Compliance AI Act and GDPR for your AI workflows.
Your automations and AI tools move personal data between software and models, some of them hosted outside Europe. We map each workflow, prepare the technical file for your DPO or lawyer, then fix what needs fixing: hosting, purging, logs, human oversight.
- Reply within 1 business day
- Free 30-minute scoping call
- You talk to the person who builds the project
Companies we have worked for
- Reply within 1 business day
- Free 30-minute scoping call
- You talk to the person who builds the project
Companies we have worked for
What already applies
The AI Act applies in stages. The GDPR has applied since 2018 to any workflow that handles an email, a CV or a customer record.
-
2 February 2025
Prohibited practices
Some uses are banned, such as social scoring or emotion recognition in the workplace.
-
2 August 2025
General-purpose AI models
Documentation and transparency obligations for model providers such as OpenAI, Anthropic or Mistral.
-
2 August 2026
Transparency
A chatbot must tell users they are dealing with an AI, and generated or manipulated content must be labelled as such.
-
2 December 2027
High-risk systems
Recruitment, staff evaluation, credit, access to essential services: these uses will have to meet requirements on documentation, human oversight and logging.
On the GDPR side, the points to check are concrete: an AI provider without a data processing agreement, data sent outside the EU, logs kept with no time limit.
Sources: Regulation (EU) 2024/1689 (AI Act) · Regulation (EU) 2026/1744, which postpones the high-risk deadlines · GDPR · CNIL recommendations on AI
Two situations, one method
Your workflows are already running
Make or Power Automate scenarios connected to an AI API, Copilot rolled out, an agent built by a contractor: we inventory what exists, flow by flow, and spot what is missing, whether a contract, hosting, a retention period or information given to people.
Your project is starting
We build the requirements in from the design stage: choice of model and hosting region, minimal data sent to the model, logs, human approval, and a record-of-processing sheet written alongside the project.
What we check
GDPR
- The personal data that flows through each workflow, and the data sent to an AI model.
- Processors (AI providers, no-code tools, hosting providers) and their data processing agreements (Article 28).
- Transfers outside the EU and their safeguards: adequacy decision or standard contractual clauses (Articles 44 to 49).
- Retention periods for data, logs and conversation histories.
- Record-of-processing entries (Article 30) and whether an impact assessment is needed (Article 35).
- The legal basis of each processing activity, to be confirmed by your DPO.
AI Act
- An inventory of the AI systems in use, including those built into your software.
- A preliminary classification of each use: prohibited, high-risk, subject to transparency or minimal risk.
- Informing users when they interact with an AI or receive generated content.
- Human oversight of decisions that concern people.
- Logging of processing and traceability of answers.
- The steps taken so your teams understand the AI tools they use (Article 4).
What you receive
Data flow map
One diagram per workflow: sources, tools, models, destinations and hosting countries.
Processor register
Each provider, its role, where the data is stored and the contract in place or to be signed.
AI Act pre-classification
Each AI use with its likely risk level and the obligations that follow, to be validated by your legal adviser.
Record-of-processing sheets
Sheets ready to copy into your record of processing activities, with the technical details already filled in.
Remediation plan
The list of technical fixes, ranked by priority, with the estimated effort for each.
The fixes we carry out
These are practices we already apply in our own builds: Mistral models, logging of every call, test sets and human approval in agents.
Hosting in Europe
Moving to a European region or a European model when the provider allows it.
Minimal data
Masking or pseudonymising names, emails and numbers before they are sent to the model.
Automatic purging
Scheduled deletion of data, temporary files and histories beyond the agreed retention period.
Logging
A record of every model call and every agent action, available if a request or an incident comes up.
Human approval
An approval step before sensitive actions: sending outside the company, a decision about a person, writing to a business system.
User information
A notice that users are talking to an AI in chatbots, and labelling of generated content.
What we don't do
- We don't give legal advice: classifying a processing activity and choosing a legal basis belong to your DPO or your lawyer.
- We don't sign contracts on your behalf: we point out which ones are missing and the technical points they need to cover.
- We don't replace your DPO: we give them the technical information they need.
We work with your DPO, in-house or external, or with your lawyer: the technical file is built so they can use it directly.
Companies we have worked for
Frequently asked questions
Does the AI Act apply to my automations?
Only to the parts that use an AI system. A Make scenario that copies spreadsheet rows into a CRM is not one; a workflow that has a language model read emails or CVs is. Most of these uses are not high-risk, but the transparency obligations have applied since 2 August 2026 whenever an AI interacts with people.
When do the high-risk obligations apply?
On 2 December 2027 for the uses listed in Annex III (recruitment, staff management, credit, access to essential services) and on 2 August 2028 for AI built into regulated products (Annex I). These dates come from Regulation (EU) 2026/1744, which pushed back the original 2 August 2026 deadline.
Is using ChatGPT or the OpenAI API compatible with the GDPR?
It depends on the plan and the settings. Business plans and APIs offer a data processing agreement and, in some cases, hosting in Europe. You also need to check how long requests are kept and whether data is used for training. We check these points for every tool you use.
Does an AI project need a data protection impact assessment (DPIA)?
Not always. Article 35 of the GDPR requires one when processing is likely to result in a high risk to people, for example evaluation or profiling, sensitive data or large-scale monitoring. We flag to your DPO the workflows that meet these criteria; the DPO decides.
Does my data have to stay in Europe?
The GDPR does not ban transfers outside the EU, it regulates them: an adequacy decision (such as the Data Privacy Framework for certified US companies), standard contractual clauses or other safeguards under Articles 44 to 49. When an equivalent model is available in Europe, EU hosting makes the file simpler.
Are you qualified to give legal advice?
No. In France, legal advice is reserved for lawyers and certain regulated professions. We carry out the technical audit and the fixes; the legal assessment belongs to your DPO or your lawyer, for whom our file is written.
How long does an audit take?
It depends on how many workflows and tools are involved. We quote it after a free 30-minute scoping call, during which we list your tools together.
AI Agents
Agents with limited, logged actions, approved by a person when needed.
RAG over your documents
An assistant that answers from your documents, filtered by each user's access rights.
Microsoft AI
Copilot, Copilot Studio and Power Automate, starting with data governance.
Guide: Implementing AI in Business
A 5-step method, use cases by department and how to measure results.