Eight questions your DPO will ask anyway.

Check what's already true for your planned (or running) AI setup. Your answers stay in your browser — fittingly. This is orientation, not legal advice.

Data inventory exists. We know which personal data would enter the AI system, from which sources. Processing agreements covered. Art. 28 DPAs exist with every external party that would process the data — or no external party does. No unassessed third-country transfer. Data either stays in the EU/your infrastructure, or a documented TIA exists. Access control designed. The AI can only retrieve documents the asking user is allowed to see. Logging policy decided. What gets logged (and what deliberately doesn't) is written down, with retention limits. Deletion path works. Removing a source document removes its traces from indexes and stores (Art. 17). Works council involved. The Betriebsrat (if one exists) knows about the project and the monitoring question is addressed. DPIA question answered. Someone has checked whether a data protection impact assessment is required (Art. 35) — and done it if so.

0/ 8

Deep dive: GDPR-compliant AI by architecture — the network, logging and audit patterns behind these eight points.

Gaps found? Most of them are architecture, not paperwork.

An on-prem deployment answers questions 2, 3 and 5–6 by construction. We'll walk your DPO through the rest — we've sat in that meeting many times.

Talk to us before the audit does