GDPR compliant AI: what each way of deploying AI makes you do

At a glance

• No AI tool is GDPR compliant on its own, because the GDPR puts the duty to comply, and to prove it, on the controller: the firm that decides why and how personal data is processed.
• An AI vendor that processes personal data for you is your processor, and the GDPR requires a binding contract with it, covering a set list of points.
• Sending personal data in prompts to a provider outside the EU is a transfer, and it is lawful only under an adequacy decision or appropriate safeguards such as the Commission’s standard data protection clauses.
• Having the model run on a device in your own office takes the AI vendor’s processor contract and the transfer question out of the picture, but your lawful basis, any DPIA, security and purpose limits stay with you whatever you buy.
• UK firms start from the same articles, but the UK GDPR has been amended by the Data (Use and Access) Act 2025, including its rules on international transfers, so check the UK text on that point.

Whether an AI tool is acceptable under the GDPR depends on how you deploy it, because the obligations sit with your firm as controller. When a sponsor’s data protection officer asks whether your AI tool is GDPR compliant, the useful answer lists what your chosen deployment requires you to put in place and which of those requirements a vendor carries with you. A five-question test you can apply to any tool follows, then four ways of getting an AI tool scored against it.

Why no tool is GDPR compliant on its own

The GDPR assigns obligations to roles, not to products. A controller is the body that “determines the purposes and means of the processing of personal data”, and a processor is one that “processes personal data on behalf of the controller”. When someone at your firm pastes a client’s file into a chatbot, your firm decided that, so your firm is the controller.

The controller must implement appropriate technical and organisational measures and be able to demonstrate that processing complies with the Regulation. It must also use only processors that provide sufficient guarantees. A vendor can take on processor duties, but choosing it, and showing the choice was sound, stays with you.

Can an AI tool be certified GDPR compliant? The GDPR provides for data protection certification, but a certification does not reduce the responsibility of the controller or the processor for compliance. When a vendor calls its product “GDPR compliant”, it usually means it will sign a processor contract and runs security measures. Both matter, and they cover the vendor’s half only.

What data is out of scope? The GDPR’s principles do not apply to anonymous information, meaning data that cannot be linked to a person by any means reasonably likely to be used. Pseudonymised data, such as records where names are replaced by codes that someone can reverse, still counts as information on an identifiable person. A coded subject ID in a trial dataset is pseudonymised if the key exists anywhere, so treat it as personal data.

The test to apply to any AI tool: five questions

1. Who is the processor, and is there a processor contract?

Processing by a processor must be governed by a contract that is binding on the processor and sets out the subject matter, duration, nature and purpose of the processing, the type of personal data and the categories of data subjects. That contract must require the processor to act only on your documented instructions, keep its staff bound to confidentiality, take the security measures the GDPR requires, help you answer data subject requests, delete or return the data when the service ends, and give you the information needed for audits.

A processor may not engage another processor without your prior written authorisation, and under a general authorisation it must tell you about changes and give you the chance to object. So ask for two documents: the vendor’s data processing agreement (DPA) and its subprocessor list. A consumer account that comes with no DPA gives you nothing to satisfy that contract requirement with.

2. Where are prompts and documents processed, and is that transfer lawful?

A transfer of personal data to a country outside the EU may take place only if the controller and processor meet the GDPR’s transfer conditions, including for onward transfers. The two routes most vendors rely on are an adequacy decision by the Commission or appropriate safeguards such as standard data protection clauses adopted by the Commission, on condition that data subjects have enforceable rights and effective legal remedies.

Ask which countries the vendor and each subprocessor process data in, and which mechanism covers each one. An “EU region” setting answers where the servers are. Also ask whether support staff outside the EU can reach the data, and whether a foreign authority could compel the vendor to hand it over.

3. Is anything you type used for training or kept, and for how long?

Personal data must be collected for specified purposes and not further processed in a way incompatible with them. It must also be kept no longer than necessary for those purposes. If a vendor trains its models on your prompts, your client’s data is being used for the vendor’s purpose. Check the training default and the retention period for the exact tier your staff use, because the same vendor often has different terms for its personal and business plans.

4. Is a DPIA required for this use?

Where processing, in particular using new technologies, is likely to result in a high risk to people’s rights and freedoms, the controller must carry out a data protection impact assessment before the processing starts. A DPIA is required in particular for processing special categories of data, such as health data, on a large scale. Supervisory authorities publish lists of processing that needs one, and you must seek your DPO’s advice where you have designated one.

A CRO summarising trial participant records, or a medtech firm feeding complaint files into an AI tool, should check its authority’s list before switching anything on. The DPIA is yours in every deployment model below.

5. Can you meet access and erasure requests for what’s in the tool?

People have the right to access the personal data you hold about them and, on the listed grounds, to have it erased. Chat histories that contain a client’s employee’s name are in scope. Ask how you would search the tool for one person and delete what you find, and whether the vendor’s contract commits it to help.

Four deployment models, scored against the test

Each column is a way of getting an AI tool. Each cell says what the model leaves you to put in place.

