Company AI standard template (GDPR)

This is the operational layer on top of our AI policy template, with concrete routines, roles and responsibilities for a European business that wants its team using AI under the GDPR and the EU AI Act without a legal department of its own. It is a starting point written by practitioners, not legal advice, so have your DPO or lawyer read it before you adopt it.

Written for small and mid-sized businesses

Few steps first: a one-page policy, business licences, a line in the privacy notice and a training log cover most of the everyday risk.

Realistic scope: built for businesses with 10 to 250 employees, not for a group with its own compliance team.

What is at stake: GDPR fines reach up to €20 million or 4% of worldwide annual turnover, whichever is higher (Article 83(5) GDPR).

Legal basis under the GDPR

Main rule: using AI to run the business more efficiently can rest on legitimate interest, Article 6(1)(f) GDPR.

Requirement: a documented balancing test showing that the business interest outweighs the impact on the people whose data is processed.

Special category data: health, religion, trade union membership and similar data need a separate condition under Article 9 GDPR.

What the EU AI Act asks of you as a user

AI literacy (Article 4): has applied since 2 February 2025. Take measures so staff who use AI understand the tools they use, and keep a record of the training.

Transparency (Article 50): applies from 2 August 2026. Deepfake images, audio or video you publish must be disclosed as AI-generated.

High-risk use (Annex III): AI in recruitment, staff evaluation or credit scoring carries extra duties from 2 December 2027.

Data transfers outside the EU

Anthropic: the data processing agreement incorporates the EU Standard Contractual Clauses. Claude.ai stores data in the US.

EU-only processing for Claude: run it through EU cross-region inference on Amazon Bedrock (called from Frankfurt, eu-central-1) or the EU endpoint on Google Cloud Vertex AI.

OpenAI: offers data residency in Europe for new ChatGPT Enterprise and Edu workspaces and for API projects.

Recommendation: file a transfer risk assessment with your GDPR documentation, and tell customers in your privacy notice when personal data may leave the EU/EEA through AI services.

CEO and management

Decides on AI strategy and budgetApproves new AI toolsIs accountable for the policy being followed

IT lead and data protection officer

Evaluates and buys AI toolsChecks technical security and contractsHandles incidents and decides whether to notify the supervisory authority

Employees

Follow the AI policy and this standardReport problems and suggest improvementsTake part in AI training

Allowed tools

Claude Team or Enterprise (DPA: anthropic.com/legal/data-processing-addendum)ChatGPT Business or Enterprise (DPA: openai.com/policies/data-processing-addendum)Microsoft 365 Copilot (company tenant)Other tools with a signed data processing agreement

Not allowed

• Free ChatGPT or Claude accounts for company data
• Private AI accounts for work
• Tools without a business contract
• Unknown or untested AI services

What is at stake

GDPR: fines up to €20 million or 4% of worldwide annual turnover, whichever is higher (Article 83(5)).

EU AI Act: fines up to €35 million or 7% of worldwide annual turnover for prohibited AI practices (Article 99).

In practice: most everyday AI use in a small business sits in the low and medium rows below, where a policy and business licences carry most of the protection.

Low risk (start here)

Start with these, the GDPR risk is minimal

• Writing and editing text

• Summarising documents

• Translation and proofreading

• Brainstorming ideas

Medium risk (needs the policy)

Fine with business licences and basic documentation

• Drafting email replies

• Customer service support

• Data analysis and reporting

• Marketing content

High risk (avoid, or get legal advice)

Needs a full GDPR assessment, usually a DPIA

• HR decisions and recruitment (high-risk under Annex III of the EU AI Act)

• Legal decisions

• Credit and financial decisions about people

• Special category data (Article 9 GDPR)

The minimum for a small business (2 to 4 hours of work)

Must do:

• A one-page AI policy (copy the template)
• Business licences for your AI tools
• One paragraph about AI in the privacy notice
• An email to staff with the rules
• A log of who has had AI training (Article 4 AI Act)

Only when the risk is high:

• A data protection impact assessment (DPIA), which Article 35 GDPR requires when processing is likely to result in a high risk to people
• Legal review of each vendor contract
• Ongoing monitoring of the AI system

When something goes wrong

1. STOP using the tool straight away

2. DOCUMENT what happened (screenshot)

3. REPORT to the IT lead within 2 hours

4. THE DPO decides whether to notify the supervisory authority, within 72 hours of becoming aware of a breach (Article 33 GDPR)

5. FOLLOW UP with corrective action

Built on the GDPR, the EU AI Act and the satori. AI policy template • Adapt it to your own business • Not legal advice

We use analytics cookies to see which pages people read, and marketing cookies stay off unless you tick them under Details.

Cookie policy

Documents