Association & foundation · AI Act

Association & foundation — AI Act: emerging uses to be framed

Associations and foundations are increasingly turning to AI: chatbots, donation campaign targeting, writing assistance. Under the AI Act, these uses generally fall under limited risk, with transparency requirements. This guide clarifies their classification and the key points to watch.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: AI Act.
  • Associations and foundations deploying chatbots and targeting tools are deployers; software publishers are providers.
  • Qualify use cases.
  • Report chatbots.
  • Prohibit manipulation.
  • For limited-risk uses, the AI Act translates primarily into transparency obligations; prohibited manipulative practices expose organisations to up to €35M or 7%.

Regulatory deadlines

The key dates of this regulation.

August 2024

Entry into force

In force

February 2025

Ban on prohibited practices

In force

August 2025

General-purpose AI models (GPAI) & governance

In force

August 2026

High-risk system obligations (Annex III)

In force

August 2027

High-risk embedded in products (Annex I)

Upcoming

What does the AI Act cover?

The AI Act requires transparency regarding interaction with an AI and generated content. The targeting of donation campaigns, without manipulation, falls under limited risk. Manipulative techniques exploiting vulnerabilities are prohibited — a point of attention for fundraising.

Donor profiling remains governed by GDPR.

Is the 'Association & Foundation' sector concerned?

Associations and foundations deploying chatbots and targeting tools are deployers; software publishers are providers.

Uses without manipulation fall under limited risk.

Detailed obligations

Qualify use cases

Confirm the limited risk of chatbots and targeting.

Flag chatbots

Disclosing interaction with an AI.

Prohibiting manipulation

Rule out any technique exploiting the vulnerabilities of donors.

Articulate with GDPR

Framing donor profiling.

Sanctions & risks

For limited-risk uses, the AI Act translates primarily into transparency obligations; prohibited manipulative practices expose organisations to up to €35M or 7%.

Application timeline

  • 1Entry into force. 1 August 2024.
  • 2Transparency. Progressive.

Common mistakes in the sector

  • 1Unreported chatbot. Not disclosing AI interaction.
  • 2Manipulation. Exploiting vulnerabilities to collect data.
  • 3Profiling ignored. Overlooking GDPR compliance.
  • 4Absent qualification. Failing to assess uses.

Practical case

A foundation deploys a chatbot and donation campaign targeting. As a limited-risk use case, it discloses AI interaction, takes care not to exploit donor vulnerability, and governs profiling in accordance with GDPR.

Compliance roadmap

  1. 1

    Inventory. Map chatbots and targeting.

  2. 2

    Qualify. Confirm limited risk.

  3. 3

    Report. Chatbot transparency.

  4. 4

    Frame. Prohibit manipulation.

  5. 5

    Articulate. Govern profiling.

Frequently asked questions

Yes: interaction with an AI must be transparent.

Back to the Association & foundation guideAssociation & foundation & GDPR

Take action on AI Act

Free assessment or a chat with an expert dedicated to association & foundation.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the association & foundation sector secured their compliance with DCO.

See testimonials