AI Act and GDPR for generative AI
Your team already uses ChatGPT at work, with no written rules
We bring order to how your company uses generative AI: we find out which tools are used and with what data, classify each use by risk, write the internal policy, review vendor contracts and train the team. We work with companies of 10 to 250 people, alongside your lawyer or DPO. It starts with the AI Act Check, a fixed-scope review.
Today and after
How a client document ends up in an AI tool.
A typical situation in a 40-person services company, built as an example for this page. It does not describe any client.
Illustrative example
Today
Everyone opened their own account No rule
Personal accounts on free plans or paid out of pocket. The company does not know how many exist.
Client data goes into the chats No rule
A complaint, a contract, a payroll spreadsheet, pasted in to get a quick summary.
Nobody knows what happens to it No rule
There is no data processing agreement, and the training settings are still the defaults.
Generated text goes straight to the client No rule
Not reread, and with no mention that AI wrote it.
The first time a large client asks, there is no answer No rule
No list of tools, no policy, no record that the team was trained.
Five gaps, none of them visible until someone outside asks.
After
Company accounts on business plans Written rule
With a signed data processing agreement and training on company data switched off.
The policy says which data goes in Written rule
One page: approved tools, forbidden data, who approves a new tool.
Every use has a risk level Written rule
Drafting and summaries: minimal risk. Customer chatbot: transparency duties. AI in hiring: a separate project.
Client-facing text is reread by a person Human check
And where the law requires it, it says clearly that AI generated it.
Training is held and recorded Written rule
The team knows the rules, and the company has the record for the DPO, a client or an inspection.
The same tools, the same productivity. Plus rules, contracts and evidence.
When this fits
When it is worth it, and when it is not.
It fits if
- People use ChatGPT or other AI tools at work, but nobody has a list of what is used and with which data.
- A large client, a bank or a partner has asked for your AI usage policy, or how you handle their data.
- You want a chatbot on your website or to publish AI-generated content, and you need to know your transparency duties.
- You are considering AI for hiring or staff evaluation and want to know what high-risk means before you buy anything.
- Your lawyer or DPO needs the technical picture of the data flows, not another general talk about AI.
It does not fit if
- You need a legal opinion. That takes a lawyer; we work alongside one, not instead of one.
- You build and sell an AI system as a product. You are then a provider under the AI Act, with heavier duties, and the first step is a dedicated legal review.
- You want a compliance certificate. We do not issue certificates; we deliver the documents and evidence your lawyer and DPO need.
- Your company does not use AI and has no plans to. A short rule you write yourself is enough; no project is needed.
What we do
The components, one by one.
Each component can be delivered on its own. The AI Act Check shows which ones you need, and in what order.
- 01
AI use inventory
We find out which tools are actually used, by whom, for what and with which data, personal accounts included. The result is a simple register that one person in the company keeps up to date.
- 02
Risk classification
Each use gets an AI Act category: prohibited practice, high risk, transparency duties or minimal risk. Most office uses fall in the last one. Borderline cases go to your lawyer, with the technical analysis attached.
- 03
Internal AI usage policy
A short policy written for people, not lawyers: which tools are approved, which data never goes into them, when generated text must be reread and who approves a new tool.
- 04
Staff training
A practical session on your tools and rules, with examples from daily work. Attendance and materials are kept as a record of the AI literacy measures required by Article 4 of the AI Act.
- 05
Vendor and contract review
For each tool we check the plan in use, the data processing agreement, whether the vendor trains models on your data, where it is stored and for how long. We tell you which plan to change and which setting to close.
- 06
Transparency duties
Where a chatbot talks to customers or you publish AI-generated content, we set what must be disclosed and where: in the interface, in the privacy notice, on the content itself. We apply it with the team that builds your site or product.
Do the math
How much work already runs through AI, with no rules?
Enter your own numbers. The result shows how much of your company’s work is already done with AI tools, which is the part the rules apply to. It is not an estimated fine and not a promised saving.
Estimate
- Work done with AI per month
- 100 hours
- Value of that work
- €3,000 per month
Per year: €36,000
Assumptions
- With the starting values: 400 tasks × 15 minutes = 100 hours a month. At €30 an hour, €3,000 of work runs through AI tools every month.
- 400 tasks a month means, for example, 20 people using AI once per working day. Ask a few colleagues how often they use it before you pick the number.
- The minutes are the working time of the whole task, not only the conversation with the AI tool.
- €30 an hour is a starting value for the full cost of an hour of work, not an official average. Use the real cost in your company.
