# GDPR and generative AI: a compliance guide > GDPR and generative AI: legal basis, data minimization, processors, data transfers, impact assessments. The steps to compliant AI in your company. URL: https://aiorigin.io/en/ressources/insights/rgpd-agents-ia-conformite-pme-france-2026 Insights Compliance # GDPR and generative AI: a compliance guide for companies As soon as an AI tool processes personal data, the GDPR applies. It is not an obstacle: it is a list of precise questions, best settled before deployment rather than after. UPDATED · OCTOBER 16, 2026 READ · 5 MIN Contents - Does the GDPR apply to generative AI? - Questions to settle before deploying - Choosing and configuring tools - How to go about it: the compliance plan - Points to watch that are specific to AI - GDPR and the AI Act: how the two texts fit together - How AI Origin supports you IN SHORT The GDPR applies to generative AI as soon as personal data appears in a prompt, a document or an output. The company, as data controller, must define the purpose and the legal basis, limit the data shared, bind the provider by contract, check transfers outside the European Union and inform the people concerned. ## Does the GDPR apply to generative AI? Yes, as soon as personal data is processed. It can be found in three places: - In the prompt: a customer name pasted into an assistant, an email to summarize, meeting minutes. - In the documents AI has access to: CRM, customer files, contracts, document bases. - In the output: a summary, a draft response or a profile that mentions people. In most cases, the company using the tool is the data controller: it decides the purposes and the means. The tool provider usually acts as a processor, within the meaning of Article 28 of the GDPR, and must be bound by a contract. The risk is not theoretical. According to KPMG and the University of Melbourne, 48% of employees who use AI at work have already entered company information into public tools. Some of that information concerns people: customers, suppliers, partners. Beware of a common misconception: replacing a name with a code is not enough to take data outside the GDPR. Pseudonymized data remains personal data as long as the person can be re-identified. Only truly anonymized data falls outside the regulation, and anonymizing free text is hard to guarantee. ## Questions to settle before deploying For each use of AI that involves personal data, here are the points to check, with the corresponding GDPR articles. QuestionWhat it impliesReference For what purpose?A specific purpose, for each useArticle 5 On what basis?Contract, legal obligation, legitimate interest or consentArticle 6 Which data?Only what is necessary; caution with sensitive dataArticles 5 and 9 Who is informed?The people whose data is processedArticles 13 and 14 Which provider?A data processing agreement with safeguardsArticle 28 Where does the data go?Outside the European Union, safeguards for transfersChapter V What risks?An impact assessment if the processing presents a high riskArticle 35 Who decides?No decision producing legal effects based solely on automated processing, with some exceptionsArticle 22 What record?An entry in the record of processing activitiesArticle 30 These questions are not specific to AI. But AI makes them more pressing, because uses multiply quickly, often outside any framework. ## Choosing and configuring tools The choice of tool determines much of your compliance. With your IT department and your DPO, check at a minimum: - How the provider uses your data: the contract must rule out training models on your data. - Hosting: where data is processed and stored, and by which provider. For the most sensitive data, hosting in France or on your premises. - The retention period for prompts and outputs, and whether it can be configured. - Access rights: each team sees only the documents that concern it, including through AI. - Traceability: AI actions and human approvals are logged. - Security: centralized authentication, encryption, segmentation. ANSSI, France’s national cybersecurity agency, has published security recommendations for generative AI systems, useful for framing these choices. A tool chosen and configured this way is also the best answer to shadow AI: when a safe solution exists, personal use declines. ## How to go about it: the compliance plan - Inventory current uses, including undeclared ones: which tools, for which tasks, with which data. An anonymous questionnaire encourages honest answers. - Classify data: public, internal, confidential, personal, sensitive. Each category gets a clear usage rule. - Select the authorized tools with the IT department and the DPO, and sign the appropriate data processing agreements. - Write a short AI policy: authorized data, excluded uses, mandatory review, whom to contact when in doubt. Our AI policy guide sets out its structure. - Update the record of processing activities and the privacy notices. - Carry out an impact assessment for the uses that require one: large-scale processing, sensitive data, vulnerable people, combining sources. - Train teams on their own cases: what can be entrusted to AI, what cannot, and why. - Review the setup regularly, with each new tool or new use. The CNIL, France’s data protection authority, has published initial guidance on deploying generative AI: start from an identified need, govern