PIPELINEGuide
What do you need for AI compliance? The prerequisites
Before AI compliance even makes sense, a few things need to be in place in your business. What those are — and which supposed prerequisites actually aren't.
For AI compliance, a business needs three things: a specifically named process that currently costs time or orders, existing content or data to work with, and a person authorized to make decisions. Technical expertise is explicitly not one of them.
01 — Requirements
What you need for AI compliance
- A clearly defined trigger. Not “we should do something with AI,” but a process that demonstrably costs time or orders today.
- Existing content or data. Data protection and AI compliance works with what's already there. The more complete the starting point, the shorter the setup.
- Access to the systems involved. Whoever manages the credentials needs to be involved from the start — this is, in our experience, the most common cause of delays.
- One decision-making contact person. One, not three.
- Willingness to refine after launch. The first weeks in real operation show what was missing in the concept. That's normal and accounted for.
02 — Participation
What we need from you
- A contact person who can make decisions — not just forward them.
- Access to the affected systems, in time and not on launch day.
- Real examples from daily business — the messier, the more useful for testing.
- Two to four hours for coordination, distributed over the project duration.
- An answer to the question of what success means. Without it, nothing can be assessed afterward.
03 — Fit
When it's worth it
- The process in question occurs at least weekly.
- It follows rules you can write down — even if there are exceptions.
- Today it's manual work that no one enjoys doing.
- There's one person who decides, not three who need to coordinate.
- You can name what would tell you it worked.
04 — Questions
Frequently asked questions
How often does the inventory need to be updated?
Whenever a new tool is introduced or the purpose of an existing one changes. An annual review as a minimum interval makes sense, even without a specific trigger.
What does the EU AI Act specifically require of us?
For most businesses, it comes down to two things: transparency and competence. Transparency means people must recognize when they're speaking with an AI system or seeing AI-generated content — this has been in effect since August 2026. Competence means the people deploying such systems are adequately trained to do so. Both are documentable and achievable with manageable effort.
Does this also apply to sole proprietorships?
Yes. The AI Act doesn't distinguish by company size, but by purpose and risk. Anyone with a chatbot on their website is affected — regardless of whether one or a hundred people work in the business.
What if we use multiple AI tools from different providers?
Each tool is assessed individually — provider, data processing, and risk class differ. The usage policy summarizes the results so no one has to look up each tool separately.
Do AI-generated texts need to be labeled?
For content that is published and synthetically generated or substantially modified, yes. Purely internal use — research, drafts, summaries — typically does not trigger this obligation.
Do we need a data protection impact assessment?
Not generally. It becomes necessary when the processing is likely to pose a high risk to data subjects — such as extensive profiling. For an FAQ chatbot on a website, it's usually not required. We review this case by case and document the result in writing.
May we enter customer data into ChatGPT?
In the free version without contractual safeguards: no. With a business account, data processing agreement, and training excluded, it may be permissible — depending on what data is involved. Precisely this distinction belongs in the usage policy, because it's constantly relevant in daily operations.
05 — Next
Related pages
- Data protection and AI compliance — Overview
- Data protection and AI compliance — duration
- Data protection and AI compliance — cost-effectiveness
- Data protection and AI compliance — common mistakes
- Data protection and AI compliance — measuring success
- Data protection and AI compliance — practical examples
- Data protection and AI compliance — contract and ownership
- Data Protection and AI Compliance — Small Businesses
- AI Consulting
- AI training
- AI chatbot
- All guides
Data protection and AI compliance by region
Next step
Send us a few sentences about your project.
We read every inquiry ourselves and respond personally. No sales team, no callback form into the void.