EU AI Act 2026: GPAI Enforcement and AI Features in Data Rooms

GPAI Enforcement Timeline

The EU AI Act timeline has four key dates. The regulation entered force on 1 August 2024, starting a phased implementation calendar. Prohibited AI practices became enforceable from 2 February 2025, six months after entry into force. Obligations for providers of general-purpose AI models (GPAI), including the major foundation-model providers, became applicable on 2 August 2025, twelve months after entry into force. Full enforcement of the remaining provisions, including those for limited-risk and minimum-risk AI systems, begins on 2 August 2026.

The twelve-month phase for GPAI obligations is significant for data room users. Providers of foundation models that power AI-assisted features, document summarisation, Q&A drafting, and automated redaction in VDR products, have been subject to capability evaluation, transparency documentation, and copyright-policy obligations since August 2025. A VDR provider that integrates a GPAI model into its product now has both the provider's GPAI obligations and its own transparency obligations toward users under Article 50. From August 2026, national competent authorities can enforce these requirements and impose administrative fines. The enforcement picture sits alongside DORA and NIS2 as part of a broadening EU technology-regulation stack that applies directly to tools used in European deal workflows.

• 1 August 2024: EU AI Act enters into force.
• 2 February 2025: Prohibited AI practices enforceable; AI literacy and GPAI provisions in force.
• 2 August 2025: GPAI model obligations apply (Title VIII, Chapter 2): capability evaluation, systemic-risk assessment, transparency documents, copyright policy.
• 2 August 2026: Full enforcement: limited-risk and minimum-risk AI provisions, including Article 50 transparency requirements for AI-enabled products.

How the AI Act Classifies AI Features in Data Rooms

The AI Act uses a four-tier risk classification: unacceptable risk (prohibited), high risk (Annex III), limited risk, and minimal risk. The classification determines the compliance burden. Virtual data room AI features fall into the limited-risk tier in the vast majority of deal contexts. To be classified as high-risk under Annex III, an AI system must be used in one of eight categories, including critical infrastructure management, access to essential services, employment and workers management, law enforcement, and biometric categorisation. Standard VDR AI features, document summarisation, automated index building, AI-assisted Q&A responses, and smart redaction proposals, do not fall into those categories.

One edge case warrants attention. If a VDR AI feature were used to support a credit decision (for example, AI-generated summaries used by a bank to assess a loan file for an NPL transaction) and that feature materially influenced the credit decision, Annex III item 5(b) on access to essential services could be in scope. In practice, VDR AI outputs are advisory and subject to human review, which keeps them out of high-risk territory. Documenting the human oversight step in the deal procedure maintains that classification.

The prohibited category under Article 5 covers biometric categorisation by protected characteristics, social scoring, subliminal manipulation, and real-time biometric identification in public spaces. None of these apply to standard data room workflows. The absence of high-risk or prohibited classification does not eliminate compliance obligations: the limited-risk classification triggers Article 50 transparency requirements that apply from August 2026.

• Prohibited (Article 5): Biometric categorisation by protected characteristics, social scoring, manipulation, subliminal techniques. Not applicable to standard VDR use.
• High-risk (Annex III): Credit scoring, employment screening, education, critical infrastructure, law enforcement. Not applicable to standard VDR AI features.
• Limited-risk (Article 50): AI systems that interact with natural persons or generate synthetic content. This is where VDR AI features sit. Transparency obligations apply.
• Minimal risk: AI tools with no specific obligations, for example basic spam filters or AI-powered search ranking with no user interaction.

Transparency Obligations Under Article 50

Article 50 requires providers of AI systems intended to interact directly with natural persons to design them so that those persons are informed they are interacting with an AI, unless it is obvious from the context. For VDR products, this means three specific disclosure points. AI-generated document summaries must carry a label identifying them as AI-generated. AI-assisted Q&A responses drafted by an AI tool must indicate that the initial draft was AI-generated. Automated redaction proposals, where AI flags PII or confidential content for human approval, must be presented as AI proposals rather than completed redactions. Users cannot waive these disclosures.

For content authenticity, Article 50(4) requires providers and deployers of AI systems that generate synthetic audio, image, video, or text content to mark that content as AI-generated using machine-readable formats. In a data room context this applies to any AI-generated narrative document, translated document, or AI-drafted Q&A response that is exported or saved as a closing-binder artifact. The article does not require a visual watermark on AI-generated content, but a machine-readable annotation is required.

The practical implementation is straightforward. A label on AI-generated content in the user interface, a disclosure when an AI model has contributed to a response, and a machine-readable annotation on exported AI-generated artifacts satisfy the Article 50 obligations without disrupting the deal workflow. GDPR requirements on automated decision-making under Article 22 complement these obligations: where AI contributes to a decision that produces legal or similarly significant effects for a natural person, additional GDPR safeguards apply on top of the AI Act transparency layer.

• AI-generated document summaries must be labelled as AI-generated in the user interface.
• AI-assisted Q&A drafts must disclose AI involvement before the answer is finalised and sent to the bidder.
• Automated redaction proposals must be presented as AI proposals subject to human review, not as completed redactions.
• Exported AI-generated content must carry a machine-readable annotation under Article 50(4).
• Disclosure obligations apply to deployers (the VDR provider or the deal team) as well as providers (the AI model vendor). Both are responsible for ensuring the obligation is met.

