PIPELINEGuide
Data Protection and AI Compliance: Real-World Examples
How AI compliance is actually used in the daily operations of small businesses — concrete processes instead of product promises, including cases where it didn't work.
In practice, data protection and AI compliance almost always starts with exactly one process, not with an overall concept. The transparency obligations under Article 50 of the EU AI Act have been in effect since August 2026 — regardless of company size. Expansion only happens once the first step has demonstrably worked in actual operations.
01 — Practice
What this looks like in concrete terms
The transparency obligations under Article 50 of the EU AI Act have been in effect since August 2026 — regardless of company size.
A typical entry point looks like this: The business identifies the one process that causes the most problems. What is being used, by whom, with what data. Usually more than management is aware of.
After going live, you don't expand immediately — you observe. Implement labeling, document training, file records.
02 — Fit
When it's worth it
- The process in question occurs at least weekly.
- It follows rules you can write down — even if there are exceptions.
- Today it's manual work that no one enjoys doing.
- There's one person who decides, not three who need to coordinate.
- You can name what would tell you it worked.
03 — Scope
When we advise against it
- The process is still changing. As long as you're adjusting the process itself, manual work is more flexible and cheaper.
- Exceptions outweigh standard cases. Then you're automating exceptions, and that gets expensive.
- There's no data foundation. Without digitally available source data, the basis is missing.
- Volume is too low. With five transactions a month, no system pays off — not even an affordable one.
- The real bottleneck lies elsewhere. If you don't have enough inquiries, you don't need faster processing.
04 — Questions
Frequently asked questions
What does the EU AI Act specifically require of us?
For most businesses, it comes down to two things: transparency and competence. Transparency means people must recognize when they're speaking with an AI system or seeing AI-generated content — this has been in effect since August 2026. Competence means the people deploying such systems are adequately trained to do so. Both are documentable and achievable with manageable effort.
Do we need a data protection impact assessment?
Not generally. It becomes necessary when the processing is likely to pose a high risk to data subjects — such as extensive profiling. For an FAQ chatbot on a website, it's usually not required. We review this case by case and document the result in writing.
Does this also apply to sole proprietorships?
Yes. The AI Act doesn't distinguish by company size, but by purpose and risk. Anyone with a chatbot on their website is affected — regardless of whether one or a hundred people work in the business.
Is a verbal agreement within the team sufficient instead of a written policy?
No, in case of dispute or audit, only what is documented counts. A brief written policy also protects new team members who never heard the verbal agreement.
May we enter customer data into ChatGPT?
In the free version without contractual safeguards: no. With a business account, data processing agreement, and training excluded, it may be permissible — depending on what data is involved. Precisely this distinction belongs in the usage policy, because it's constantly relevant in daily operations.
How often does the inventory need to be updated?
Whenever a new tool is introduced or the purpose of an existing one changes. An annual review as a minimum interval makes sense, even without a specific trigger.
Do AI-generated texts need to be labeled?
For content that is published and synthetically generated or substantially modified, yes. Purely internal use — research, drafts, summaries — typically does not trigger this obligation.
05 — Next
Related pages
- Data protection and AI compliance — Overview
- Data protection and AI compliance — measuring success
- Data protection and AI compliance — Checklist
- Data Protection and AI Compliance — Small Businesses
- Data protection and AI compliance — alternatives
- Data protection and AI compliance — provider comparison
- Data protection and AI compliance — How it works
- Data protection and AI compliance — DIY
- AI Consulting
- AI training
- AI chatbot
- All guides
Data protection and AI compliance by region
Next step
Let's talk briefly about whether this makes sense for you.
A twenty-minute conversation is usually enough to clarify whether a project makes sense. If not, we'll say so — that's cheaper for both sides than an offer nobody needs.