Using AI in your company on a sound legal footing

AI tools have long been in use in most companies – often without management or the data protection officer knowing about it. This shadow AI is the real risk: staff enter client data, job applications or draft contracts into services whose processing nobody has reviewed.

A ban does not solve the problem, it merely moves it. What works is an orderly framework: reviewed tools, clear rules for handling personal and confidential data, and staff who have understood both.

This includes

• Taking stock of the systems in use and building an AI inventory
• Determining your role under Regulation (EU) 2024/1689 – provider or deployer – and the duties that follow from it
• Classifying your use cases against the risk categories of the AI Act, including the prohibited practices
• Data protection review: legal basis, purpose limitation, transparency and, where required, a data protection impact assessment
• Contractually securing processing and third-country transfers for services outside the EU
• Reviewing training and input data, and what the provider is allowed to do with them
• A usage policy and training, so that the AI literacy required by the Regulation can be demonstrated
• Documenting the decisions for supervisory authorities, clients and auditors

How we work

We start with what is actually being used, not with what a policy is supposed to say. That inventory produces an assessment per use case: what can stay, what needs contractual or technical safeguards, what has to be replaced. Only then do we write rules – short enough that people read them.

Where you want to build AI into your own applications, we continue with the same care: we examine which data the model may reach, where processing takes place and how inputs and results can be logged without creating new data protection problems.