GDPR-Compliant AI in Business
Consulting and implementation for the safe use of AI tools, from Microsoft Copilot to Dragon speech recognition to ChatGPT. We make sure productivity gains and data protection work together instead of against each other.
AI Selection and Consulting
Technical foundation: We review which AI tools fit your business, which providers offer a data processing agreement under Art. 28 GDPR, and where data is actually processed (EU, US, or elsewhere). The result is a clear picture of which tools are safe to use and which are not.
Benefit for you: You make an informed decision instead of relying on vendor marketing claims, and avoid data protection problems from tools that were already rolled out.
Microsoft Copilot
Technical foundation: Copilot in Microsoft 365 automatically inherits your existing permissions when accessing documents, mail, and chats. If permissions in SharePoint and Teams are not properly maintained, Copilot surfaces access rights that were already too broad but simply unused until now. We set up your permission structure correctly before rollout and review Microsoft's data processing terms.
Benefit for you: Your team uses Copilot productively without accidentally exposing personnel files, client records, or patient data to colleagues who should never have had access to them.
Microsoft Dragon Copilot
Technical foundation: Dragon Copilot is the successor to Dragon Medical and combines classic speech recognition with ambient-listening AI that captures the physician-patient conversation in real time. From that conversation, the system automatically drafts structured documentation (findings, orders, referral letters) that the physician must review and approve before it is added to the patient record. Patient consent is required before any recording. We work with you to determine how that consent is documented in your practice, and review the data processing agreement with Microsoft.
Benefit for you: Documentation is created during the conversation itself instead of afterward at a desk. Your practice team gains time for patients instead of paperwork, without losing control over which patient data gets approved.
ChatGPT
Technical foundation: There are significant differences between the free version of ChatGPT and the Business or Enterprise plans: only the paid business plans exclude your input from being used to train the models by default, and come with a data processing agreement. We set up the right plan for your business and draft a clear policy for what staff may and may not enter.
Benefit for you: Your team uses ChatGPT for writing, research, and everyday tasks without trade secrets, patient data, or client data ending up in the wrong plan or the wrong input field.
LibraTech AI for Law Firms
Technical foundation: LibraTech AI (Libra) is an AI workspace built specifically for lawyers and legal teams, offering legal research based on vetted legal sources, automated drafting of contracts and briefs, and document review against your company policies with compliance scoring. It integrates with Word, Outlook, SharePoint, and Kleos, is ISO 27001 certified, and is stated by the provider to be hosted within the European Economic Area (GDPR compliant) and operated with regard to attorney-client confidentiality under German law (BRAO compliant). We review these claims and the data processing agreement before rollout.
Benefit for you: Research and drafting work move faster without client data leaving your firm or attorney-client confidentiality being put at risk, and without giving up your existing Word, Outlook, and SharePoint environment.
From assessment to safe day-to-day use
-
Assessment
Which AI tools are already in use or planned, and what data do they process?
-
Evaluation
Review of data processing, server location, and data processing agreements for each tool.
-
Setup
Configuration of permissions, plans, and security settings based on the evaluation.
-
Policy
Clear, short usage guidelines for your team: what is allowed, and what is not.
-
Ongoing support
New tools and features are reviewed on an ongoing basis before they are put to use.