Choosing AI Tools a European Company Can Defend

GDPR compliant AI tools, for a 10-100 person European company, come down to five checks you can do before signing anything. One: a business or enterprise plan that comes with a data processing agreement, because without one you have no contractual control over retention, security, or sub-processors. Two: a written commitment that the provider does not train on your inputs, which business tiers of the major tools typically make by default. Three: a lawful basis for data leaving the EU, either EU hosting where the vendor offers it or a recognised transfer safeguard. Four: staff rules that keep customer and employee data off free and personal accounts, where a pasted customer list can be a reportable breach. Five: a data protection impact assessment before any risky use, such as hiring, staff monitoring, or profiling. On top of GDPR, the EU AI Act already asks every company using AI to ensure a general understanding of AI among its staff. None of this needs a compliance platform. It needs a short checklist and the discipline to write down what you chose and why.

What makes a tool defensible under GDPR?

Defensible means that if a customer, an employee, or a supervisory authority asks "what happens to our data in that tool?", you can answer from documents rather than hope. Four of the five checks are about the vendor.

The processing agreement. GDPRwise's guide to AI tools puts the stakes plainly: "Without one, you have no contractual control over retention, security or sub-processors." Business versions of the common tools usually include a DPA and, in the guide's words, avoid training on your inputs by default. Free and consumer tiers usually include neither.

Where the data goes. Many AI providers are US-based or run on US servers, so transfers need a safeguard: the guide names the EU-US Data Privacy Framework or standard contractual clauses. EU data storage is not mandatory, but, as the guide says, "worth choosing where available." Ask the vendor which one applies to your plan and keep the answer.

The risky uses. For hiring, staff monitoring or evaluation, profiling, or anything touching sensitive data, the guide's instruction is to "do a DPIA first and make sure a human makes the final decision." A DPIA sounds heavier than it is at this size: a few pages describing the processing, the risks, and the mitigations, written before the tool goes live.

What does the EU AI Act add for a small company?

Less than the headlines suggest, and one thing that already applies. Article 4 of the Act, the AI literacy obligation, entered into application on 2 February 2025, according to the European Commission's own guidance, with supervision and enforcement rules applying from 2 August 2026. It covers both providers and deployers, which means a company that merely uses AI tools is in scope.

The Commission's description of what that means is reassuringly modest: at minimum, "ensure a general understanding of AI within their organisation," taking into account the risks of the systems used and the knowledge of the staff. The guidance states the obligation "does not require providers or deployers to guarantee any specific level of AI literacy of any individual," and that no certificate is required, though keeping internal records of training or other initiatives is sensible. In practice the one-hour training session from the adoption plan I described in An AI Adoption Plan for a 10-100 Person Company, plus the written usage rules, is most of the way there. Keep a note of who attended and what was covered.

Deadlines for the heavier, high-risk obligations have been the subject of amendment, so for anything beyond the literacy duty and ordinary transparency, check the current official text rather than a blog, this one included.

Why are free accounts the real risk?

Because the breach is a paste away. The GDPRwise guide spells out the scenario: "When someone pastes a customer list into a free chatbot, that can be a personal data breach," one that must be documented and, where it is likely to create a risk to the people concerned, reported to the supervisory authority within 72 hours. Its verdict on free or personal accounts is blunt: not suitable for personal data of customers or employees.

This is the compliance face of the pattern I described in Shadow ChatGPT: Your Team Already Uses AI. Now What?. The fix is the same: an approved tool on company accounts with a DPA, and the one-page policy from The One-Page AI Usage Policy Your Company Actually Needs naming which data never goes into any AI tool. Quality is a separate axis from compliance, and a defensible tool can still answer wrongly; the failure patterns in Your AI Agent Has the Same Red Flags as Your Ex apply to the most compliant vendor on the market.

The checklist to keep on file

For every AI tool you approve, one page with seven lines: the plan tier and that it is a company account; the DPA, signed and dated; the no-training commitment, quoted from the vendor's terms; the data location and the transfer safeguard that applies; admin controls, who can add users and export data; retention and deletion, how long inputs are kept and how to delete them; and the DPIA, done or documented as not needed and why. Store it next to the usage policy. When the question comes, you answer from the file.

Picking tools against exactly this checklist, with the DPAs and settings in place, is part of my AI Adoption Sprint: usage mapping, tool selection and setup with compliant options included, plus the policy and training, in 2 days + follow-up at EUR 1,800 fixed.

FAQ

Is EU hosting mandatory? No. It is the simplest way to avoid transfer questions, so choose it when a vendor offers it, but US-hosted tools are usable with a valid safeguard such as the Data Privacy Framework or standard contractual clauses.

Do we need a lawyer for this? For the five checks and the file, usually not. Bring one in for a DPIA on genuinely risky processing, for sector rules in health or finance, or when a customer contract imposes its own AI clauses.

Can we just ask the vendor if they are GDPR compliant? Ask for the documents instead: the DPA, the sub-processor list, the training clause, the data location. "We are compliant" on a sales page is not something you can show a regulator.

What if the AI Act deadlines change again? Then your file still holds, because its contents are GDPR obligations plus the literacy duty that already applies. Build the file now; adjust to the Act's final timeline when it is confirmed.