AI tools are everywhere, and so are the rules.
Staff are already using AI for writing, images, support and screening. The AI Act and the GDPR both apply to how you use it, and customers and candidates are starting to ask. A short checklist, a list of vendor questions and a few lines of wording cover most of it.
Using AI can make you a "deployer"
The AI Act gives duties to businesses that use AI systems, not only those that build them. Most everyday uses carry light duties, but some, such as hiring tools, are treated as high-risk.
Prompts can leak data
Pasting customer or employee data into an AI tool is a data transfer with GDPR consequences. The data minimisation notes show what to keep out and how to set tools safely.
Some AI use must be disclosed
People should be told when they are talking to a chatbot, and certain AI-generated content must be labelled. The pack gives wording you can use.
Four parts. One practical approach to AI at work.
Each part stands on its own and also points to the next: the checklist sorts your tools by risk, the vendor questions test them, and the wording and minimisation notes put the result into practice.
High-risk checklist
Find out whether a use of AI needs extra care.
- Whether a use is prohibited, high-risk or subject to transparency rules
- Common risky uses, such as recruitment, credit decisions and education
- What to do if a tool might be high-risk
Vendor assessment questions
Ask the right things before you adopt a tool.
- Questions to ask AI vendors about data, training and security
- What to request: documentation, instructions for use and data processing terms
- Red flags to watch for before you sign
Transparency wording
Tell people when AI is involved.
- Notices for chatbots and AI-generated content
- Wording for staff, customers and candidates
- When and where to show it
Data minimisation notes
Use AI without handing over more than you need to.
- What not to paste into an AI tool
- Removing or masking personal data before use
- Settings that limit retention and training on your data
Real wording, not a table of contents.
Two short excerpts from the pack. Highlighted fields are the parts you fill in for your own business.
Telling people they are talking to AI
You are chatting with an AI assistant, not a person. It can answer common questions about [your service], but it can make mistakes. If you need a person, choose “Talk to a human” or contact us at [contact email]. Please do not share sensitive personal details in this chat.
Place this where the chat starts, in plain language and in the languages you serve.
The full pack adds wording for AI-generated images, text and staff use.
Before you adopt an AI tool
- Does the provider use your prompts or files to train its models, and can you opt out?
- Where are data processed and stored, and is there a data processing agreement?
- Can you delete your data, and how long does the provider keep it?
- Does the provider say whether the tool is high-risk under the AI Act, and what it supplies to help you comply?
- What human oversight does the tool allow, and who on your team will use it?
The full list covers security, logging and what to ask about hiring tools.
These are shortened starting points. Your own notices and records must reflect what you actually do, and national rules vary. The pack shows you where to check.
Who it's for, and who it isn't.
A good fit if you
- Use AI tools at work, such as chatbots, image generators or meeting summarisers
- Use or plan to use AI in hiring, customer service or marketing
- Are a small or mid-sized business without a dedicated AI or legal team
- Want simple wording and questions you can use today
Not enough on its own if you
- Build or sell AI systems, where provider duties apply
- Run a clearly high-risk system, such as automated credit or hiring decisions, and need specialist advice
- Process special-category data with AI at scale
- Need a signed, lawyer-reviewed contract; the pack is not legal advice
Four parts. One payment.
Everything on this page, delivered together. Adapt it to your business, update your notices and answer the next question from the same documents.
- High-risk checklist
- Vendor assessment questions
- Transparency wording
- Data minimisation notes
Before you ask —
Who is the AI Tools Compliance Pack for?
Small and mid-sized businesses in the EU that use AI tools such as ChatGPT, image generators and hiring tools, and want practical checklists and wording for EU AI Act and GDPR compliance.
What do I receive?
Four parts: a high-risk checklist, vendor assessment questions, transparency wording and data minimisation notes. You get your download page straight after checkout, with no account to create.
Does the AI Act apply if I only use ChatGPT?
It can. Businesses that use AI systems are "deployers" and have duties that depend on the use. Many everyday uses carry few obligations beyond AI literacy and, in some cases, transparency, while uses such as screening job applicants are treated as high-risk. The pack's checklist helps you sort your uses.
Is pasting customer data into an AI tool allowed?
Only if you have a legal basis, have told people, and the provider is bound by suitable terms, which usually means a data processing agreement. The safest habit is to leave personal data out. The data minimisation notes show how.
Do I have to label AI-generated content?
Some content must be disclosed, such as chatbots that interact with people and certain AI-generated or manipulated media. The rules have exceptions and details, so the pack gives wording for the common cases and tells you where to check.
Is this legal advice?
No. The pack is a practical starting point. The AI Act is new, its application is still being clarified, and your obligations depend on how you use each tool. Have a qualified lawyer review anything you rely on.
What if it isn't what I expected?
Email hello@gdprgard.eu within 14 days for a full refund. No form to fill in.
Use AI with confidence and a paper trail.
Get the risk checklist, vendor questions, transparency wording and minimisation notes in one pack.
Get the Pack — €39