GuidesAI and compliance
AI, GDPR and the AI Act: what a business should check
Two texts, two logics
GDPR protects personal data. It applies as soon as an AI system processes information about people: customers, employees, applicants.
The European AI regulation (AI Act) governs the systems themselves, according to their level of risk. It applies in stages and its timetable was adjusted along the way. Transparency obligations for chatbots and generated content have applied since August 2026; the heaviest rules, for high-risk systems, were pushed back. Check the dates in force at the time of your project.
This guide is not legal advice. It lists what gets checked in practice.
Which data goes to the model
It is the first question, and the most concrete.
- MinimiseSend only what the task needs. A ticket summary does not need the card number.
- Anonymise or maskWhere possible.
- ExcludeSensitive categories unless necessary: health, opinions, minors’ data.
- Know where it is processedCountry, provider, subprocessors.
The contract with the model provider
To read before connecting anything:
| Point | What you look for |
|---|---|
| Training | Your data is not used to train the model |
| Retention | Short retention period, or none |
| Location | Processing in the European Union if needed |
| Processing | A signed data processing agreement |
| Security | Encryption, access control, certifications |
Providers’ business offers often differ from their consumer offers on these points.
Transparency
- A chatbot presents itself as an AI.
- Generated content that could mislead is flagged as such.
- People are informed when an AI takes part in a decision that concerns them.
Human oversight
No decision that matters to a person should rest on an AI alone: hiring, credit, sanctions, termination. A human decides, with a real ability to contradict the machine.
Classify your uses by risk
Most small-business uses are low risk: drafting, summarising, sorting, assistance. Some areas are classed as high risk and carry heavy obligations, notably employment, education, access to credit and to essential services. A few practices are prohibited. If your project touches those areas, consult a lawyer before building.
Neutrality and bias
On Votons, a comparison tool for political manifestos, neutrality is enforced by code: anonymised positions, left-right parity, and every card prepared by an agent is reviewed by a verifier agent and then by a human. When a topic is sensitive, rules are not left to an instruction.
The checklist
- A register of AI uses: what, with which data, which provider.
- An internal rule on what can be given to a model.
- Up-to-date data processing agreements.
- The AI notice on chatbots and relevant content.
- Human review before any binding output.
- A log of agent actions.
- A named owner.
For implementation, see Bringing AI into a small business and AI chatbot.
Frequently asked questions
- Are you allowed to send customer data to an AI model?
- GDPR applies as for any processor: you need a legal basis, a data processing agreement, data limited to what is necessary and information given to the people concerned. Also check where the data is processed and whether it is used to train the model.
- Must a chatbot say it is an AI?
- Yes. The European AI regulation provides a transparency obligation: a person must know they are interacting with an AI system. It is also a matter of trust.
- Does this guide replace legal advice?
- No. It gives the practical checkpoints. The application timetable of the European regulation has changed, and sensitive cases call for a lawyer or your data protection officer.
