Shadow IT Identification
We identify unregulated tools such as DeepL, ChatGPT, or browser extensions and define reviewed alternatives with clear approval rules.
Risk Mitigation
ConsultingServices.aiAI Consulting for SMEsRisk Mitigation & Security
EU AI Act & Compliance: Using AI legally.
The unregulated use of AI tools carries liability and privacy risks. We audit your AI usage, uncover Shadow IT, and develop practical guidelines for GDPR, the EU AI Act, and safe AI adoption.
⏱ Audit Duration
~ 2 - 4 Weeks
(Analysis & Policy)
Initial Audit
from ~3,500 €
(Consulting)
Running Costs
None
(Fixed Price)
EU AI Act Compliance (Factsheet)
Download management summary as a compact fact sheet (PNG/PDF).
Target Audience
For whom is an AI Audit crucial?
Perfect for:
- Companies already utilizing ChatGPT & Co. (even unofficially).
- Executives looking to proactively minimize personal liability risks.
- Organizations requiring safe guidelines for their employees.
Not for:
- Startups training their own foundational High-Risk Base Models.
- Companies strictly banning any use of AI.
- Pure legal counseling (we are IT strategists, not lawyers).
Application Areas
Where an AI Audit offers maximum leverage
GDPR & Customer Data
We review which data may flow into which AI systems, which vendor and contract settings apply, and where technical safeguards are required.
Data ProtectionVendor Management
We screen IT vendors for data flows, roles, documentation, and relevant transparency obligations under the EU AI Act.
Third-Party RiskYour Benefits
What specifically changes
Liability Protection
You document risks in a traceable way and reduce the likelihood of GDPR or EU AI Act issues.
Team Clarity
Through corporate policy, employees know precisely which tools are permitted.
Customer Trust
A transparent AI strategy is a prime competitive advantage during B2B audits.
Room for Innovation
With clear organizational and technical guardrails, the team can experiment more safely and purposefully.
Approach
How the audit works
01
Status-Quo Analysis
Which AI systems are productively or unofficially used? How do the data flows look currently?
02
Risk Classification
Every app is classified by role, use case, and risk class. For sensitive or potentially high-risk systems, we define appropriate controls.
03
Corporate Guidelines
We draft an AI policy with privacy, IT, and business stakeholders and prioritize secure platform setups.
The Backend
Technical Safeguards
Data Loss Prevention (DLP)
Sensitive material such as credit cards, IDs, or personal data can be blocked or masked before it is passed to AI systems.
Private AI Enclaves
For sensitive scenarios, we review isolated cloud or tenant setups, regional processing, access roles, and logging instead of uncontrolled public-tool usage.
Frequently Asked Questions
EU AI Act — clearly answered
Who does the EU AI Act apply to?
The EU AI Act affects providers and deployers of AI systems depending on their role, use case, and risk class. SMEs should document which AI tools are used and which obligations may apply.
Isn't GDPR enough?
GDPR regulates personal data. The EU AI Act adds obligations such as risk classification, transparency, human oversight, and documentation depending on the concrete use case.
How dangerous is ChatGPT Free?
The risk depends on the specific product, plan, and settings. The critical scenario is employees entering confidential data into unapproved AI tools without controls. Clear policies and reviewed enterprise setups reduce this risk.
Concrete Offer
What you get, how long it takes, and how risk is reduced.
- Result
- Risk classification, action list, documentation gaps, and a pragmatic implementation roadmap.
- Timeframe
- 1-3 weeks
- Price anchor
- from 1,900 EUR
- Best fit
- Best when AI use needs to become legally and organizationally cleaner.
Risk reduction
- Pilot before rollout
- Human-in-the-loop and fallback rules
- Documented data flow and handover
Proof material
Review sample deliverables before deciding: pilot report, implementation plan, prompt and fallback set, handover documentation.
View work examplesStandard process
- Maturity check and initial consultation
- Scoped pilot with realistic data
- Rollout decision and handover
Not included by default
External licenses, large-scale data cleanup, major ERP/CRM rebuilds, and legal case-by-case advice are scoped separately before project start.
