Skip to content

Free AI consultation.Book a call

KROTERION
Book a call
Book a free consultationBook a demo

EU AI Act compliance, with an AI policy and GDPR data protection.

Put the EU AI Act and GDPR into practice in your company, with an AI policy everyone understands.

Book an initial call

Free and without obligation. Or see the packages

Try it outClick throughTry it out

AI register

0 of 4 recorded
  • ChatGPT TeamTexts and emails
  • DeepLTranslations
  • Website chatCustomer enquiries
  • Applicant AIPre screening

Searching for AI in subscriptions, browsers and contracts

AI compliance under the EU AI Act and GDPR, implemented clearly.

Since February 2025, even companies that only use AI have to comply with the EU AI Act. We record your AI applications, classify them by risk level and write an AI policy that everyone on your team understands. We check data protection under the GDPR from the start.

  • Clear classification

    You learn in writing which of your AI applications falls into which risk class and what obligations follow from it.

  • An AI policy everyone understands

    Your AI policy defines which tools are allowed, which data may go into them and who to ask with questions. We write it in plain language.

  • AI literacy in your team

    Anyone who uses AI has to promote AI literacy in their team. In our AI training your team learns to use AI safely, and everyone receives a certificate of attendance.

  • GDPR data protection from day one

    We choose models and providers so personal data stays protected. Where necessary, the AI runs on servers in the EU or directly on your premises.

Risk levels in the EU AI Act. Which obligations apply to your AI?

The EU AI Act classifies AI by its risk to people. The higher the level, the more obligations. Pick a level and see what applies to your company.

Limited risk

This includes AI that talks to people or generates content. The focus is on transparency, because people must be able to recognise that they are dealing with AI.

Examples

  • Chatbot on the website
  • AI generated images and copy for advertising
  • Voice assistant on the phone

Obligations

  • Disclose the use of AI
  • Label AI generated content

How we help

We write the notices, build them into chat and website and set out the labelling in the AI policy.

EU AI Act deadlines. The timeline after the Digital Omnibus.

The EU AI Act applies in stages. Some obligations already apply today to every company that uses AI, others follow until August 2028.

  1. February 2025

    Prohibitions and AI literacy

    Certain AI practices have been banned since then. Anyone using AI must promote the AI literacy of their staff.

  2. August 2025

    Rules for large AI models

    Providers of large models such as GPT or Llama have their own obligations, and the rules on fines apply.

  3. August 2026

    Transparency obligations

    Chatbots and AI generated content must be recognisable as such.

    Today

  4. December 2027

    High risk applications

    Strict obligations apply to AI in HR, credit checks or education. The Digital Omnibus postponed this date.

  5. August 2028

    AI in products

    The high risk obligations then also apply to AI in regulated products such as machinery or medical devices.

EU AI Act and GDPR compliance in four steps.

At the end you have an AI register, a risk assessment, an AI policy and training records. When someone asks, these documents show how your company handles AI.

  1. Record AI applications

    We record which AI tools are in use in your company, including those nobody officially introduced.

    Outcome

    AI register

  2. Classify under the EU AI Act

    Every application gets its risk class under the EU AI Act, plus the resulting obligations and a clear recommendation.

    Outcome

    Risk classification

  3. Write an AI policy and check GDPR

    We write an AI policy everyone understands and check providers, contracts and data flows under the GDPR.

    Outcome

    AI policy

  4. Train AI literacy

    Your team learns to use AI safely and sensibly with examples from their own daily work. Every person receives a certificate of attendance.

    Outcome

    Training certificate

Packages for the EU AI Act and GDPR. Matched to your project.

We put your project together from these packages. You can start with one package or combine several.

  • AI policy and AI Act classification

    We write a clear AI policy for your team and classify each AI application under the EU AI Regulation.

    Policy and AI registerGood starting point

  • AI literacy training

    Your team learns to use AI safely and sensibly while protecting personal data. Everyone receives a certificate of attendance.

    Half a day, on site or online

  • External AI officer

    We take on the duties of an AI officer for your company, without you having to hire anyone.

    Ongoing support

  • GDPR compliant AI systems

    We review providers, contracts and data flows of your AI applications under the GDPR and set up new systems with privacy in mind from the start.

    Review and implementation

  • Security review for AI agents

    We review permissions, prompt injection protection, logs and approvals of your AI agents and show what is still missing before going live.

    Review with report

Tell us what you have in mind. In a free initial consultation we work out the right approach for your project together.

We are not a law firm and do not provide legal advice. We deliver the technical and organisational foundation, and binding legal questions are best clarified with your lawyer.

Book an initial call

Frequently asked questions on the EU AI Act and the GDPR.

Answers to common questions about the EU AI Act, the GDPR and a company AI policy. How we train your team in AI literacy is part of our AI adoption service.

Does the EU AI Act also apply to companies that only use AI?

Yes, as soon as anyone in the company uses AI for work, even if it is only ChatGPT for emails. For most companies the obligations are manageable. They mainly concern AI literacy in the team and transparency towards customers. Short documentation helps you show this if asked.

What did the Digital Omnibus change in the EU AI Act?

Adjusted rules have applied since July 2026. The strict obligations for high risk applications only take effect from December 2027, for AI in regulated products from August 2028. Companies must still promote AI literacy in their teams. Prohibitions and transparency obligations remain in place.

How are the EU AI Act and the GDPR related?

The EU AI Act governs how AI is classified and used. The GDPR governs what happens to personal data. As soon as an AI works with customer or employee data, both apply, which is why we look at them together.

Can we use ChatGPT in our company in line with the GDPR?

That depends on the contract, the provider and the data you enter, such as customer data. We check this under the GDPR for your tools and write the answer into the AI policy so everyone understands it.

What belongs in an AI policy for companies?

The AI policy defines which AI tools are allowed, which data may go into the AI, how AI generated content is labelled and who to ask with questions. We write it in plain language so everyone on the team understands it.

Do we need an AI officer?

The EU AI Act does not require a specific role. It helps, however, if one person keeps an eye on the AI applications, the AI policy and the training. If there is nobody in house for this, we take on the task as an external AI officer.

Do you replace a law firm?

No. KROTERION is not a law firm and does not provide legal advice. We deliver the technical and organisational foundation. You clarify binding legal questions with your law firm, and we are happy to join in.

More services that fit well.

All AI services

Your next step: a free initial consultation.

Tell us which tasks take up a lot of time in your company. We will tell you honestly where AI pays off and where it does not.

  • Video call or on site
  • Free and without obligation
  • Servers in the EU
Book a free consultation

What happens next

  1. Send a request

    A few sentences about your plans are enough.

  2. Consultation

    We listen and give you an honest assessment of what is worth doing.

  3. Clear plan

    You receive a proposal and decide in your own time.