Insights
MAKONIS team · · 7 min read
In short: For GDPR-compliant AI, companies need a legal basis, transparency towards data subjects, a data processing agreement with the AI provider, control over data location and retention, and a data protection impact assessment where risk is high. The EU AI Act adds risk-based obligations; for most mid-sized use cases AI literacy of staff and transparency duties matter most. This article is not legal advice.
Book a free call1. Define purpose and legal basis for each processing activity.
2. Sign a data processing agreement with the AI or hosting provider.
3. Clarify data location and retention: are inputs stored or used for training?
4. Transparency: inform data subjects about AI use.
5. Carry out a data protection impact assessment where risk is high.
6. Implement access control, logging and deletion periods technically.
7. Internal AI policy: which data may go into which tools.
The AI Act classifies AI systems by risk. The table is simplified.
| Risk level | Examples | Consequence |
|---|---|---|
| Prohibited | Social scoring | Not permitted |
| High risk | Candidate screening, critical infrastructure | Extensive obligations |
| Limited risk | Chatbots, generated content | Transparency duties |
| Minimal risk | Internal drafting, translation | Hardly any extra duties |
Most use cases such as knowledge assistants, document analysis or AI agents for internal processes fall into the lower levels. What matters is AI literacy of staff, labelling AI towards customers and a register of the AI systems in use.
We run AI models on infrastructure in Germany so data does not leave the EU, and implement logging, access rights and policies technically. It starts with a free 30-minute call with our engineers.
In principle yes, with suitable contracts, settings and rules on what data may be entered. Personal or confidential data is better handled by locally run models.
Talk to us about your cloud, DevOps and AI initiatives — no obligation, directly with our engineers.
