AI use cases and related rules

Each use case links to the rules that mention it, its risk classification by jurisdiction and the base documents that cover those topics.

• Employees use generative AI (ChatGPT, Copilot, Gemini…)

  Staff use of generative AI assistants to draft, summarize, translate, analyze or research in daily work, with approved or unapproved tools (shadow AI). The risk lies in the data entered, reliance on wrong outputs and ownership of what is generated.

• Coding assistants

  Tools that suggest, complete or generate source code inside the development environment or through agents. The risks are leaking code or secrets, incompatible open-source licenses, vulnerabilities and ownership of generated code.

• Customer service chatbot or assistant

  Text or voice conversational assistants that serve customers on websites, apps, WhatsApp or call centers. They are already regulated: users must be told they are talking to AI and, in several countries, offered the option of reaching a person.

• Companion or social chatbot

  Chatbots designed to sustain personal relationships or conversations, such as friendship, emotional support or characters. Several US states already require notices, crisis protocols and protections for minors.

• AI agents that take actions

  Systems that, given a goal, plan and execute actions in other tools: sending emails, purchasing, changing records or approving requests. Their risk depends on the permissions they hold and whether they decide about people without human involvement.

• Generated or synthetic marketing content

  AI-generated text, images, video and audio for advertising, social media, catalogs or corporate communications. The risks are misleading the public, infringing third-party rights and making unsubstantiated AI claims.

• Voice or likeness cloning

  Creating digital replicas of real people's voice, face or appearance, such as voice actors, employees, performers or customers. It requires consent and transparency, and using it to deceive or impersonate is penalized in several countries.

• Hiring, evaluation or termination of staff

  Using AI to target job ads, screen resumes, interview, score candidates or evaluate performance, promotions and terminations. It is the use case with the most laws in force worldwide because of its impact on the right to work and the risk of discrimination.

• Algorithmic worker management (shifts, tasks, pay)

  Systems that assign shifts, tasks, routes or pay, set targets or decide incentives and penalties without a supervisor in each case. They affect working conditions, so platform and algorithmic information laws require transparency and human oversight.

• Worker monitoring

  Using AI to track workers' activity, productivity, location, behavior or state through cameras, software or sensors. It clashes with privacy and dignity, so it requires proportionality and prior notice, and in the EU inferring emotions is banned.

• Credit or creditworthiness scoring

  Models that estimate a person's likelihood of default or creditworthiness to approve, deny or price credit. It is high-risk in the EU and Peru and requires explaining denial reasons and allowing human review in almost every jurisdiction.

• Insurance pricing or underwriting

  Models that calculate premiums, accept or decline risks or adjust coverage based on personal data. For life and health insurance it is high-risk in the EU, and several US regulators require governance and discrimination testing.

• Diagnosis, triage or clinical support

  AI that helps diagnose, prioritize patients, recommend treatments, read medical images or draft clinical notes. Errors affect health, so clinical validation, medical oversight, patient transparency and, if it is a medical device, sanitary registration are required.

• Admissions, grading or exam proctoring

  AI that decides admissions, grades work, assigns levels or proctors online exams. It shapes students' access to education, often minors, so it is high-risk in the EU and Peru, and emotion recognition in classrooms is banned in the EU.

• Biometrics, facial or emotion recognition

  Identifying or verifying people by physical or behavioral traits, biometric categorization and emotion recognition. It is the most restricted use: bans in the EU and Peru, written consent in several US states and sensitive data across Latin America.

• Training or fine-tuning models on own data

  Training, fine-tuning or grounding models on customer, employee or public data. It requires a legal basis to reuse personal data, dataset documentation and, when developing a general-purpose model, provider duties.

• AI features inside vendor software

  AI features built into software the organization already buys, such as CRM, ERP, office suites or HR tools. The customer remains responsible for how they are used and must control contracts, data, training on its information and subprocessors.

• Selling software or services that include AI

  Organizations that build and sell AI-enabled products or services to businesses or consumers. They take on provider duties and, above all, customer demands for evidence of governance, security and transparency before buying.

• Access to public services or benefits

  AI used by public bodies or their suppliers to decide or prioritize access to subsidies, aid, social or health services, or permits. It affects vulnerable people and fundamental rights, so it requires impact assessment, transparency and human review.

• Other automated decisions with significant effects (housing, pricing, access to services)

  Automated or AI-driven decisions that affect people outside employment and credit: housing rentals, personalized pricing, access to services, account blocking or legal services. They trigger rights regarding automated decisions under data protection laws and, in the US, consequential decision laws.