EU AI Act and GDPR for Self-Hosted LLMs

Running an LLM on your own infrastructure does not create an exemption from the EU AI Act or the GDPR. The AI Act regulates particular AI systems and general-purpose AI (GPAI) models and assigns duties by role. The GDPR applies when personal data is processed; a prompt or output may contain personal data, but does not always do so.¹² Local hosting can reduce external data transfers, while the intended use, the actors involved and the actual data flows determine the legal duties.

Start with the use and the role

An LLM is not automatically a high-risk AI system. Under Article 6 and Annex III, uses such as recruitment or worker management, education and certain creditworthiness assessments may qualify; Article 6(1) also addresses safety components or products under specified Annex I legislation. Article 6(3) sets a limited exception for some Annex III systems that do not pose significant risk. A provider invoking it must document the assessment under Article 6(4).³ A general coding assistant and an LLM used to screen job applicants therefore require different assessments even if they run the same weights.

Identify separately:

• GPAI-model provider: the actor that develops or places a general-purpose model on the market under its name.
• AI-system provider: the actor that develops or has a system developed and places it on the market or puts it into service under its name or trademark.
• Deployer: the actor that uses an AI system under its authority, except personal non-professional use.⁴

A company can have more than one role. Self-hosting upstream weights alone does not always turn it into the GPAI-model provider. Building and putting a system into service under the company's name can make it the system provider even if the model weights came from elsewhere. Changing the intended purpose or substantially modifying another provider's high-risk system can also trigger Article 25's provider rules. Assess the actual arrangement rather than inferring a role from server location.

Application dates after the Digital Omnibus

Regulation (EU) 2026/1744 is in force. It postponed Chapter III, Sections 1–3 for Annex III high-risk systems to 2 December 2027 and for Annex I high-risk systems to 2 August 2028.⁵ The Article 4 AI-literacy duty and most Article 5 prohibitions have applied since 2 February 2025; the two new Article 5 prohibitions apply from 2 December 2026. The GPAI chapter has applied since 2 August 2025, subject to transition provisions. Article 50 transparency has applied since 2 August 2026. The new Article 111(4) gives providers of generative systems placed on the market before 2 August 2026 until 2 December 2026 to comply with Article 50(2).⁵ See the detailed timeline.

Open-source model duties are a separate question

Article 53(2) removes only the technical-documentation and downstream-information duties in Article 53(1)(a)–(b) for qualifying free and open-source GPAI models whose parameters, architecture and usage information are publicly available. It does not remove the copyright-policy or public training-data-summary duties in Article 53(1)(c)–(d), and the exception does not apply to GPAI models with systemic risk.⁶ These duties concern a GPAI-model provider, not every organisation that deploys an open-weights model. A published fine-tune may change the analysis; the licence, changes and release arrangement need review. “Open weights” by itself does not prove that the licence meets Article 53(2).

Article 50: match the paragraph to the actor

Article 50(1) requires providers of systems intended to interact directly with natural persons to design them so those persons are informed that they are interacting with AI, unless obvious in context. Article 50(2) requires providers of generative systems to ensure machine-readable marking and detectability of synthetic audio, image, video or text, subject to its exceptions and the technical-feasibility qualification. Article 50(4) requires deployers to disclose certain deepfakes and AI-generated public-interest text, subject to its separate exceptions.⁷ A system's output need not be publicly posted for Article 50(2) to merit assessment; publication is relevant to the particular public-interest-text duty in paragraph 4. A back-office tool that never interacts directly with an applicant is not covered by paragraph 1 solely because it processes an application.

Article 4 calls for measures supporting AI literacy of staff and other persons dealing with the operation or use of AI on behalf of providers and deployers. The amended wording and the organisation's context matter; the Act does not prescribe a universal certificate or one fixed training deck.⁸

GDPR: follow the actual data flow

When prompts, outputs, logs or retrieval documents contain identifiable-person information, document the GDPR purpose and legal basis, minimise the data, set retention, protect access, and handle data-subject rights. The company determining purposes and means will usually be a controller; an infrastructure vendor that processes data on its behalf may be a processor requiring an Article 28 agreement. The roles depend on the contract and reality, not on the label “self-hosted”.²

Hosting in the EU can avoid a transfer to a model API, but it does not prove that no international transfer occurs. Check remote support, subprocessors, monitoring, backups and administrator access. Where personal data is transferred outside the EEA, assess the Chapter V transfer mechanism and any supplementary measures needed. Reusing prompts to train or fine-tune is a distinct processing question that requires a documented purpose and legal-basis assessment. The EDPB's Opinion 28/2024 discusses AI-model data protection issues but does not provide a blanket lawful basis for all LLM uses.⁹

Working checklist

1. Record the system's intended purpose, who provides it, who deploys it and who provided the underlying GPAI model.
2. Check Article 5 prohibitions, Article 4 literacy measures and each applicable Article 50 paragraph now.
3. If Article 6/Annex I or III may apply, document the classification and plan the affected Chapter III work for the correct 2027 or 2028 date.
4. Map prompt, output, retrieval and log data; document GDPR roles, purpose, legal basis, retention, security and any international transfers.
5. Review the model licence and source documentation before assuming the Article 53(2) open-source exception applies to a model you publish.

Legal status checked on 29 September 2026. This is general information, not individual legal advice.