GDPR requires that you have a legal basis for processing personal data, that you do not collect more than you need and that the data is protected. That applies just as much in an AI workflow as in an ordinary system.
AI raises new questions. Is personal data sent to a model outside the EU? Could an assistant show information to the wrong person? That is why we go through the sources before a solution is built, mask personal data where needed and give the assistant the same permissions as the user.
The risk classification in our AI Discovery Sprint covers both the AI Act and GDPR.
