GDPR-compliant AI in companies

AI systems process personal data almost by default. This guide covers legal bases, third-country transfers, permissions, the EU AI Act and a checklist for procurement.

• Legal basis, purpose limitation and data subject rights per use case
• Third-country transfers: standard contractual clauses and transfer impact assessment
• Permissions inherited from source systems instead of a flat index
• EU AI Act: risk classes, transparency and AI literacy obligations
• A ten-question checklist before procurement