We work out with you how your company uses AI, which data may go in and which rules apply. Then we set it up and train your team.
Most employees already use AI, often without management knowing. Three points decide whether that becomes an advantage or a problem.
This is the term for AI tools that employees use privately and without approval for work. Customer data, contracts or source code then end up with providers your company has no contract with.
Every input is processed by the provider of the AI model. Whether it is stored there or used for training depends on the contract and settings, not on the tool alone.
GDPR, the EU AI Act and employment law apply even when only a chat tool is used. Knowing them lets you use AI widely instead of banning it.
An official, governed tool is usually the most effective protection against shadow AI.
Which approach fits depends on how confidential your data is and what the AI should do.
Large AI providers with a business contract: processing in the EU, no training on your data, a data processing agreement. Quick to introduce and very capable. With providers based outside the EU a legal residual risk remains that needs to be assessed.
European and German cloud providers run open AI models in data centres in Germany or the EU. Chosen by public authorities, banks, insurers and healthcare when data should stay under European law.
Open models run on your own GPU servers, on premises or in a data centre. Nothing leaves the company. Effort and cost for hardware and operation are highest.
Everyday work through a cloud AI, confidential work through your own or a European model. The most common approach in larger companies. A clear data classification defines what may go where.
Wherever the AI runs, your company needs these five building blocks.
An internal rule on which tools are allowed, which data may go in and who checks results. Short enough to be read.
If a provider processes personal data on your behalf, a contract under Art. 28 GDPR is required. For providers outside the EU, a legal basis for the transfer is also needed (Art. 44 et seq. GDPR).
A written assessment of risks before use. Mandatory where processing is likely to result in a high risk to data subjects (Art. 35 GDPR), for example with health or employee data.
Deployers of AI systems take measures to support the AI literacy of their staff (Art. 4, as applicable since 27 July 2026). High-risk uses, such as personnel decisions, bring further obligations.
In Germany, AI tools that can evaluate employee behaviour or performance are subject to co-determination (Section 87(1) no. 6 Works Constitution Act). A works agreement creates clarity for both sides.
Five steps, bookable individually or as a programme.
Which AI is already in use, officially and unofficially
Define which data may go into which AI
Cloud, European cloud, own operation or hybrid
AI policy, DPA, impact assessment, works agreement
Set up the tool, train staff through the GAD Academy
Consulting and implementation from one source: GRC & Compliance for the rules, AI Solutions for the technology.
We record which AI tools are in use and which data flows out through them.
Providers and models compared on data protection, performance and cost, with a written recommendation.
Draft for approval by management, aligned with your data classes.
Review of provider contracts, impact assessment, template for the works agreement.
We set up the tool, connect it to your systems or build your own AI in the data centre.
AI literacy for staff and managers through the GAD Academy, with a GAD certificate of attendance.
Legal status: GDPR, German Works Constitution Act and EU AI Act as applicable on 19 October 2026, Art. 4 EU AI Act as amended by Regulation (EU) 2026/1744. This page does not replace legal advice in individual cases.
Yes, if the company governs it. This requires a business contract with the provider, an AI policy that defines which data may go in and, for personal data, a data processing agreement under Art. 28 GDPR. Private accounts should be excluded for company data.
Companies deploying AI systems take measures to support the AI literacy of their staff (Art. 4 as amended by Regulation (EU) 2026/1744). Prohibited practices under Art. 5 have been banned since February 2025. High-risk uses, such as personnel decisions, bring additional obligations.
If the AI processes personal data and this is likely to result in a high risk to data subjects, yes (Art. 35 GDPR). This applies, for example, to health data, employee data or automated assessments of people.
In Germany, if the AI tool is capable of monitoring employee behaviour or performance, the works council has a right of co-determination (Section 87(1) no. 6 Works Constitution Act). This applies to many tools because they log inputs and usage.
Yes, with open models on your own servers, on premises or in a data centre. These models are good today for text, summaries and knowledge search. For very demanding tasks the large cloud models are usually stronger, which is why many companies combine both approaches.