attached policy, have staff read it, keep the record | 1 day |
| 2 | The chatbot does not say it is AI | 2 Aug 2026 | Paste the disclosure text below; confirm with the supplier | 1 hour |
| 3 | AI images published without a label | 2 Aug 2026 | Add the label below to realistic images | ongoing |
| 4 | Candidate ranking: unclear who reviews the ranking, whether candidates are told, what is logged | 2 Dec 2027 | Ask the supplier for its documentation and instructions for use; assign a reviewer; legal review | plan in 2027 |
| 5 | Staff paste client data into the general assistant | GDPR, now | Rule in the policy: no client personal data; check the processing agreement | with #1 |
AI-use policy (excerpt)
From the one-page policy, adapted to Primer d.o.o.
1. We use the AI tools on the approved list only. New tools are added by the managing director after a short check.
2. We do not enter clients' personal data, salary data or contracts into general AI assistants.
3. A person checks every AI output before it leaves the company or changes a booking.
4. Customers are told when they talk to AI. Realistic AI images are labelled.
5. Everyone who uses AI reads this policy once a year. The record of who read it is kept by HR.
2. We do not enter clients' personal data, salary data or contracts into general AI assistants.
3. A person checks every AI output before it leaves the company or changes a booking.
4. Customers are told when they talk to AI. Realistic AI images are labelled.
5. Everyone who uses AI reads this policy once a year. The record of who read it is kept by HR.
With it you receive the training record as a table (name, date, version read) and a 20-minute briefing outline for staff.
Disclosure texts, ready to paste
Chatbot, first message (EN)Hi, I am an automated assistant (AI). I can answer questions about orders and deliveries. For anything else, or if you prefer a person, write "person" and a colleague will reply.
Chatbot, first message (SL)Pozdravljeni, sem samodejni pomočnik (umetna inteligenca). Odgovorim na vprašanja o naročilih in dostavi. Za vse drugo ali če želite človeka, napišite "človek" in odgovoril vam bo sodelavec.
Label for AI imagesImage generated with AI. · Slika je ustvarjena z umetno inteligenco.
Dates that apply to Primer d.o.o.
| Date | What | Status |
|---|---|---|
| 2 Feb 2025 | AI literacy (Art. 4) | due, gap #1 |
| 2 Aug 2026 | Transparency (Art. 50): chatbot disclosure, labels on realistic AI images | due, gaps #2, #3 |
| 2 Dec 2026 | Machine-readable marking by providers of generative systems already on the market | supplier's duty, nothing for Primer |
| 2 Dec 2027 | High-risk systems in Annex III, including recruitment | gap #4 |
What this report is not
- Not legal advice and not a certification. No certificate for "AI Act compliance" exists for companies like this one; we recommend that your lawyer reviews the documents.
- It does not assess the supplier's own obligations as provider; it lists what to ask them for.