PIPELINEGuide
How does AI compliance work? Explanation without jargon
What actually happens technically when AI compliance runs in a business — explained for decision-makers, not developers. Including the points where people are still needed.
Data protection and AI compliance works like this at its core: A request comes in, is checked against stored content and rules, and is either answered directly or passed to a person with full context. The real work isn't in the technology, but in defining exactly where that boundary lies.
01 — How it works
How AI compliance works technically
A documented inventory, a practical usage policy, and the evidence that can be requested.
From the outside, here's what happens: A request comes in — through the website, phone, a form, or an existing system. It's captured, checked against the stored rules and content, and either answered directly or handed over to a person with full context. The critical part isn't the technology, but defining where that boundary lies.
AI tools are already being used, usually without rules. That's a data protection risk and since the EU AI Act also a compliance issue. That exact point determines how the system is configured — not a general product promise.
02 — Components
What the system consists of
- Inventory: which AI tools are actually being used in the business
- Classification under the EU AI Act — risk class and resulting obligations
- Review of the data protection situation for each tool, including data processing agreements
- Usage policy that's practical in everyday work rather than just formally correct
- Implement labeling requirements for chatbots and AI-generated content
- Proof of AI competence through documented training
03 — Process
The steps in detail
Taking stock
What is being used, by whom, with what data. Usually more than management is aware of.
Classification
Risk class per application, and the specific obligations that follow.
Writing the rules
A policy that's short enough to actually be read.
Implementing and documenting
Build in labeling, document training, file the records.
04 — Questions
Frequently asked questions
What does the EU AI Act specifically require of us?
For most businesses, it comes down to two things: transparency and competence. Transparency means people must recognize when they're speaking with an AI system or seeing AI-generated content — this has been in effect since August 2026. Competence means the people deploying such systems are adequately trained to do so. Both are documentable and achievable with manageable effort.
May we enter customer data into ChatGPT?
In the free version without contractual safeguards: no. With a business account, data processing agreement, and training excluded, it may be permissible — depending on what data is involved. Precisely this distinction belongs in the usage policy, because it's constantly relevant in daily operations.
Does this also apply to sole proprietorships?
Yes. The AI Act doesn't distinguish by company size, but by purpose and risk. Anyone with a chatbot on their website is affected — regardless of whether one or a hundred people work in the business.
Is a verbal agreement within the team sufficient instead of a written policy?
No, in case of dispute or audit, only what is documented counts. A brief written policy also protects new team members who never heard the verbal agreement.
How often does the inventory need to be updated?
Whenever a new tool is introduced or the purpose of an existing one changes. An annual review as a minimum interval makes sense, even without a specific trigger.
Do AI-generated texts need to be labeled?
For content that is published and synthetically generated or substantially modified, yes. Purely internal use — research, drafts, summaries — typically does not trigger this obligation.
Do we need a data protection impact assessment?
Not generally. It becomes necessary when the processing is likely to pose a high risk to data subjects — such as extensive profiling. For an FAQ chatbot on a website, it's usually not required. We review this case by case and document the result in writing.
05 — Decision
How to move forward
The most affordable next step is a conversation, not a quote. Twenty minutes is usually enough to clarify whether a project makes sense, what scope it involves, and whether we're the right fit.
If we're not, we'll say so. An honest no costs less than a project you abandon after three months — for both sides.
06 — Next
Related pages
- Data protection and AI compliance — Overview
- Data protection and AI compliance — AI labeling
- Data protection and AI compliance — provider comparison
- Data protection and AI compliance — duration
- Data protection and AI compliance — common mistakes
- Data protection and AI compliance — alternatives
- Data protection and AI compliance — requirements
- Data protection and AI compliance — Checklist
- AI Consulting
- AI training
- AI chatbot
- All guides
Data protection and AI compliance by region
Next step
Let's talk briefly about whether this makes sense for you.
A twenty-minute conversation is usually enough to clarify whether a project makes sense. If not, we'll say so — that's cheaper for both sides than an offer nobody needs.