- The estimate does not model fines or the cost of a data leak. It only shows how large the share of work covered by the rules is.
- It is an indicative estimate, not a quote.
How we work
From what is used today to rules the team follows.
The first step is the AI Act Check: a fixed-scope review of five working days that shows what is used, with which data and what needs doing. The next steps are decided from it, together with your lawyer or DPO.
- 01
AI Act Check
Short conversations with each team, a questionnaire for everyone and a look at the tool accounts and settings. We classify each use by risk.
Output: the use inventory, the risk map and a prioritized action list.
- 02
Rules and contracts
We write the internal policy, review plans and data processing agreements, and decide what changes and what stops. Your lawyer approves the texts.
Output: an approved policy, contracts in order, settings corrected.
- 03
Training
We run the session with the team on the approved tools and the new rules, with examples from each person’s work.
Output: a trained team and a kept record of the training.
- 04
Review
We revisit the register when a new tool, a new use or a change in the law appears. The 2 December 2027 date for high-risk systems goes in the calendar.
Output: one person in the company who owns the register and knows when to call us.
Limits
What we do not do, and what can go wrong.
This is not legal advice
We do the technical and operational part: inventory, data flows, policy, training, settings. Legal interpretation, and responsibility for it, stay with your lawyer or DPO, whom we work with directly.
The data we see during the review
To build the inventory we see which data goes into AI tools. We sign a data processing agreement for any data we can access, and work on anonymized examples wherever possible.
The rules keep changing
The AI Act was already amended once, in July 2026, and Romania’s implementing law had not been adopted when we last checked. So every deliverable carries its check date and sources, and is reviewed when something changes.
A policy nobody reads
A 20-page policy changes nothing in how people work. We write a short one, tie it to the tools you already use and test it during training, on real cases.
Questions about the AI Act and GDPR at work
What does the AI Act require from a company that only uses ChatGPT?
The company is a deployer: it uses an AI system for professional purposes. Since 2 February 2025 it must take measures to support the AI literacy of the people who use the tools, and avoid prohibited practices such as inferring employees’ emotions. Drafting, summarizing or translating are not high-risk uses. The full picture is in our guide.
GDPR, the AI Act and ChatGPT at workWhat changed with the AI Omnibus?
Regulation (EU) 2026/1744, in force since 27 July 2026, moved the rules for Annex III high-risk systems, such as AI used in hiring or credit scoring, to 2 December 2027. For AI built into products covered by Annex I, the date is 2 August 2028. We checked these dates on 17 October 2026 against the European Commission’s official pages.
Which transparency duties apply from 2 August 2026?
Article 50 applies from 2 August 2026. For a company that uses AI, three situations matter most: a customer chatbot must be built so people know they are talking to an AI system; published deepfakes must be disclosed; AI-generated text published to inform the public on matters of public interest must be disclosed unless it goes through human editorial review. Providers of generative AI separately have to mark generated content technically; for systems placed on the market before 2 August 2026, their deadline is 2 December 2026.
Do we need a lawyer or a DPO?
For interpreting the law and for legal responsibility, yes: a lawyer, or your company’s DPO if you have one. We do not give legal opinions. We do the part lawyers usually need from someone else: the inventory, the data flows, the technical settings, a policy written in your team’s language and the training.
What is the AI Act Check?
A fixed-scope review of five working days. At the end you have the inventory of AI tools used in the company, each use classified by risk under the AI Act and GDPR, and a prioritized action list. We agree the cost and the dates in a short call before we start.
Can we simply ban ChatGPT at work?
You can, but people usually keep using it from their phones and personal accounts, and the company loses all control over the data. It is safer to choose the approved tools, on business plans with a data processing agreement, and to say clearly which data never goes into them.
Is an AI tool GDPR compliant?
No tool is GDPR compliant on its own; the way you use it is. What matters is the plan, consumer or business, the data processing agreement, whether the vendor trains models on your data, where it is stored and for how long. And the internal rule on which data never goes in.
Plans and contracts, in our guideWho enforces the AI Act in Romania?
A government memorandum proposes ANCOM as market surveillance authority and single point of contact, alongside sectoral authorities such as ASF, the National Bank of Romania and ANSPDCP. ANCOM said on 24 July 2026 that sanctions can apply only once the national implementing law is in force, which we did not find adopted on 17 October 2026. The obligations apply regardless. GDPR stays with ANSPDCP.
Further reading
Read more on this.
Tell us how your team uses AI today.
A few lines on the tools, the people and the data that goes into them are enough. We will tell you honestly whether an AI Act Check is the right step, or whether a short rule will do.