PIPELINEGuide
Data Protection and AI Compliance: the most common mistakes and how to avoid them
Projects around data protection and AI compliance rarely fail because of technology. The patterns repeat — and can be prevented in advance.
The most common mistake with data protection and AI compliance is starting with the technology instead of the actual bottleneck. A project that no one in the business actually maintains delivers less in the long run than a smaller one that is actually used.
01 — Mistakes
The most common mistakes
- Starting too big. Projects where nobody can use anything for months fail more often than average. A small, usable first step is almost always the better way.
- Not involving the people who work with it. Requirements that only come from management rarely match the actual work.
- Not defining a success measure. Without a metric defined in advance, you can't say afterwards whether it delivered anything — and the next decision will be made on gut feeling again.
- Overlooking operating costs. The project price is only part of it. What operation costs over three years belongs in the same calculation.
- Creating dependency. If you don't get access, documentation and source code, you're locked in. That needs to be clarified before commissioning, not after.
02 — Warning signs
When to be skeptical
- Guaranteed results. Anyone promising top Google ranking or a specific revenue increase is selling something they can't deliver.
- No pushback. A provider who thinks every project is a good idea has either not listened or is only selling.
- Time pressure. Limited-time discounts on project prices are a sales tool, not an offer.
- Unclear ownership. Anyone who won't clearly say who owns data and access doesn't have your interests at heart.
- No contact with technical expertise. If only sales sits in the first meeting, that's where misunderstandings arise.
03 — Bottlenecks
What typically causes delays
- Content and deliveries. By far the most common cause of delay. Text, images, price lists, access credentials — what's missing blocks progress.
- Decisions. When it's unclear who approves, the project waits. A named contact person with decision-making authority noticeably shortens the timeline.
- Access to third-party systems. Getting access to inventory management, phone systems, or CRM regularly takes longer than the integration itself.
- Endless review rounds. Two correction rounds are normal, five are a sign that the goal wasn't clear at the start.
04 — Questions
Frequently asked questions
Is a verbal agreement within the team sufficient instead of a written policy?
No, in case of dispute or audit, only what is documented counts. A brief written policy also protects new team members who never heard the verbal agreement.
Does this also apply to sole proprietorships?
Yes. The AI Act doesn't distinguish by company size, but by purpose and risk. Anyone with a chatbot on their website is affected — regardless of whether one or a hundred people work in the business.
What does the EU AI Act specifically require of us?
For most businesses, it comes down to two things: transparency and competence. Transparency means people must recognize when they're speaking with an AI system or seeing AI-generated content — this has been in effect since August 2026. Competence means the people deploying such systems are adequately trained to do so. Both are documentable and achievable with manageable effort.
How often does the inventory need to be updated?
Whenever a new tool is introduced or the purpose of an existing one changes. An annual review as a minimum interval makes sense, even without a specific trigger.
Do we need a data protection impact assessment?
Not generally. It becomes necessary when the processing is likely to pose a high risk to data subjects — such as extensive profiling. For an FAQ chatbot on a website, it's usually not required. We review this case by case and document the result in writing.
What if we use multiple AI tools from different providers?
Each tool is assessed individually — provider, data processing, and risk class differ. The usage policy summarizes the results so no one has to look up each tool separately.
May we enter customer data into ChatGPT?
In the free version without contractual safeguards: no. With a business account, data processing agreement, and training excluded, it may be permissible — depending on what data is involved. Precisely this distinction belongs in the usage policy, because it's constantly relevant in daily operations.
05 — Decision
How to move forward
The most affordable next step is a conversation, not a quote. Twenty minutes is usually enough to clarify whether a project makes sense, what scope it involves, and whether we're the right fit.
If we're not, we'll say so. An honest no costs less than a project you abandon after three months — for both sides.
06 — Next
Related pages
- Data protection and AI compliance — Overview
- Data protection and AI compliance — Costs
- Data protection and AI compliance — Process
- Data protection and AI compliance — implementation
- Data protection and AI compliance — provider comparison
- Data protection and AI compliance — Ongoing operations
- Data protection and AI compliance — requirements
- Data protection and AI compliance — team and acceptance
- AI Consulting
- AI training
- AI chatbot
- All guides
Data protection and AI compliance by region
Next step
Let's talk briefly about whether this makes sense for you.
A twenty-minute conversation is usually enough to clarify whether a project makes sense. If not, we'll say so — that's cheaper for both sides than an offer nobody needs.