Obligation	Consumer chatbot on a personal account	Business tier of a US SaaS	EU-hosted SaaS	Managed device in your office
Processor contract	Usually none on offer, so the requirement cannot be met	You need the vendor’s DPA and subprocessor list	You need the vendor’s DPA and subprocessor list	Not applicable for the model. Check the vendor that maintains the device
International transfer	Likely, to the vendor’s home country, with no contract to cover it	Applies unless processing stays in the EU. You need adequacy or appropriate safeguards	Check subprocessors and support access from outside the EU	Not applicable for the model
Training and retention	Set by each employee’s account settings	Check the default and the retention terms	Check the default and the retention terms	You set it
DPIA	Yours	Yours	Yours	Yours
Access and erasure	Data sits in staff’s personal accounts, out of your reach	Admin export and delete tools, plus processor assistance	Admin export and delete tools, plus processor assistance	Your storage and logs
Security	The vendor’s, with no audit right for you	Shared between vendor and your account settings	Shared between vendor and your account settings	Shared with the vendor that runs it, under contract

Two columns need more than the table gives them. The consumer column is the one most firms already have, because staff sign up on their own, and it fails the first question outright. The managed-device column is not obligation-free: if the vendor that maintains the device can reach the data on it, that vendor may be acting as your processor, so ask exactly what its access covers.

An “EU-hosted” label shortens the transfer row and nothing else. The processor contract, the DPIA and the erasure questions are the same as for a US vendor.

What the model itself carries: the EDPB’s opinion on AI models

A separate question is whether the model contains personal data from its training. In its opinion on AI models, the European Data Protection Board considers that AI models trained with personal data cannot, in all cases, be considered anonymous, and that a claim of anonymity must be assessed case by case. For a model to count as anonymous, both the likelihood of extracting training data about individuals and the likelihood of obtaining it through queries must be insignificant.

For a firm that deploys a model rather than builds one, the EDPB says supervisory authorities should consider whether the deploying controller made an appropriate assessment that the model was not developed by unlawfully processing personal data. In practice, ask your AI vendor what the model’s publisher documents about training data. This question follows the model wherever it runs, including on a device in your office.

What stays your job whatever you buy

These obligations do not move to a vendor in any column of the table:

• A lawful basis for each use. Processing is lawful only if at least one of the grounds the GDPR lists applies, such as a contract with the person or your legitimate interests.
• Data minimisation. Personal data must be adequate, relevant and limited to what is necessary for the purpose. Put the paragraph in the prompt, not the whole file.
• Purpose limitation. Using client documents to answer that client’s question is a different purpose from building a firm-wide knowledge base out of them.
• Protection by default. By default, only the personal data necessary for each purpose may be processed, and that includes how accessible it is. An agent that can read every folder on the server is a default worth reviewing.
• Security appropriate to the risk, which the controller must implement alongside any processor.
• Accountability. The controller must be able to demonstrate compliance with all of the above.

A vendor’s DPA can promise help with several of these. It cannot choose your lawful basis or write your DPIA.

Where IntraMuros fits (and where it doesn’t)

IntraMuros is the managed-device column of the table. Mayet, a British company that builds software for pharma, biotech, medical devices, clinical research and other regulated industries, delivers a device to your office and, once it is plugged in, configures it remotely in a few hours. It connects the device to your documents and email, and can connect it to software such as an eQMS, eTMF or CTMS, whether those are on your premises or in the cloud, and then patches, monitors and backs it up. The model runs on the device itself. Prompts, documents and answers are stored on the device and do not go to an AI company, so the AI vendor’s processor contract and the transfer question for the AI step do not arise. On question 3, your documents and conversations are never used to train any AI model, by Mayet or anyone else, and retention is yours to set. Staff sign in with the Microsoft or Google work account they already have, and the agent works with that person’s permissions, which helps with the point about default access above: a coordinator who cannot open a sponsor’s study folder or its records in connected software gets no answers drawn from them. Every answer shows the document it came from. See how it works.

That leaves the vendor that maintains the device. Mayet connects to the device to update, monitor and back it up. It is still the one outside party that administers the device, so list Mayet as a vendor, ask what its access covers, and decide with whoever handles data protection at your firm whether your contract with Mayet needs processor terms.

Everyone at the firm can use it, and maintenance is £1,000 a month or £10,000 a year for one device. The device is a one-off charge with set-up included: a firm of 5 to 10 people fits Base at £4,500, and a firm of 25 fits Enterprise at £12,000. When it is busy, questions wait their turn. See pricing. If a sponsor’s data protection questionnaire is what prompted the question, the quality and audit page covers answering due-diligence questions from what your firm has already approved, with each answer linked to its source.

If your AI use involves no personal or confidential sponsor data, or your sponsors already accept a business-tier cloud tool under a DPA, a cloud subscription is cheaper to start. IntraMuros is also the wrong fit if you want to run and tinker with the device yourself, or to train or fine-tune your own models. Whatever you choose, the lawful basis and the DPIA stay with you.

For the wider decision between cloud AI and a device in your office, see on-premise AI and private AI for business. If you also hold US health data, the HIPAA side of the same question is in is there a HIPAA compliant AI.

Sources

• Regulation (EU) 2016/679, General Data Protection Regulation (Articles 4(7), 4(8), 5(1)(b), 5(1)(c), 5(1)(e), 5(2), 6(1), 15, 17, 24(1), 25(2), 28, 28(1), 28(2), 28(3), 28(3)(a) to (h), 28(3)(e), 32, 32(1), 35, 35(1), 35(2), 35(3)(b), 35(4), 42(4), 44, 45 and 46; Chapter V; Recital 26)
• EDPB Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models (17 December 2024; executive summary and paragraph 129)