PIPELINEGuide
Data protection and AI compliance: comparing providers — what really matters
Quotes on data protection and AI compliance are hard to compare because everyone includes something different. The questions that reveal the differences — and the warning signs.
When comparing providers for data protection and AI compliance, what matters less is the quoted price than the question of what happens afterward: who supports the system after go-live, and what does a later modification cost. That's the difference that only shows up after a few months.
01 — Criteria
How quotes differ
- What exactly is included. Two quotes with the same total can cover completely different deliverables. Ask for scope as a list, not as running text.
- Who delivers what. Content, images, data, access — if it's not specified, it becomes a point of conflict later.
- What operation costs. Calculated over three years, including licenses, hosting, and support.
- What happens if you want to switch. Do you get access, data, and documentation? The answer to this question says more about a provider than any reference.
- Who actually does the work. With small providers this matters: who sits in the meeting, and who then does it.
02 — Questions
Questions you should ask
- What happens if the project becomes more expensive than estimated — who bears that?
- Who owns data, access, and, if developed, the source code?
- What does operation cost in the second and third year?
- What does the documentation we receive at the end look like?
- How would you measure whether the project was successful?
- Is there a case in which you would advise us against this?
03 — Warning signs
When to be skeptical
- Guaranteed results. Anyone promising top Google ranking or a specific revenue increase is selling something they can't deliver.
- No pushback. A provider who thinks every project is a good idea has either not listened or is only selling.
- Time pressure. Limited-time discounts on project prices are a sales tool, not an offer.
- Unclear ownership. Anyone who won't clearly say who owns data and access doesn't have your interests at heart.
- No contact with technical expertise. If only sales sits in the first meeting, that's where misunderstandings arise.
04 — Scope
What's included
- Inventory: which AI tools are actually being used in the business
- Classification under the EU AI Act — risk class and resulting obligations
- Review of the data protection situation for each tool, including data processing agreements
- Usage policy that's practical in everyday work rather than just formally correct
- Implement labeling requirements for chatbots and AI-generated content
- Proof of AI competence through documented training
05 — Questions
Frequently asked questions
How often does the inventory need to be updated?
Whenever a new tool is introduced or the purpose of an existing one changes. An annual review as a minimum interval makes sense, even without a specific trigger.
Do AI-generated texts need to be labeled?
For content that is published and synthetically generated or substantially modified, yes. Purely internal use — research, drafts, summaries — typically does not trigger this obligation.
May we enter customer data into ChatGPT?
In the free version without contractual safeguards: no. With a business account, data processing agreement, and training excluded, it may be permissible — depending on what data is involved. Precisely this distinction belongs in the usage policy, because it's constantly relevant in daily operations.
What if we use multiple AI tools from different providers?
Each tool is assessed individually — provider, data processing, and risk class differ. The usage policy summarizes the results so no one has to look up each tool separately.
Is a verbal agreement within the team sufficient instead of a written policy?
No, in case of dispute or audit, only what is documented counts. A brief written policy also protects new team members who never heard the verbal agreement.
Do we need a data protection impact assessment?
Not generally. It becomes necessary when the processing is likely to pose a high risk to data subjects — such as extensive profiling. For an FAQ chatbot on a website, it's usually not required. We review this case by case and document the result in writing.
Does this also apply to sole proprietorships?
Yes. The AI Act doesn't distinguish by company size, but by purpose and risk. Anyone with a chatbot on their website is affected — regardless of whether one or a hundred people work in the business.
06 — Next
Related pages
- Data protection and AI compliance — Overview
- Data protection and AI compliance — requirements
- Data protection and AI compliance — where to start
- Data protection and AI compliance — measuring success
- Data protection and AI compliance — How it works
- Data protection and AI compliance — integration
- Data protection and AI compliance — common mistakes
- Data protection and AI compliance — duration
- AI Consulting
- AI training
- AI chatbot
- All guides
Data protection and AI compliance by region
Next step
Initial assessment, no obligation.
Briefly describe what you need. You'll get an honest answer about what's realistic and what it will roughly cost.