uses, choose a secure system, train people, and set up governance. It is the same logic. ## Points to watch that are specific to AI Accuracy. AI can produce false information about a person. The GDPR requires accurate data: any generated information must be checked before it is saved in a file or a CRM. Data subject rights. Access, rectification, erasure, objection: you must be able to respond to these requests for data processed through AI as well. That means knowing where the data is, hence the importance of traceability. Decisions. AI prepares, a person decides. This principle protects you: a decision that produces legal or similarly significant effects for a person must not rest solely on automated processing. Sensitive data. Health, opinions, data relating to criminal offenses: these fall under a stricter regime. Exclude them from AI uses by default, unless a specific framework is approved by the DPO. Stored outputs. A summary or profile produced by AI that mentions people becomes personal data itself. It follows the same retention and access rules as the file it came from. Connectors. An agent connected to the CRM or the ERP widens access to data. The agent’s rights must be limited to what the use requires, and approved by the IT department. ## GDPR and the AI Act: how the two texts fit together The two regulations apply together. The GDPR as soon as personal data is processed; the AI Act according to the risk level of the use. Since February 2, 2025, Article 4 of the AI Act has required companies that use AI to ensure a sufficient level of AI literacy among their staff. Since August 2, 2026, the transparency obligations have applied: a person who interacts directly with an AI must be informed. Uses listed as high-risk carry stricter obligations. Your DPO remains your first point of contact; our guide on the AI Act in business details the timeline. ## How AI Origin supports you We build compliance in from the operations mapping stage: for each use case, the data involved, the right tool, any need for an impact assessment, with your IT department and your DPO. We help draft the AI policy and train your teams on their real cases. Our tools are designed for security: SOC 2 Type II, hosting in France or on your premises, no model training on your data, logged actions. YOUR QUESTIONS ## Frequently asked questions. Can you use ChatGPT at work and comply with the GDPR? Yes, with a business offering whose contract governs data processing and rules out training on your data, clear rules on authorized data, and information for the people concerned. The same reasoning applies to other assistants. Do you need a data protection impact assessment to use generative AI? Not always. It is required when the processing presents a high risk to people, for example at large scale, with sensitive data or with vulnerable people. The DPO determines whether that is the case. Is the AI provider a processor under the GDPR? Usually, yes, when it processes data on your behalf and according to your instructions. A contract that complies with Article 28 of the GDPR must then govern the relationship. Can you put customer data into an AI tool? Only in a tool approved by the company, for a defined purpose, and limiting data to what is strictly necessary. Consumer services with no contractual safeguards should be ruled out for this data. Who is liable if AI gets something wrong about a person? The company that uses AI remains the data controller. Hence the review rule: generated information is checked before it is saved or shared. SOURCES ## Texts and studies cited in this article. Every figure on this site is sourced. See all our sources. Union européenne, Règlement (UE) 2016/679 relatif à la protection des données (RGPD), April 27, 2016. eur-lex.europa.eu KPMG et Université de Melbourne, Trust, attitudes and use of artificial intelligence: A global study 2025, April 2025, 48,340 people in 47 countries. assets.kpmg.com CNIL, Comment déployer une IA générative ? La CNIL apporte de premières précisions, 2024. cnil.fr ANSSI, Recommandations de sécurité pour un système d’IA générative, April 2024. cyber.gouv.fr Union européenne, Règlement (UE) 2024/1689 sur l’intelligence artificielle (AI Act), June 13, 2024. eur-lex.europa.eu Commission européenne, AI literacy – Questions & Answers (article 4 de l’AI Act), 2025. digital-strategy.ec.europa.eu AICPA, SOC 2® – SOC for Service Organizations: Trust Services Criteria. aicpa-cima.com READ NEXT ## To go further. - GUIDECompany AI policy: contents, drafting, template - GUIDEEU AI Act: what companies using AI must do - Security and privacy: SOC 2 Type II, GDPR LET’S TALK ABOUT YOUR PROJECT ## Let’s talk about your operations. Thirty minutes to review current usage, and tell you where we would start. Your contact The AI Origin team that runs the projects You talk directly with the people who will run your project, from scoping to go-live. No specific project yet? Start with a hands-on session: everyone brings a real problem and leaves with the AI agent that solves it. See step 3, Bring your teams on board Thank you, we have received your request. We will get back to you to schedule a time. ### Write to us in two lines. Your company, the teams involved, what you are seeing. We will get back to you to schedule a time. Write to contact@aiorigin.io Or book a time slot Or write to us: contact@aiorigin.io