Most Of It Already Applied

The vacuum that is not there

A common feeling: AI moved so fast that the rules have not caught up, so nobody really knows what is allowed.

It is half true. Purpose-built AI legislation is genuinely new, uneven across countries, and in places still draft.

But it is mostly wrong, and the wrong half is the expensive half. The great majority of what governs your AI use is not new at all.

Technology-neutral

When regulators have been asked whether their rules cover AI, the answer has been remarkably consistent: the rules are about what you do, not what tool you used.

If your profession required you to:

• keep records of client communications
• verify a claim before you filed it
• not mislead in a promotion
• protect confidential information
• supervise work done on your behalf

then all of that already covers the AI-assisted version. No new rule was needed, and none is coming to replace them.

That last one deserves attention. Several professional bodies frame AI tools as something you supervise, in the same way you supervise a junior assistant. You remain answerable for the output.

Where new rules do add something

AI-specific regulation exists, and the dominant design sorts uses into tiers by risk.

The shape is roughly:

• Unacceptable uses, prohibited outright
• High risk uses, carrying real obligations around documentation, oversight, and quality
• Limited risk, mostly transparency duties such as telling people they are talking to a machine
• Minimal risk, which is nearly everything else

Most daily office work sits at the bottom. Drafting, summarising, brainstorming, tidying notes: minimal.

The uses that jump tiers are the ones that decide something about a person. Hiring, credit, education access, essential services. If your AI use touches those, the picture changes completely.

The question that sorts your own work

Ask: does this output affect a specific person's access to something they want?

If no, you are almost certainly in ordinary professional-duty territory, and the rules you already knew are the rules.

If yes, stop and find out properly. That is the boundary where obligations get heavy, and where an honest "I did not realise" is worth very little.

The same model, the same prompt style, two completely different regulatory positions depending on what the answer is used for.