GDPR and AI: sort this out before your team opens ChatGPT

Most of the businesses I talk to already use AI. Not officially, but on a colleague's laptop. Rewriting a quote, summarising an email. Handy, until a customer's name ends up in a prompt.

That is no reason to ban AI. It is a reason to sort out five things. Not a twenty-page policy document, but agreements that fit on a single A4 sheet.

1. Agree what can go in

Make a list of what may and may not go into an AI tool. Names, addresses and bank details: no. An anonymised draft email: yes. Pin that list next to the coffee machine.

2. Choose tools that don't learn from your input

Free versions of AI tools are often allowed to use your input for training. Paid business versions usually aren't. Check that in the terms, or let me do it.

3. Sign a data processing agreement (DPA)

If personal data passes through a tool, the supplier is a processor. That calls for a DPA. Large suppliers have one ready as standard. If I build something for you, I sign one too.

4. Put in writing who is responsible

One person in the business is the point of contact for AI use. No IT specialist needed. Just someone who keeps the list up to date and answers questions.

5. Tell customers when AI is talking to them

If there is a chatbot on your site, visitors must know it is a chatbot. That is in the European AI rules. One line under the chat window is enough.

What this costs you

The agreements take an afternoon. Business AI tools cost a fixed amount per user per month; that amount is on the supplier's website. The rest is simply doing what you agreed.