Artificial Intelligence in the Workplace

Artificial Intelligence (AI) in the Workplace, used responsibly.

GDPR and the EU AI Act in step, from tool selection to staff policy.

What we deliver

From obligation to advantage.

We assess the use of AI systems and AI-powered tools in your company under GDPR and the EU AI Act, advise on setup, operation and output optimisation, draft policies for employees, and review provider contracts for data processing terms and third-country transfer.

  • AI consulting across the full lifecycle: setup, operation, output optimisation
  • Risk classification of AI systems under the EU AI Act
  • Data protection impact assessment for AI-driven processing
  • Review of AI provider contracts for DPA terms and third-country transfer
  • Policies for employee use of AI tools
  • Training on transparency and labelling obligations

How we work

From the inventory to the policy.

  1. Step 01

    Inventory

    We map which AI systems and AI tools are already in use in your company, officially sanctioned or as shadow IT.

  2. Step 02

    Risk assessment

    Classification under the EU AI Act (prohibited, high-risk, transparency-obligated or minimal-risk practice) and a data protection assessment under Art. 35 GDPR.

  3. Step 03

    Policy & training

    We draft an internal AI usage policy and train employees on opportunities, limits and reporting obligations.

AI with a system

Between opportunity and regulation.

Whether a writing assistant, a customer-service chatbot or AI-assisted candidate screening: artificial intelligence is already in use in most companies, often faster than data protection and internal rules can keep up. Using AI responsibly means mastering two sets of rules at once. Companies in Frankfurt am Main and the Rhine-Main region we accompany from picking the tools to the internal policy.

Two frameworks that interlock

The GDPR governs whether and how personal data may flow into AI systems (legal basis, purpose limitation, data minimisation, and where required a data protection impact assessment under Art. 35 GDPR). The EU AI Act (Regulation (EU) 2024/1689) regulates the AI system itself, depending on its risk. Both apply in parallel; we assess them in a single pass instead of reviewing them in isolation.

The four risk classes of the EU AI Act

  • Unacceptable risk (Art. 5 EU AI Act, prohibited since February 2025): e.g. social scoring, manipulative systems or emotion recognition in the workplace.
  • High risk (Annex III): for example AI in recruitment, credit scoring or critical infrastructure, with strict obligations for risk management, data governance, logging and human oversight.
  • Limited risk (transparency obligation, Art. 50 EU AI Act): chatbots must disclose that they are AI; AI-generated content and deepfakes must be labelled.
  • Minimal risk: the vast majority of applications (e.g. spam filters), without special obligations but with advisable internal guardrails.

Provider or deployer? Your role defines the obligations

Most companies are deployers of third-party AI systems (they use a chatbot, say), not their providers. Deployers must use AI as intended, ensure human oversight and inform affected individuals; high-risk systems add further duties. Anyone who develops or substantially modifies AI themselves quickly becomes a provider with considerably higher requirements. We clarify your role before obligations are overlooked.

New from 2 August 2026: the transparency and labelling duties

From 2 August 2026 the EU AI Act applies in general (Art. 113 EU AI Act), and with it Art. 50 EU AI Act carrying the transparency obligations. The provision addresses providers and deployers, with different duties for each. For a company using third-party AI tools exactly two remain: disclosure for deep fakes (para. 4) and notification for emotion recognition (para. 3). The other two paragraphs fall on the provider of the system.

Which cases are actually affected, when and how disclosure has to happen and which reassurances hold, we have written up in detail: Labelling duty under Art. 50 EU AI Act (in German).

Typical areas of use we assess

  • Text and writing assistants (e.g. ChatGPT, Copilot) in everyday work
  • Customer-service and website chatbots
  • AI-assisted pre-selection and screening in recruitment
  • Automated data and document analysis
  • Forecasting and scoring models in sales and finance

More services

What else we cover.

From the blog

Further reading on the topic.

Do you want to use AI safely?

Give us a call. The first conversation is free and without obligation.

Call directly +49 (0)69 27 13 57 20-0
Request a callback →

Frequent questions

What companies ask most often about AI.

What does AI consulting cost?
Unlike the NIS-2 scope assessment or the training sessions, there is no flat fee here. The effort depends on how many AI tools are in use, whether they process personal data and whether a policy already exists. We therefore start with an inventory and then give you a binding range before we go further.
What does artificial intelligence in the workplace actually cover?
From chatbots and writing assistants to AI-assisted candidate screening in recruiting and automated data analysis. Every use raises two separate questions: is the processing of personal data permitted under GDPR, and which risk category does the system fall into under the EU AI Act? We assess both together instead of reviewing isolated tools.
When does the EU AI Act apply?
The regulation entered into force in August 2024 and applies in stages: prohibited practices since February 2025, obligations for general-purpose AI systems since August 2025, and most remaining obligations from August 2026.
Is using ChatGPT at work GDPR-compliant?
That depends on the contract model, the processing involved and what is entered into it. We review the specific provider contract, clarify data processing terms and third-country transfer, and draft an internal usage policy.
What fines and penalties are possible?
Several frameworks apply side by side. EU AI Act (Art. 99 of Regulation (EU) 2024/1689). Prohibited AI practices under Art. 5 EU AI Act, such as social scoring or emotion recognition in the workplace (Art. 99(3) EU AI Act): up to €35 million or 7 % of worldwide annual turnover. Breaches of the remaining obligations, such as the transparency and labelling duties in Art. 50 EU AI Act (Art. 99(4) EU AI Act): up to €15 million or 3 % of worldwide annual turnover. Incorrect, incomplete or misleading information given to authorities (Art. 99(5) EU AI Act): up to €7.5 million or 1 % of worldwide annual turnover. Whichever amount is higher applies. For small and medium-sized enterprises the lower of the two amounts applies instead (Art. 99(6) EU AI Act). GDPR (Art. 83 GDPR). Breaches of the processing principles, the legal bases, data subject rights or transfers to a third country (Art. 83(5) GDPR): up to €20 million or 4 % of worldwide annual turnover. Breaches of controller and processor obligations, such as the record of processing activities, security of processing, breach notification or appointing a data protection officer (Art. 83(4) GDPR): up to €10 million or 2 % of worldwide annual turnover. Whichever amount is higher applies. Alongside a fine, a supervisory authority may order, restrict or prohibit the processing; section 42 BDSG additionally makes certain intentional acts a criminal offence, punishable by up to three years imprisonment or a fine.