GDPR compliant AI automation: five questions to ask before an AI touches personal data

Alexander Krastev · 2026-10-19

No software is "GDPR compliant" on its own — your organisation is, or is not, in how it uses it. What a tool can do is make compliance easy or hard. Before an AI agent reads invoices, e-mails or customer records, ask these five questions.

1. Where does the data go?

A cloud AI model means the document's text goes to that provider. That can be fine with a data processing agreement — but it is a transfer you have to document. The alternative is a local model on your own server: nothing leaves your network. AIK lets you choose per agent, so the agent reading payroll can stay local while the one drafting a blog post uses the cloud.

2. Can personal data be removed before it leaves?

If you do use a cloud model, personal identifiers — national ID numbers, IBANs, e-mail addresses, phone numbers — can be masked before the call, so the model sees the task, not the person. Names are harder to mask reliably; know that limit.

3. Who can see what?

Each person's files, agents and results should be their own. In AIK every account works in its own folder; administrators can look at others' items only in a logged way, and can change them only with an explicit switch. Agents can be fenced so their tools see only their owner's files.

4. Can you prove what happened?

Article 5(2) asks you to demonstrate compliance. Every action AIK takes goes into an append-only activity log whose entries are chained by hashes, so an edit after the fact shows. Each run keeps what it did, which model it used and what it cost.

5. Can a person stop it — and erase it?

• Human approval: actions that leave the system — sending an e-mail, uploading, deleting — can wait for a person's OK. In AIK this is on by default for every new agent.
• Erasure and export: an account's data can be exported, and erased in one sweep; run records are anonymised rather than kept with a name.
• Marking AI output: under the EU AI Act, AI-generated content that leaves your organisation should say so. AIK marks e-mails, documents and messages — visibly and inside the file.

What this does not replace

Your records of processing, your legal basis, your data processing agreements and your retention rules stay your job. For a client running AIK on its own servers, the data processing agreement and the security brief describe what AIK does and does not do.

More: on-premise AI automation · EU AI Act Article 50: marking AI output.