The Checklist for the Provider
Ask every AI provider about these points:
- Is there a data processing agreement according to Article 28 GDPR?
- Where is the data stored, and which sub-processors are involved?
- Are customer data used for training AI models?
- How are access credentials and confidential fields protected?
- Who in the team sees what, and can this be configured per person?
- Is it logged what the AI has done?
Access Rights: The AI Should Not Display More Than the Human User
A frequently overlooked point: An AI that knows everything can inadvertently provide information to individuals who should not see it. Therefore, the same rights must apply to the AI's responses as to the person making the query. Personal tasks, private calendars, and external mailboxes should not be included in responses to colleagues.
What the EU AI Act Additionally Requires
Since February 2025, companies using AI must ensure sufficient AI competence among their employees (Article 4). Anyone communicating with individuals about an AI must disclose this (Article 50). For high-risk systems, effective human oversight is required (Article 14).
UK, USA, and Canada
In the United Kingdom, the UK GDPR applies with very similar principles. In the USA, there is no uniform federal law, but state laws like the California Consumer Privacy Act exist. In Canada, PIPEDA governs the handling of personal data in the private sector. The checklist above is a good starting point everywhere.
Who Does What?
AIRIS Prepares
- Data Storage in the EU: The database is located in Frankfurt, and files are stored in data centers within the EU. Customer data is not used for training AI models.
- Rights Also Apply to AIRIS: AIRIS only shows each user what they are permitted to see. Tasks and calendars are personal; mailboxes belong to one specific company.
- Logging and Authorizations: What AIRIS does is logged. You determine its level of autonomy per task.
- AI Competence According to the EU AI Act: Training with certification for your team.
You Decide
- The company, not the provider, decides which data belongs in an AI system in the first place.
- Special categories such as health data require separate review.
- This guide does not substitute legal advice.
