Guide

Data protection and AI compliance for small businesses and sole proprietors

Most examples come from companies with their own IT departments. What can be transferred to a business with three to fifteen people — and what cannot.

Request assessment ↗Data protection and AI compliance

Quote upon request3 to 5 weeksStatus 2026

In short

For businesses with three to fifteen people, AI compliance is often more effective than for large companies, because the same person fills multiple roles. But the approach must be different: small scope, few moving parts, maintenance without specialist knowledge — not a solution designed for growth to fifty employees.

01 — Business size

What this means for small businesses

Most examples online come from companies with their own IT departments. In a business with three to fifteen people, different rules apply: there's no one to maintain a system on the side, and every hour spent on implementation is taken directly from day-to-day operations.

This doesn't mean AI compliance is unsuitable for small businesses — on the contrary, the impact is often greater there because the same person fills multiple roles. It means the approach must be different: small scope, few moving parts, maintenance without specialist knowledge.

A sole proprietorship doesn't need a solution designed for growth to fifty employees. Anyone who buys something like that pays for complexity that will never be used.

02 — Fit

When it's worth it

The process in question occurs at least weekly.
It follows rules you can write down — even if there are exceptions.
Today it's manual work that no one enjoys doing.
There's one person who decides, not three who need to coordinate.
You can name what would tell you it worked.

03 — Calculation

How to calculate it

Four numbers are enough: How often does the process occur? How long does it take? What does an hour cost internally? And what does the solution cost — one-time plus operation over three years?

An example: A process that occurs twice a week and takes 40 minutes each time ties up around 69 hours per year. At an internal hourly rate of 45 euros, that's roughly 3,100 euros per year locked in there. If a solution reduces this effort by two-thirds, it often pays for itself — depending on the actual quote — within one to two years. We'll give you the exact figure for your case after the initial meeting.

This calculation is deliberately conservative: it only accounts for the time saved, not the errors avoided or the orders that come through due to faster response. In practice, the benefit is usually higher — but you shouldn't count on it before you've measured it.

04 — Questions

Frequently asked questions

Is a verbal agreement within the team sufficient instead of a written policy?

No, in case of dispute or audit, only what is documented counts. A brief written policy also protects new team members who never heard the verbal agreement.

Does this also apply to sole proprietorships?

Yes. The AI Act doesn't distinguish by company size, but by purpose and risk. Anyone with a chatbot on their website is affected — regardless of whether one or a hundred people work in the business.

May we enter customer data into ChatGPT?

In the free version without contractual safeguards: no. With a business account, data processing agreement, and training excluded, it may be permissible — depending on what data is involved. Precisely this distinction belongs in the usage policy, because it's constantly relevant in daily operations.

How often does the inventory need to be updated?

Whenever a new tool is introduced or the purpose of an existing one changes. An annual review as a minimum interval makes sense, even without a specific trigger.

What does the EU AI Act specifically require of us?

For most businesses, it comes down to two things: transparency and competence. Transparency means people must recognize when they're speaking with an AI system or seeing AI-generated content — this has been in effect since August 2026. Competence means the people deploying such systems are adequately trained to do so. Both are documentable and achievable with manageable effort.

What if we use multiple AI tools from different providers?

Each tool is assessed individually — provider, data processing, and risk class differ. The usage policy summarizes the results so no one has to look up each tool separately.

Do we need a data protection impact assessment?

Not generally. It becomes necessary when the processing is likely to pose a high risk to data subjects — such as extensive profiling. For an FAQ chatbot on a website, it's usually not required. We review this case by case and document the result in writing.

05 — Decision

How to move forward

The most affordable next step is a conversation, not a quote. Twenty minutes is usually enough to clarify whether a project makes sense, what scope it involves, and whether we're the right fit.

If we're not, we'll say so. An honest no costs less than a project you abandon after three months — for both sides.

06 — Next

Data protection and AI compliance by region

Next step

Let's talk briefly about whether this makes sense for you.

A twenty-minute conversation is usually enough to clarify whether a project makes sense. If not, we'll say so — that's cheaper for both sides than an offer nobody needs.

Send inquiry ↗ office@pipeline-solutions.at OR +43 681 207 64 203