Rolling out generative AI in your business without thinking about GDPR compliance means risking a data leak, a fine from the CNIL, or a loss of customer trust. The good news is that compliance is not a brake: it is a clear, practical framework that protects the company as much as its users. This guide offers an operational reading of the rules to follow in 2026 when using ChatGPT, Claude, Gemini or any AI tool that processes personal data.
Is Generative AI Compatible With the GDPR
The short answer is yes, provided you respect a few key principles. The GDPR does not prohibit the use of AI. It regulates how personal data is collected, processed, stored and transferred. Any company that uses an AI tool is likely processing personal data: customer names in emails, candidate resumes, meeting transcripts, employee records.
As long as usage is governed and documented, generative AI is perfectly usable. The trap is uncontrolled usage: an employee who copy-pastes a customer file into free ChatGPT, a manager who has resumes analyzed without informing the candidate, a support team that transcribes calls without consent. These practices, common in 2025, are the real problem.
The Five Main Risks to Know
When it comes to AI compliance in business, the same risks always come up. Understanding them is already a way to protect yourself.
1. Data Leaks From Using Free Tools
The free versions of ChatGPT, Claude or Gemini may reuse your data to train the models. In practice, the content of a customer file sent to the AI can, in theory, resurface in another user's response. It is rare, but it is documented. The only safe way is to switch to the Team, Enterprise or API versions with a contractual no-training commitment.
2. Data Transfers Outside the EU
OpenAI, Anthropic and Google are American companies. Data sent to their APIs may pass through servers outside the EU. The GDPR regulates these transfers through Standard Contractual Clauses and certifications such as the Data Privacy Framework. Check that your provider complies with this framework: it is mentioned in its DPA (Data Processing Agreement).
3. Failure to Inform Data Subjects
If you use AI to analyze resumes, transcribe meetings or categorize customer emails, the people concerned must be informed. This is an obligation, not a courtesy. The absence of information is a non-compliance that can be sanctioned directly.
4. Automated Decisions Without Human Intervention
Article 22 of the GDPR prohibits purely automated decisions that produce significant legal effects on a person (credit refusal, elimination of an application, disciplinary action). AI can assist, suggest, and pre-select. But the final decision must remain human, and the person must be able to contest it.
5. Excessive Retention
AI conversations are archived by default on most platforms. If they contain personal data, you are responsible for how long they are kept. Defining a clear policy (deletion after 30, 60 or 90 days depending on the use case) is essential.
The Key Obligations to Meet
Six obligations structure the compliance of AI use in business. None are insurmountable, but none can be ignored.
Keep a record of processing activities. Every AI use that touches personal data must appear in the company's GDPR record. Include the purpose, the data processed, the retention period, and the recipients. This is the foundation of any compliance.
Carry out a DPIA if necessary. A Data Protection Impact Assessment is required whenever processing presents a high risk to people's rights and freedoms. It is almost systematic for AI uses in HR, healthcare, or large-scale customer relations.
Choose a compliant provider. Your provider's DPA (Data Processing Agreement) must be read, signed and archived. Check the commitments on no-training, server location, sub-processors, and data subject rights.
Inform users and data subjects. Information notices in contracts, in HR policies, in commercial emails. The GDPR's transparency principle requires that no one be processed by an AI without their knowledge.
Secure access. Strong authentication on professional AI accounts, access logging, restriction of sensitive files, and an internal usage policy. A human breach is just as serious as a technical one.
Enable the exercise of rights. The right of access, rectification, erasure, objection, and portability. Your internal processes must allow you to respond within the legal deadlines (one month maximum), including for data that has passed through an AI.
How to Audit Your AI Use in Four Steps
Here is the audit approach we recommend to businesses that want to check their current compliance. Allow two to four weeks depending on the size of the organization.
Step 1: map actual usage. Which employees use which AI tools, on what data, how often? This mapping often reveals a huge gap between reported use and actual use. Anonymous surveys, interviews, expense analysis: combine your sources.
