Artificial intelligence is changing how companies work. At the same time, data protection in the EU is not an optional feature — it's a fundamental right. For many decision-makers in Austria, this raises a central question: Can we use AI without violating the GDPR?
The answer: Yes — if you do it right. AI and data protection are not contradictory; it's a question of architecture, processes, and choosing the right partner.
This guide shows which rules apply, what the new EU AI Act concretely means, and how to set up AI projects compliantly from the start.
Why Data Protection Is Especially Important with AI
AI systems frequently process large volumes of data — including potentially personal data. This ranges from customer names in emails to employee data in HR systems to user behavior on websites.
The GDPR (General Data Protection Regulation) has regulated since 2018 how personal data may be processed in the EU. For AI applications, this creates concrete requirements:
-
Purpose Limitation (Art. 5(1)(b) GDPR): Data may only be used for the purpose for which it was collected. If customer data was collected for order processing, it may not be used for training an AI model without further justification.
-
Data Minimization (Art. 5(1)(c) GDPR): Only as much data as actually needed may be processed. An AI system that processes all available employee data even though it only needs project data violates this principle.
-
Transparency (Art. 13, 14 GDPR): Data subjects must be informed that and how their data is processed — even when AI is involved.
-
Automated Individual Decision-Making (Art. 22 GDPR): Decisions based solely on automated processing that produce legal effects are generally prohibited — unless there is explicit consent, a legal basis, or the decision is necessary for a contract.
The EU AI Act: What Changes in 2025 and 2026
With Regulation (EU) 2024/1689 — the EU AI Act — the European Union has created the world's first comprehensive legal framework for artificial intelligence. The regulation was published in the EU's Official Journal in August 2024 and takes effect in stages.
Risk-Based Approach
The EU AI Act classifies AI systems by risk into four categories:
| Risk Level | Regulation | Examples |
|---|---|---|
| Unacceptable Risk | Prohibited | Social scoring, manipulative AI, untargeted scraping of biometric data, emotion recognition in the workplace |
| High Risk | Strict requirements | AI in recruitment, credit scoring, education, critical infrastructure, law enforcement |
| Limited Risk | Transparency obligations | Chatbots (labeling as AI), deepfakes, AI-generated text |
| Minimal Risk | No requirements | Spam filters, AI-powered games, recommendation systems |
Application Timeline
The EU AI Act's provisions apply on a staggered schedule:
- February 2025: Prohibitions on AI systems with unacceptable risk are already in effect. Social scoring, manipulative AI, and untargeted biometric scraping are banned.
- August 2025: Requirements for General-Purpose AI (GPAI) models and codes of conduct take effect. GPAI model providers must provide technical documentation and comply with copyright law.
- August 2026: Main provisions for high-risk AI systems become applicable. Strict requirements for risk management, datasets, documentation, transparency, human oversight, and cybersecurity.
- August 2027: Extended obligations for high-risk AI systems used as safety components in products.
What Does This Concretely Mean for Austrian Companies?
If your company uses or plans to use AI, your obligations depend on the risk profile of the system:
- Do you use a chatbot on your website? → Limited risk. You must transparently inform users that they are interacting with an AI.
- Do you use AI to pre-screen job applications? → High risk. From August 2026, strict requirements apply: risk assessment, training data quality assurance, logging, human oversight, and documentation.
- Do you use AI agents for document analysis? → Typically minimal or limited risk, as long as no automated decisions with legal effect are made.
GDPR and AI: The 10-Point Checklist
This checklist helps you set up AI projects in a data-protection-compliant manner from the start:
1. Clarify the Legal Basis
Before using data for an AI system, you need a legal basis under Art. 6 GDPR. The most common options:
- Legitimate Interest (Art. 6(1)(f)): Possible if processing is necessary for the business purpose and the interests of data subjects do not prevail. Requires a documented balancing test.
- Consent (Art. 6(1)(a)): Voluntary, informed, specific, and revocable. Often difficult with AI training since the purpose must be clearly defined in advance.
- Contract Performance (Art. 6(1)(b)): If the AI processing directly serves to fulfill a contract with the data subject.
2. Conduct a Data Protection Impact Assessment
For AI systems that pose a high risk to the rights and freedoms of natural persons, a Data Protection Impact Assessment (DPIA) under Art. 35 GDPR is mandatory. This particularly applies to:
- Systematic profiling
- Automated decision-making
- Processing of special categories of personal data (health, religion, etc.)
3. Implement Privacy by Design
Data protection must be built into the architecture of an AI system from the start (Art. 25 GDPR). Concretely, this means:
- Only collecting and processing necessary data
- Anonymization or pseudonymization where possible
- Implementing access controls and encryption
- Logging data processing activities
4. Ensure Data Minimization
Use only the data required for the specific purpose. Ask for every data field: Does the AI system actually need this data? Remove names, email addresses, and other personal data from training data wherever possible.
5. Ensure Transparency
Inform data subjects:
- That AI is being used
- Which data is being processed
- For what purpose
- Who is responsible
- What rights exist (access, deletion, objection)
Update your privacy policy accordingly.
