Guide

Do data protection and AI compliance yourself or have it done?

Much of what's involved in data protection and AI compliance can be built in-house — the question is whether it pays off. When internal effort makes sense, where the limit is, and which path is the most expensive.

Request assessment ↗Data protection and AI compliance

Quote upon request3 to 5 weeksStatus 2026

In short

Building data protection and AI compliance yourself pays off when the project stays small, someone in the business has time for it, and no one depends on it being live by a specific date. Once other systems need to be integrated or someone is liable if it fails, external implementation is usually cheaper — the most expensive path is the half-finished one.

01 — In-house effort

Build yourself or have it built?

Building yourself makes sense when someone in the business has the time and interest, the project stays small, and no one depends on it being live by a specific date.
Ready-made platforms get you to a first result quickly, but hit limits where custom processes, custom data, or integrations with existing systems come into play.
External implementation pays off once data protection and AI compliance needs to communicate with other systems, once someone is liable if it doesn't work, or once the internal effort becomes more expensive than external implementation.
The most expensive path is the halfway one: built in-house for months on the side, then abandoned and rebuilt externally. If you decide on in-house effort, set a time budget and an abort point.
Hybrid approach: concept and setup external, maintenance internal. This is often the most economical path for data protection and AI compliance — provided the handover is documented.

02 — Requirements

What you need for AI compliance

A clearly defined trigger. Not “we should do something with AI,” but a process that demonstrably costs time or orders today.
Existing content or data. Data protection and AI compliance works with what's already there. The more complete the starting point, the shorter the setup.
Access to the systems involved. Whoever manages the credentials needs to be involved from the start — this is, in our experience, the most common cause of delays.
One decision-making contact person. One, not three.
Willingness to refine after launch. The first weeks in real operation show what was missing in the concept. That's normal and accounted for.

03 — Calculation

How to calculate it

Four numbers are enough: How often does the process occur? How long does it take? What does an hour cost internally? And what does the solution cost — one-time plus operation over three years?

An example: A process that occurs twice a week and takes 40 minutes each time ties up around 69 hours per year. At an internal hourly rate of 45 euros, that's roughly 3,100 euros per year locked in there. If a solution reduces this effort by two-thirds, it often pays for itself — depending on the actual quote — within one to two years. We'll give you the exact figure for your case after the initial meeting.

This calculation is deliberately conservative: it only accounts for the time saved, not the errors avoided or the orders that come through due to faster response. In practice, the benefit is usually higher — but you shouldn't count on it before you've measured it.

04 — Questions

Frequently asked questions

Is a verbal agreement within the team sufficient instead of a written policy?

No, in case of dispute or audit, only what is documented counts. A brief written policy also protects new team members who never heard the verbal agreement.

May we enter customer data into ChatGPT?

In the free version without contractual safeguards: no. With a business account, data processing agreement, and training excluded, it may be permissible — depending on what data is involved. Precisely this distinction belongs in the usage policy, because it's constantly relevant in daily operations.

Does this also apply to sole proprietorships?

Yes. The AI Act doesn't distinguish by company size, but by purpose and risk. Anyone with a chatbot on their website is affected — regardless of whether one or a hundred people work in the business.

Do we need a data protection impact assessment?

Not generally. It becomes necessary when the processing is likely to pose a high risk to data subjects — such as extensive profiling. For an FAQ chatbot on a website, it's usually not required. We review this case by case and document the result in writing.

How often does the inventory need to be updated?

Whenever a new tool is introduced or the purpose of an existing one changes. An annual review as a minimum interval makes sense, even without a specific trigger.

What if we use multiple AI tools from different providers?

Each tool is assessed individually — provider, data processing, and risk class differ. The usage policy summarizes the results so no one has to look up each tool separately.

What does the EU AI Act specifically require of us?

For most businesses, it comes down to two things: transparency and competence. Transparency means people must recognize when they're speaking with an AI system or seeing AI-generated content — this has been in effect since August 2026. Competence means the people deploying such systems are adequately trained to do so. Both are documentable and achievable with manageable effort.

05 — Decision

How to move forward

The most affordable next step is a conversation, not a quote. Twenty minutes is usually enough to clarify whether a project makes sense, what scope it involves, and whether we're the right fit.

If we're not, we'll say so. An honest no costs less than a project you abandon after three months — for both sides.

06 — Next

Data protection and AI compliance by region

Next step

Let's talk briefly about whether this makes sense for you.

A twenty-minute conversation is usually enough to clarify whether a project makes sense. If not, we'll say so — that's cheaper for both sides than an offer nobody needs.

Send inquiry ↗ office@pipeline-solutions.at OR +43 681 207 64 203