GDPR and AI Tools: The 2026 Compliance Checklist

Adopting AI tools in business raises concrete GDPR and EU AI Act compliance questions. This checklist helps you audit an AI tool before deploying it to your team, identifying the critical points to verify.

## The 5-Point Checklist

Before deploying any AI tool, systematically verify:

### 1. Data Hosting and Location
- Where is the data processed by the tool stored?
- Does the vendor offer **EU data residency**?
- Are there **transfers** to the US or other third countries?
- If yes, are they covered by a recognized mechanism (Standard Contractual Clauses, Data Privacy Framework)?

### 2. Contracts and DPA
- Does the vendor offer a **Data Processing Agreement (DPA)**?
- Are **processing purposes** clearly defined?
- Are **sub-processors** listed and identified?
- Does the contract cover your sector requirements (healthcare, finance, legal)?

### 3. Model Training
- Is your **data used** to train the vendor's models?
- Is there a clear, activatable **opt-out** at the organization level?
- Do **Enterprise versions** provide stronger guarantees than consumer versions?

### 4. Data Subject Rights
- How to exercise **GDPR rights** (access, rectification, deletion, portability)?
- Does the vendor effectively delete data on request?
- Is there a **DPO contact point** on the vendor side?

### 5. Certifications and Audits
- Does the vendor have **SOC 2 Type II**, **ISO 27001**, **HIPAA** (where applicable)?
- Is a **bug bounty** or third-party audits in place?
- Is the **incident history** transparent?

## Consumer vs Enterprise Versions

This is probably the most frequent trap. Consumer versions (ChatGPT Plus, Claude Pro, individual subscriptions) are **generally not compliant** with European professional requirements:

- Terms accepted by the individual user, not the organization
- No DPA
- Data potentially used for training
- No centralized admin controls

For team deployment on business data, Business, Team, Enterprise, or API versions with contracts are the only credible options.

## The EU AI Act in Brief

The AI Act classifies AI systems by risk level:
- **Unacceptable risk**: prohibited (social scoring, manipulation)
- **High risk**: strict obligations (healthcare, recruitment, credit access)
- **Limited risk**: transparency obligations
- **Minimal risk**: free

For tools and decisions on AI compliance in your organization, see our [methodology](/en/pages/methodology) and our [Trust Score guide](/en/blog/trust-score-evaluer-outil-ia).

> This content is educational. It does not constitute legal advice. For compliance decisions, consult your DPO or a digital law specialist.