Step 2: rank uses by criticality. Not all uses are equal. An assistant that drafts internal emails is less critical than a tool that analyzes resumes or categorizes patient files. Three levels: low, moderate, high.
Step 3: verify the compliance of each critical use. For each use ranked moderate or high, check: signed DPA, up-to-date record, DPIA if necessary, information of the people concerned, access security, retention period. Document the gaps.
Step 4: remediate and document. Define a prioritized action plan, with dates and owners. Document every fix. This file is what will protect you in the event of a CNIL inspection.
Want to put it into practice?
Grab our free AI templates, prompts and mini-courses. Delivered instantly by email.
Get the free resourcesThe Role of the DPO and the Legal Department
The DPO (Data Protection Officer) is the cornerstone of AI compliance. Their role is not limited to oversight: they support, advise, and raise awareness. A good practice is to involve the DPO as early as the tool-selection stage, not after deployment.
In practice, the DPO validates the DPA, contributes to the DPIA, checks the information notices, leads GDPR training for the teams using the tools, and serves as the point of contact when an employee, customer or candidate has a question. Without an involved DPO, AI deployments quickly drift.
The legal department, for its part, secures provider contracts, manages transfers outside the EU, and arbitrates edge cases. The DPO and legal pairing is the operational duo of AI compliance in 2026.
AI compliance is not a one-off project but an ongoing discipline. Tools evolve, uses multiply, and regulators refine their doctrine. A company that does not revisit its AI compliance every six months automatically falls behind.
Best Practices for a Company AI Policy
A well-written AI policy fits on two pages, is readable by every employee, and is the reference in 90% of cases. Here are the essential sections.
- Allowed and prohibited tools: the list of platforms approved by the DPO and IT department, and those that are banned.
- Allowed and prohibited data: what can be copy-pasted into an AI and what can never be (medical data, customer financial data, trade secrets, data on minors).
- Mandatory information: when and how to inform a customer, candidate or employee that an AI is being used to handle their request.
- Human validation: the golden rule restated: no decision affecting a customer, candidate or employee should be made by the AI alone.
- Incident procedure: who to notify and within what timeframe in the event of a leak, error, or doubt.
- Sanctions: a reminder of the consequences of non-compliance, aligned with the internal rules.
Toward the AI Act: A Framework Taking Shape
The GDPR remains the foundation, but it is now complemented by the European AI Act, whose first obligations come into force gradually between 2025 and 2027. Companies must start classifying their uses according to the risk categories defined by the regulation (unacceptable, high, limited, minimal risk) and anticipate the specific obligations for high-risk systems (HR, scoring, biometrics).
AI compliance in 2026 is not just a signed document. It is an internal culture, ongoing vigilance, and a permanent dialogue between the IT department, the DPO, legal, and the business teams. Companies that get started now gain a considerable operational and reputational head start.
FAQ: The Most Frequently Asked Questions
Is my company subject to the GDPR if it uses free ChatGPT?
Yes, as soon as an employee processes personal data in the tool. Whether the plan is free or paid changes nothing: it is the processing of data that triggers the GDPR, not the type of subscription. Free versions simply carry additional contractual risks.
What sanction can the CNIL impose in the event of a breach?
Sanctions range from a warning to fines of up to 4% of global revenue. Beyond the fine, the reputational impact is often more painful: a company that is publicly sanctioned loses the trust of its customers and partners.
Do you always have to carry out a DPIA for an AI use?
Not always, but often. A DPIA is required whenever processing presents a high risk to people's rights and freedoms. For simple internal uses (drafting, summarizing), it is not mandatory. For uses that affect customers, candidates or employees at scale, it almost always is.
Can you use ChatGPT Enterprise without any GDPR risk?
The Enterprise plan brings strong contractual guarantees (no-training, SOC 2, dedicated DPA), but it does not exempt the company from its own obligations: informing people, keeping a record of processing, human validation of decisions. Compliance remains a matter of internal organization, not just tool choice.