PIPELINEGuide
Data protection and AI compliance 2026: what has changed
What's different about data protection and AI compliance in 2026 compared to two years ago — legally, technically, and in terms of what actually makes sense for small businesses.
Two things changed in data protection and AI compliance in 2026: The transparency obligations of the EU AI Act have been in effect since August, and search engines are answering more and more questions directly in the results. Technically, reliability has primarily increased — which doesn't mean every initiative makes sense.
01 — Current
What changed recently
Two developments shape the decision in 2026: First, the transparency requirements of the EU AI Act have been in effect since August — anyone communicating with an AI system must be able to recognize it. Second, search itself now answers more and more questions directly, which changes the value of having your own easily findable information source.
For data protection and AI compliance, this means in practice: labeling is mandatory, not a stylistic choice, and the content the system works with is the same content cited in search results and generated answers. Prepare it properly once, use it twice.
Technically, reliability has improved most of all. What was still an experiment two years ago is today a plannable implementation in many cases — which doesn't mean every project makes sense.
02 — Legal situation
EU AI Act: what applies
Since August 2026, the transparency requirements from Article 50 of the EU AI Act apply: Anyone communicating directly with an AI system must be able to recognize it. We build in the labeling as standard.
The AI Act doesn't distinguish by company size: A sole proprietorship with an AI system in customer contact is affected just as much as a corporation. What matters is purpose and risk, not headcount.
There's also the obligation to ensure adequate AI competence for the people working with it. That's not an examination requirement, but it should be documented — a training session with a participant list is the simplest proof.
03 — Benefits
What it actually delivers
- Time that's missing elsewhere. AI tools are already being used, mostly without rules. That's a data protection risk and, since the EU AI Act, also a compliance issue.
- Consistent quality. A system doesn't have a bad day and doesn't skip a step — regardless of who's currently in the office.
- Traceability. What runs automatically is documented. That helps with handovers, vacation coverage, and in case of disputes.
- Availability outside business hours. A significant portion of inquiries arise in the evening and on weekends — where until now no one was responding.
- A side effect hardly anyone plans for: During setup, it regularly becomes apparent that processes in the business are unclear. Clarifying that is often more valuable than the automation itself.
04 — Questions
Frequently asked questions
What does the EU AI Act specifically require of us?
For most businesses, it comes down to two things: transparency and competence. Transparency means people must recognize when they're speaking with an AI system or seeing AI-generated content — this has been in effect since August 2026. Competence means the people deploying such systems are adequately trained to do so. Both are documentable and achievable with manageable effort.
Do we need a data protection impact assessment?
Not generally. It becomes necessary when the processing is likely to pose a high risk to data subjects — such as extensive profiling. For an FAQ chatbot on a website, it's usually not required. We review this case by case and document the result in writing.
Is a verbal agreement within the team sufficient instead of a written policy?
No, in case of dispute or audit, only what is documented counts. A brief written policy also protects new team members who never heard the verbal agreement.
What if we use multiple AI tools from different providers?
Each tool is assessed individually — provider, data processing, and risk class differ. The usage policy summarizes the results so no one has to look up each tool separately.
How often does the inventory need to be updated?
Whenever a new tool is introduced or the purpose of an existing one changes. An annual review as a minimum interval makes sense, even without a specific trigger.
Does this also apply to sole proprietorships?
Yes. The AI Act doesn't distinguish by company size, but by purpose and risk. Anyone with a chatbot on their website is affected — regardless of whether one or a hundred people work in the business.
May we enter customer data into ChatGPT?
In the free version without contractual safeguards: no. With a business account, data processing agreement, and training excluded, it may be permissible — depending on what data is involved. Precisely this distinction belongs in the usage policy, because it's constantly relevant in daily operations.
05 — Next
Related pages
- Data protection and AI compliance — Overview
- Data protection and AI compliance — Costs
- Data protection and AI compliance — Process
- Data protection and AI compliance — Checklist
- Data protection and AI compliance — How it works
- Data protection and AI compliance — Funding
- Data protection and AI compliance — DIY
- Data protection and AI compliance — Ongoing operations
- AI Consulting
- AI training
- AI chatbot
- All guides
Data protection and AI compliance by region
Next step
Let's talk briefly about whether this makes sense for you.
A twenty-minute conversation is usually enough to clarify whether a project makes sense. If not, we'll say so — that's cheaper for both sides than an offer nobody needs.