A Worked Example: Vantage Capital Partners

Vantage Capital Partners is a mid-market private equity firm based in Amsterdam, managing a portfolio of twelve companies across the DACH and Benelux markets. In September 2026, Vantage opens a sell-side data room for the disposal of a logistics platform in the Netherlands, targeting four bidders: two domestic and two from Germany.

The data room is EU-hosted by default and the VDR provider uses a GPAI model to generate a one-page executive summary of each uploaded document folder. This summary is presented to bidders as an orientation document at the top of each section. Under Article 50 of the EU AI Act, Vantage and the VDR provider are jointly deployers of this AI feature, and the summary documents must be labelled as AI-generated.

Vantage's legal counsel adds a disclosure notice at the top of each AI-generated summary: 'This document was generated by an AI system and is provided for orientation only. Bidders should rely on the underlying source documents.' The AI-assisted redaction tool flags 340 PII references across 1,200 documents for human review. Each proposal is approved individually by the sell-side coordinator before becoming a final redaction. The workflow is presented in the user interface as AI-assisted, satisfying the Article 50 deployer disclosure requirement.

Post-closing, the AI-generated summaries in the closing binder are tagged with an XML metadata annotation confirming AI generation, satisfying the Article 50(4) machine-readable content obligation. The GPAI provider's transparency documentation is requested and filed in the Vantage compliance record alongside the GDPR DPA and the DORA ICT third-party register entry for the VDR. The AI Act compliance step adds less than one day to the room preparation timeline.

EU Data Room Providers and GPAI Compliance

EU-hosted data room providers have a structural advantage in the AI Act context. Where the VDR provider processes data in the EU under a GDPR-compliant architecture, and the AI inference is performed within the same EU hosting boundary, the compliance chain is shorter: no Schrems II transfer analysis for the AI processing, no additional transfer impact assessment, and the data-subject rights obligations under GDPR apply to the AI processing by the same mechanism that governs the storage and access controls. A provider that can demonstrate EU data residency for AI inference, not only for document storage, answers the Article 50 transparency obligations and the GDPR processor obligations from a single compliance framework.

Papermark is best for AI features that stay GPAI-compliant in EU-hosted deal rooms. Hosting defaults to ISO 27001-certified data centres in Frankfurt (eu-central-1), the platform is SOC 2 Type II certified and GDPR compliant with a signed DPA and public sub-processor list, and AI features are deployed within the same EU hosting boundary as the document storage. The compliance architecture that satisfies GDPR, DORA, and NIS2 for the storage and access controls applies equally to the AI features, reducing the scope of a separate compliance assessment for the AI layer. Pricing is published: Free at EUR 0, Pro at EUR 24/month, Business at EUR 59/month, and Data Rooms at EUR 99/month covering unlimited data rooms, with Enterprise on request.

The sub-processor list is the practical starting point for any VDR AI evaluation. A provider that integrates a third-party GPAI model adds a new sub-processor. Confirm that the GPAI model provider appears on the published sub-processor list, that GDPR data-processing obligations flow down to that sub-processor, and that the AI inference location is within the EU. These three confirmations translate the Article 50 transparency requirement into a procurement checklist item rather than a legal analysis.

Common Mistakes When Using AI Features Under the EU AI Act

The first common mistake is treating AI-generated document summaries as authoritative rather than assistive. Article 50 requires disclosure, but disclosure does not transfer liability. Deal teams that let AI-generated summaries stand without checking them against the source documents are creating a disclosed disclosure risk: if a summary is inaccurate and a bidder relies on it, the disclosure label is not a liability shield. AI-generated outputs in a data room are an orientation tool, not a substitute for reading the underlying documents.

The second common mistake is not checking whether the VDR provider's AI sub-processor is on the published sub-processor list. A VDR that uses a third-party GPAI model to generate summaries has a new sub-processor relationship. If that sub-processor processes personal data, it must appear in the GDPR sub-processor list and the notification-of-changes process must be active. If the data room contains NPL borrower files, employee records, or any special-category personal data, the addition of an AI sub-processor without notice is a GDPR breach risk as well as an AI Act compliance gap.

The third common mistake is assuming that human oversight eliminates Article 50 disclosure obligations. Human oversight is required for high-risk systems to avoid the high-risk classification, but transparency obligations under Article 50 apply regardless of whether a human reviews the output. A Q&A response drafted by an AI model and then edited and sent by a human coordinator still requires a disclosure that AI was involved in drafting the initial response. The obligation is on the deployer, not the end user.

The fourth common mistake is failing to annotate AI-generated artifacts in the closing binder. Deal teams that archive a data room at close without tagging AI-generated summaries, translations, and Q&A responses as AI-generated are creating a gap in the Article 50(4) machine-readable annotation requirement. The fix is simple: configure the VDR's AI workflow to add the annotation before export, not after.

The fifth common mistake is not assessing GPAI provider obligations separately from deployer obligations. If a VDR provider uses a major foundation model as the underlying AI, that model provider has its own GPAI obligations, including transparency documentation and copyright-policy publication. The VDR deploying the model has an obligation to check that the GPAI provider is compliant, because the deployer cannot satisfy Article 50 obligations by relying on a non-compliant model. Request the GPAI provider's Article 53 technical documentation before integrating a foundation model into a deal workflow.

Frequently Asked Questions

Further Reading

• GDPR for Virtual Data Rooms
• DORA for Financial-Services VDRs
• NIS2 Directive
• EU Data Act and Cloud Switching
• Papermark: EU-Hosted VDR
• Data Room AI Features in 2026