Deploying GenAI Without Breaking GDPR
The project has been frozen for three months. An assistant meant to help the support team answer faster, technically ready, never shipped. The reason is not technical. In a steering meeting someone said four letters, GDPR, then two words, AI Act, and the project stopped dead, out of fear of getting it wrong.
I see this scene more and more often. A company perfectly able to build the tool, paralysed at the thought of plugging it in. The fear of the penalty does more damage than the penalty ever would.
Three texts, one requirement
GDPR. The EU AI Act. The NIST AI Risk Management Framework. Three documents, three vocabularies, three origins. We read them as three walls to climb. They are not.
Read side by side, they say roughly the same thing, and that thing looks a lot like a hygiene checklist for engineers. Do you know what data you are handling? Do you know where it goes? Is there a human accountable at the end of the chain? Could you replay what happened? Four questions. A leader who can answer them is already compliant on the essentials, long before opening a single article of law.
The rest, the fine risk classification, the registers, the impact assessments, matters too. But it is formatting. The substance fits in four questions.
The four questions that do the job
What data goes into the model? Classify before you connect. Public, internal, personal, secret. An assistant that summarises meeting notes does not play in the same league as a tool that screens job applications or scores a loan file. GDPR calls it minimisation: you give the model only what the task needs, never the whole customer table out of convenience. Half of the compliance problems vanish here, because they should never have entered in the first place.
Where does that data go? This is the hosting boundary, the subject of Sovereign by Default. A request sent to a non-EU API is data leaving the territory, and the legal frame that protects it. For a bland meeting note, it does not matter. For an HR file or a trade secret, it is exactly what GDPR governs. The answer is not “everything on-premises” as a principle. It is the right data in the right place.
Who decides at the end of the chain? The point where the AI Act is firmest. Uses that touch people, hiring, credit, access to a service, are classed as high-risk, and GDPR already forbids a consequential decision being made with no real human involvement. The AI proposes, a human decides and answers for it. This is not a constraint. It is the same governance rule I install everywhere else: the machine does not carry a responsibility it cannot hold.
Could you replay what happened? Traceability. Which prompt, which answer, which model version, which human decision behind it. The NIST framework calls this measuring and managing. In practice it is a log. The day a candidate, a customer, or the regulator asks “why this answer”, the company that can replay the sequence responds in ten minutes. The one that cannot spends three weeks reconstructing what it should have written down.
The real risk is elsewhere
While the official project stays frozen out of caution, the teams have not waited. Someone is already pasting contract clauses into a free chatbot to save time. Someone else runs an HR letter through a tool whose host nobody can name. This is shadow AI, and it, not the scoped project, is where the real GDPR risk lives.
The paradox is cruel. The company that bans AI out of fear of the penalty pushes its people toward the least controlled uses of it. A ban does not remove the use. It makes it invisible.
What I install first
Before the impact assessment, before the register, before a single three-hundred-page document, two simple things.
A one-page usage policy, readable, that says what may be handed to an AI and what is never handed to one. This is the AI usage charter. Not a ten-page rulebook, a compass. And an approved tool, hosted in the right place, put in front of the teams, so that legitimate use has an official path. A team with a good, governed tool has no reason left to go looking for a bad one in secret.
Compliance comes after that, and it comes more easily, because you are documenting a real, bounded practice instead of chasing one you cannot even see. Who, after all, boasts about using an AI to write their meeting notes, their reports, their emails? Nobody.
We restarted the frozen project. Not by reading the regulatory texts, but by answering the four questions, then writing the usage page. The fine-grained compliance came afterward, as a tidy-up, not a precondition.
What I bring into a company is not fear of the regulator. It is the ability to use AI while knowing exactly what you feed it, where it goes, and who answers for it.
Useless laws weaken the necessary ones. — Montesquieu, The Spirit of the Laws, 1748