6. Properly Regulate Data Processing Agreements
If you use cloud-based AI services (OpenAI API, Azure AI, Google Cloud AI), the provider is typically a data processor under Art. 28 GDPR. This requires:
- A data processing agreement (DPA)
- Verification of whether data is transferred to third countries
- Ensuring adequate safeguards (Standard Contractual Clauses, adequacy decisions)
7. Check Data Residency
Where is your data processed? Since the Schrems II ruling by the CJEU, strict rules apply to data transfers to third countries:
- EU/EEA: Unproblematic
- USA: Possible under the EU-U.S. Data Privacy Framework (valid since July 2023, EU Commission adequacy decision)
- Other Third Countries: Only with Standard Contractual Clauses and Transfer Impact Assessment
For particularly sensitive data, an on-premise solution or a European cloud may be the safest option.
8. Build in Human Oversight
AI should support decisions, not make them autonomously — especially when they have legal effects on individuals. Build human-in-the-loop processes:
- Results are reviewed by humans before taking effect
- Employees can override AI recommendations
- Critical decisions require explicit human approval
9. Technically Implement Data Subject Rights
Your AI system must enable data subject rights:
- Right of Access (Art. 15): What data is being processed?
- Right to Erasure (Art. 17): Can data be removed from the system?
- Right to Rectification (Art. 16): Can incorrect data be corrected?
- Right to Object (Art. 21): Can data subjects object to processing?
For AI models trained on personal data, implementing the right to erasure can be technically challenging. Document your solution.
10. Maintain Documentation
Document:
- Which AI systems are in use
- Which data is being processed
- The legal basis for each processing activity
- Completed data protection impact assessments
- Data processing agreements
- Technical and organizational measures
This documentation is not only legally required (Art. 30 GDPR) but also the foundation for accountability under the EU AI Act.
Common Mistakes in AI Projects
1. Using Cloud APIs Without a Data Processing Agreement
Many companies use AI APIs from US providers without checking whether a DPA exists and whether data is transferred to the USA. Most major providers (OpenAI, Microsoft, Google) now offer GDPR-compliant contracts and European data centers — but you must actively configure these.
2. Sending Personal Data in Prompts
When employees copy customer data into ChatGPT or similar tools, personal data may leave the controlled corporate environment. Solution: Enterprise versions with data protection guarantees or on-premise models.
3. No Processing Records for AI Systems
AI applications are often introduced "on the side" without being included in the records of processing activities. Every AI application that processes personal data must be documented there.
4. Forgetting the DPIA
For AI systems with profiling, automated decision-making, or the processing of sensitive data, a data protection impact assessment is mandatory — not optional.
5. Failing to Inform Data Subjects
Customers, employees, or applicants are not informed that their data is being processed by an AI system. This is a violation of the GDPR's transparency obligations.
How Ai11 Implements GDPR-Compliant AI
At Ai11 Consulting, data protection is not an afterthought but an integral part of every AI project. Our approach:
- Privacy by Design: Every architectural decision considers GDPR requirements from day one.
- European Infrastructure: Wherever possible, we rely on European cloud providers and data centers. For particularly sensitive data, we offer on-premise solutions.
- Data Minimization: Our AI agents process only the data they actually need. We implement automatic anonymization and pseudonymization.
- Human Control: Our solutions are designed so that humans retain control — with configurable approval processes and transparent decision paths.
- Documentation: Every project is delivered with complete compliance documentation, including records of processing activities, DPIA (where required), and DPA templates.
FAQ: GDPR and AI in Austria
Can I Use ChatGPT or Other AI Tools in My Company?
Yes, but under conditions. Enterprise versions from OpenAI, Microsoft, or Google offer GDPR-compliant contracts and guarantee that inputs are not used for model training. Free versions generally do not offer these guarantees. Important: Employees should not enter personal data into non-compliant AI tools.
Do I Need to Conduct a Data Protection Impact Assessment (DPIA)?
If your AI system processes personal data and involves systematic evaluation, profiling, or automated decision-making, a DPIA under Art. 35 GDPR is mandatory. When in doubt: Yes, conduct a DPIA. It never hurts and serves as proof of due diligence.
Does the EU AI Act Also Apply to Small Businesses?
Yes. The EU AI Act applies regardless of company size to everyone who offers or uses AI systems in the EU. However, the regulation provides simplified compliance pathways for SMEs, particularly access to "regulatory sandboxes" and reduced fees.
What Happens If You Violate the EU AI Act?
The penalties are significant: Up to €35 million or 7% of global annual turnover for violations of the prohibitions; up to €15 million or 3% of turnover for other violations. The national supervisory authority — in Austria presumably the RTR (Austrian Regulatory Authority for Broadcasting and Telecommunications) in cooperation with the Data Protection Authority — will be responsible for enforcement.
Can AI Models Be Trained on Our Own Data Without Violating the GDPR?
Yes, if you follow the basic principles: legal basis exists, purpose is clearly defined, data minimization is implemented, data subjects are informed, and security measures are in place. Anonymized data does not fall under the GDPR. For pseudonymized data, regulations still apply but with lower risk.
Planning an AI project and want to ensure it's GDPR-compliant from the start? Contact us for a free consultation.
Sources and Further Reading: