PIPELINEGuide
Introducing data privacy and AI compliance to your team without resistance
The technical side of data privacy and AI compliance is rarely the problem. Where implementations actually fail is with the people who need to work with it — and that can be addressed beforehand.
Resistance to data privacy and AI compliance is almost never about technology, but about feared additional work or the worry of being replaced. Anyone who handles the affected process daily should be asked before implementation, not informed afterward — and nothing should be introduced that requires additional data entry.
01 — Team
How to get the team on board
- Involve early, don't just inform early. Whoever handles the process daily knows where the exceptions are. This information only exists beforehand, not after go-live.
- Take resistance seriously. It's almost never directed at technology, but at extra work or the fear of being replaced. Both need to be addressed openly.
- Don't introduce anything that creates extra work. Systems that require additional data entry will be circumvented — and rightly so.
- Designate one person as the first point of contact. Not as ownership, but so questions don't fall through the cracks.
- Make success visible. If after four weeks no one knows whether it delivered results, what sticks is the memory of the disruption, not the benefit.
02 — Participation
What we need from you
- A contact person who can make decisions — not just forward them.
- Access to the affected systems, in time and not on launch day.
- Real examples from daily business — the messier, the more useful for testing.
- Two to four hours for coordination, distributed over the project duration.
- An answer to the question of what success means. Without it, nothing can be assessed afterward.
03 — Measurement
How you measure success
- Define the one number beforehand. Without a baseline value, nothing can be proven afterward. Two weeks of tracking is enough for a reliable reference point.
- Processing time per case. The most direct metric: How long does the affected process take today, how long afterward.
- Percentage of cases that complete without intervention. This ratio typically rises significantly in the first weeks when refinements are made — it's the best early indicator.
- External response time. How quickly does someone who inquires receive an initial binding answer.
- What you should not measure: Team satisfaction in the first two weeks. Every transition feels worse initially than it actually is.
04 — Questions
Frequently asked questions
What does the EU AI Act specifically require of us?
For most businesses, it comes down to two things: transparency and competence. Transparency means people must recognize when they're speaking with an AI system or seeing AI-generated content — this has been in effect since August 2026. Competence means the people deploying such systems are adequately trained to do so. Both are documentable and achievable with manageable effort.
Is a verbal agreement within the team sufficient instead of a written policy?
No, in case of dispute or audit, only what is documented counts. A brief written policy also protects new team members who never heard the verbal agreement.
Do AI-generated texts need to be labeled?
For content that is published and synthetically generated or substantially modified, yes. Purely internal use — research, drafts, summaries — typically does not trigger this obligation.
Do we need a data protection impact assessment?
Not generally. It becomes necessary when the processing is likely to pose a high risk to data subjects — such as extensive profiling. For an FAQ chatbot on a website, it's usually not required. We review this case by case and document the result in writing.
Does this also apply to sole proprietorships?
Yes. The AI Act doesn't distinguish by company size, but by purpose and risk. Anyone with a chatbot on their website is affected — regardless of whether one or a hundred people work in the business.
What if we use multiple AI tools from different providers?
Each tool is assessed individually — provider, data processing, and risk class differ. The usage policy summarizes the results so no one has to look up each tool separately.
May we enter customer data into ChatGPT?
In the free version without contractual safeguards: no. With a business account, data processing agreement, and training excluded, it may be permissible — depending on what data is involved. Precisely this distinction belongs in the usage policy, because it's constantly relevant in daily operations.
05 — Next
Related pages
- Data protection and AI compliance — Overview
- Data protection and AI compliance — Ongoing operations
- Data protection and AI compliance — AI labeling
- Data Protection and AI Compliance — Pros and Cons
- Data protection and AI compliance — Funding
- Data protection and AI compliance — where to start
- Data protection and AI compliance — Checklist
- Data protection and AI compliance — implementation
- AI Consulting
- AI training
- AI chatbot
- All guides
Data protection and AI compliance by region
Next step
We'll look at your starting position.
Tell us what's eating up time today. That becomes an assessment with effort and benefit — and only then an offer.