Guide · Compliance
AI, GDPR and the AI Act: what a company should review before using artificial intelligence
Before using AI, a company should take an inventory of the systems it uses, classify their risk level under the EU AI Act, review personal data processing under GDPR, tell users when they are interacting with an AI, sign contracts with providers and train its staff. This content is informational and does not replace legal advice.
Important notice
This guide summarises general concepts to help you ask the right questions. It is not legal advice and the regulation is being phased in (with guidance and deadlines that are updated): verify the current status and consult your legal adviser or your data protection officer before deciding.
The two main regulations
GDPR
Regulates the processing of personal data: legal basis, minimisation, transparency, people's rights, security and limits on automated decisions. It applies whenever the AI processes personal data.
EU AI Act
Regulates AI systems according to their risk: prohibited practices, high-risk systems with strict requirements, transparency obligations and free use for minimal risk. It applies gradually.
Sector-specific rules (healthcare, finance, insurance), labour, intellectual property and information security rules may also apply.
Risk levels in the AI Act
| Level | What it implies | Examples |
|---|---|---|
| Prohibited practices | Cannot be used | Harmful subliminal manipulation, social scoring, certain uses of biometrics |
| High risk | Requirements for risk management, data, documentation, human oversight and logging | Recruitment and staff evaluation, creditworthiness, some uses in health, education and insurance |
| Transparency | Inform that one is interacting with an AI and about generated content | Chatbots, synthetic content |
| Minimal risk | No specific obligations, good practices | Spam filters, internal documentation assistants |
Most common business uses (chatbots, assistants over documents, automations) fall under transparency or minimal risk; it pays to check sector by sector, as we explain in AI for HR or AI for healthcare.
Review checklist for a company
- Inventory: list all AI tools and systems (including those employees use on their own), their purpose, data and provider.
- Risk classification: check whether any use affects employment, credit, health, education or other sensitive areas.
- Personal data: legal basis, minimisation, information to data subjects, record of processing activities and, if the risk is high, an impact assessment.
- Automated decisions: ensure human intervention and the possibility of challenge where there are significant effects on people.
- Transparency: tell the user they are talking to an AI and offer human contact.
- Providers: data processing agreements, data location, use for training, security and sub-processors.
- People: training in the use of AI for those who use it and a usage policy (which data is not entered and when to review the output).
- Security and logging: minimum access, traceability of decisions and periodic quality evaluation.
How we approach it in projects
- We include the regulatory risk analysis in the design, not at the end.
- We apply minimum permissions, data minimisation and activity logging by default.
- We prepare technical documentation (what the system does, with what data, how it is evaluated) that is useful for your legal adviser.
- We can deploy models in the EU or on your infrastructure when the data requires it.
If you need to put order into the use of AI in your company, AI consulting includes an inventory and usage policy, and the guide to implementation in a small business places compliance within the plan.
Frequently asked questions
What is the AI Act?
It is the EU regulation on artificial intelligence, which regulates AI systems according to their risk level: it prohibits some practices, imposes requirements on high-risk systems and sets transparency obligations for others, such as chatbots.
Does a company chatbot have to say it is an AI?
Yes, as a general rule the user must be told they are interacting with an AI system, unless it is obvious from the context. It is also good practice to offer human contact.
Can I use customers' personal data with AI?
Yes, if you comply with GDPR: legal basis, information to data subjects, minimisation, security, contracts with providers and, when the risk is high, an impact assessment.
Which AI uses are high risk?
Among others, those related to employment and staff recruitment, creditworthiness assessment, education, access to essential services and some uses in health or insurance. The current list in the Regulation must be reviewed with an adviser.
Do I need an AI usage policy for my employees?
It is highly recommended: it defines which tools are approved, which data cannot be entered and when the output must be reviewed. It also helps meet training and security obligations.
Shall we talk about your project?
Tell us about your case and we will reply within 24-48 hours with a proposed scope and an indicative quote.
Tell us about your project
Describe what you want to achieve and which systems you work with. We reply within 24-48 hours.
Artificial intelligence services and guides
Everything we do with AI for business, from the diagnostic to the product in production. Artificial intelligence for business.
Services
- AI agents for businessSystems that plan and carry out tasks on your CRM, ERP and email.
- Custom AI chatbots24/7 support and sales on web and WhatsApp, connected to your systems.
- Assistant over your company documents (RAG)An AI that answers with your information and cites the source.
- AI integration in apps and softwareAdd language models to your product without rebuilding it.
- Artificial intelligence consultingDiagnostic, prioritised cases and a roadmap with return.
- Machine learning and predictive analyticsDemand forecasting, churn, anomalies and predictive maintenance.
- Computer vision and OCR with AIReading invoices and delivery notes and image-based quality inspection.
- Custom AI app developmentApps and platforms with AI built in from the design stage.
- Process automation with AIWorkflows that save hours of manual work.
- AI voice assistantsPhone agents that answer calls and book appointments using your systems.
- AI recommendation systemsPersonalisation and recommendations measured with A/B tests.
Guides
- AI agent, chatbot or assistant: differences
- How much an AI chatbot or agent costs
- What RAG is and how to use it in your company
- AI use cases in business by department
- How to implement AI in a small business
- n8n, Make, Zapier or custom development
- How to choose the AI model for your company
- How to measure the ROI of an AI project
- How to appear in ChatGPT and AI Overviews
- What is MCP (Model Context Protocol)
- Automation with n8n for business
- 17 tools to develop apps with AI
- Mobile apps with artificial intelligence
- 10 AI automations for small businesses
- WhatsApp Business with AI: customer service
- AI in mobile apps: device or cloud
AI by sector
- AI for e-commerce
- AI for real estate
- AI for clinics and healthcare
- AI for logistics and transport
- AI for human resources
- AI for insurance and brokerage
- AI for industry and manufacturing
- AI for hospitality and restaurants
- AI for law and accounting firms
- AI for education and e-learning