Use-case assessment
Purpose, users, data categories, affected people and human involvement in decisions.
Services / AI & data protection
AI governance & data protection
Before a new tool becomes part of everyday work, understand what it does with data.
Discuss your project ↗Our approach
Work with a clear scope.
AI governance connects technology choices with clear responsibilities, usage rules and risk assessment. Where personal data is involved, GDPR requirements need to be considered alongside applicable AI rules.
The scope and specific deliverables are agreed after an initial discussion and review of your activities.
What the work includes
Vendor review
Contract terms, use of data for training, subprocessors, data location and deletion.
Internal policies
Permitted tools, restrictions on confidential data, human oversight and approval processes.
Impact assessment
Assess whether a DPIA is required and support analysis of risks to people’s rights and freedoms.
FAQ
Answers to your questions
Can we put personal data into an AI tool?
There is no universal answer. Check the purpose, lawful basis, vendor terms, transfers and safeguards before use.
Is a vendor contract enough?
A contract is one part of the assessment. Actual data flows, configuration, the parties’ roles and how outputs are used also matter.
What would an AI recruitment review cover?
For example: what applicant data enters the system, how a score is produced, who checks it and how an applicant can challenge a decision.
Does the AI Act replace GDPR requirements?
No. AI rules and personal data protection have distinct, complementary purposes. A system may need both an AI Act assessment and a GDPR assessment of lawful basis, transparency, individual rights and risks.
Let’s start with your question.
Tell us about your organisation, challenge or planned project. We will discuss an appropriate scope of work.
Discuss your project