PIPELINEGuide
Data protection and AI compliance: risks and how to limit them
What can go wrong with data protection and AI compliance, how likely each scenario is, and what stipulations can prevent them — without dramatization and without sugar-coating.
The biggest risk with data protection and AI compliance isn't the technology, but that no one maintains the system after launch. Incorrect answers can be limited by working exclusively from verified content and escalating when uncertain; dependency is avoided by contractually keeping access, data, and documentation with the client.
01 — Risks
What can go wrong
- The system answers incorrectly. Containable by having it work exclusively from verified content and escalate when uncertain rather than guess. This is a configuration decision, not a property of the technology.
- The effort is underestimated. Most common reason: unclear starting situation. An honest assessment of the current state before the proposal prevents this more reliably than any buffer.
- No one maintains it. The biggest risk of all — and the most easily avoidable.
- Data protection gaps. Almost always arise from missing deletion deadlines and unclear responsibility, rarely from the technology itself.
- Vendor lock-in. Avoidable if access credentials, data, and documentation contractually remain with the client.
02 — Warning signs
When to be skeptical
- Guaranteed results. Anyone promising top Google ranking or a specific revenue increase is selling something they can't deliver.
- No pushback. A provider who thinks every project is a good idea has either not listened or is only selling.
- Time pressure. Limited-time discounts on project prices are a sales tool, not an offer.
- Unclear ownership. Anyone who won't clearly say who owns data and access doesn't have your interests at heart.
- No contact with technical expertise. If only sales sits in the first meeting, that's where misunderstandings arise.
03 — Contract
What needs to be clarified in writing
- Ownership of data and access. They belong to the client. If a provider won't clearly confirm this, that's the most important information from the conversation.
- Handover upon termination. In what format, within what timeframe, at what cost.
- No minimum term without consideration. Lock-in is justifiable if something is delivered in return — otherwise not.
- What a later change costs. The total cost isn't determined by the project price, but by the hourly rate in year three.
- Documentation as a deliverable. Not as a promise, but as a line item in the proposal.
04 — Questions
Frequently asked questions
May we enter customer data into ChatGPT?
In the free version without contractual safeguards: no. With a business account, data processing agreement, and training excluded, it may be permissible — depending on what data is involved. Precisely this distinction belongs in the usage policy, because it's constantly relevant in daily operations.
Do AI-generated texts need to be labeled?
For content that is published and synthetically generated or substantially modified, yes. Purely internal use — research, drafts, summaries — typically does not trigger this obligation.
Do we need a data protection impact assessment?
Not generally. It becomes necessary when the processing is likely to pose a high risk to data subjects — such as extensive profiling. For an FAQ chatbot on a website, it's usually not required. We review this case by case and document the result in writing.
How often does the inventory need to be updated?
Whenever a new tool is introduced or the purpose of an existing one changes. An annual review as a minimum interval makes sense, even without a specific trigger.
Does this also apply to sole proprietorships?
Yes. The AI Act doesn't distinguish by company size, but by purpose and risk. Anyone with a chatbot on their website is affected — regardless of whether one or a hundred people work in the business.
What if we use multiple AI tools from different providers?
Each tool is assessed individually — provider, data processing, and risk class differ. The usage policy summarizes the results so no one has to look up each tool separately.
Is a verbal agreement within the team sufficient instead of a written policy?
No, in case of dispute or audit, only what is documented counts. A brief written policy also protects new team members who never heard the verbal agreement.
05 — Next
Related pages
- Data protection and AI compliance — Overview
- Data protection and AI compliance — cost-effectiveness
- Data protection and AI compliance — practical examples
- Data protection and AI compliance — implementation
- Data protection and AI compliance — data protection
- Data protection and AI compliance — duration
- Data protection and AI compliance — Ongoing operations
- Data Protection and AI Compliance — Pros and Cons
- AI Consulting
- AI training
- AI chatbot
- All guides
Data protection and AI compliance by region
Next step
Initial assessment, no obligation.
Briefly describe what you need. You'll get an honest answer about what's realistic and what it will roughly cost.