A GDPR-compliant AI assistant for your company documents

An assistant that answers your team's questions from your own documents (procedures, contracts, product sheets, client files) saves real time. But as soon as those documents contain personal data, GDPR comes into play, and rightly so.

“GDPR-compliant” isn't a box a vendor ticks for you. It's a set of technical and organizational choices that you need to be able to explain. Here are the ones that matter.

What “GDPR-compliant” means in practice

For an assistant on your documents, the points to address are almost always the same.

• A legal basis: often legitimate interest or performance of a contract, documented in your record of processing activities.
• Data minimization: index only the documents you need, and remove or mask personal data that isn't needed for answers.
• Location: data hosted and processed in the European Union, or transfers outside the EU properly covered.
• Sub-processors: a data processing agreement (DPA, GDPR Article 28) with each vendor, and the list of their own sub-processors.
• No training on your data: this is usually the default for business APIs, but not always for free or consumer offerings. Check it in the contract, not on a marketing page.
• Retention periods: for indexed documents, the questions asked and the logs.
• Role-based access rights: the assistant must never show someone a document they wouldn't be allowed to open.
• Logs: who asked what, when, and based on which sources.
• Human review for sensitive decisions: the assistant prepares, a person decides. GDPR strictly regulates fully automated decisions that significantly affect people (Article 22).

What about the AI Act?

The EU AI Act entered into force on August 1, 2024 and applies in stages. Prohibited practices and the AI literacy obligation have applied since February 2, 2025, the rules on general-purpose AI models since August 2, 2025, and most of the other rules, including transparency obligations, since August 2, 2026.

For an internal assistant on your documents, two points matter most: users must know they're interacting with an AI, unless it's obvious, and your teams need support to use it well. The heavy obligations target “high-risk” systems (recruitment, credit, access to essential services…). For those, the AI “Digital Omnibus,” in force since July 2026, pushed the deadline back to December 2, 2027, and to August 2, 2028 for AI built into certain regulated products. If your assistant plays a part in that kind of decision, have your case reviewed.

Architecture choices

Most document assistants rely on RAG (retrieval-augmented generation). The system first finds the relevant passages in your documents, then the model writes an answer based only on those passages, citing its sources. Your documents aren't used to train the model: they stay in your database, and only the useful excerpts are sent with each question.

Then you need to choose where the model runs. There are three main options:

• A European provider: Mistral AI hosts data in the European Union by default, while noting that some features may involve transfers to sub-processors outside the EU. Scaleway offers open-source models hosted in Paris and doesn't use your data for training.
• The European region of a major provider: on Microsoft Azure, an EU “Data Zone” deployment processes requests within the EU Data Boundary, whereas a “Global” deployment may process them in any region. OpenAI also offers European data residency for its API, subject to eligibility conditions. The configuration matters as much as the provider's name.
• An open-source model on your own servers or with a European host: maximum control, but heavier to run (servers, updates, monitoring).

A pilot in six steps

There's no need to index everything at once. A pilot of a few weeks is enough to know whether the assistant delivers.

• Pick a specific use case and a group of users (for example, internal support on your quality procedures).
• Select and clean up the documents: current versions, duplicates removed, unnecessary personal data masked.
• Do the GDPR groundwork: legal basis, record of processing, DPAs with vendors, and a data protection impact assessment (DPIA) if the processing is high-risk, for example with health data.
• Build the assistant with role-based access, source citations and logs from day one.
• Test it with fifty or so real questions whose answers you know, and measure: correct answers, incomplete answers, errors.
• Decide based on the numbers: extend, adjust or stop.

What makes a good assistant

An assistant isn't judged by its demo, but by what it says when it doesn't know. A good assistant says “I can't find this information in your documents” instead of making something up, and shows where each answer comes from. That's the behavior to test first.

This is the core of our AI integration offer, from €4,000 excl. VAT: an assistant that answers from your documents, hosted in Europe, with role-based access and human review for sensitive decisions. If you'd like to know whether your case is a good fit, let's talk during a free 30-minute diagnostic.

Sources

• Regulation (EU) 2016/679 (GDPR): eur-lex.europa.eu/eli/reg/2016/679/oj
• Regulation (EU) 2024/1689 (AI Act): eur-lex.europa.eu/eli/reg/2024/1689/oj
• European Commission — AI regulatory framework and timeline: digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
• Future of Privacy Forum — The AI Act implementation timeline under the AI Omnibus: fpf.org/blog/the-ai-act-implementation-timeline-what-changes-under-the-ai-omnibus
• Microsoft Learn — Deployment types (Global, Data Zone, Standard): learn.microsoft.com/en-us/azure/foundry/foundry-models/concepts/deployment-types
• OpenAI — Data controls and European data residency: developers.openai.com/api/docs/guides/your-data
• Mistral AI — Where is my data stored: help.mistral.ai/en/articles/347629-where-do-you-store-my-data-or-my-organization-s-data
• Scaleway — Generative APIs data privacy: scaleway.com/en/docs/generative-apis/reference-content/data-privacy