An AI compliance checklist is a list of concrete checkpoints a business uses to determine whether its use of AI tools meets the requirements of the GDPR and the EU AI Act. It does not replace advice, but it shows you quickly where the gaps are.
Over the past months I have written a separate post on almost every individual topic: acceptable use policy, DPIA, records of processing, training. What was missing was the overview. Which points does a small business actually need to tick off, and in what order?
This checklist is meant for businesses with 5 to 50 employees that use AI tools like ChatGPT, Copilot or Claude in everyday office work. It is not meant for businesses that develop AI systems themselves or use AI for hiring decisions or credit checks. Additional obligations apply there.
Set aside an hour, go through the 20 points and mark each one yes, no, or “don’t know”. The third answer is the most honest and the most common.
Part 1: Inventory
1. You know which AI tools are used in the business. Not just the officially rolled-out ones, all of them. Ask your team directly and without blame. In my experience the list is longer afterwards than before. How to go about it is covered in the post on shadow AI among employees.
2. The licence tier of each tool is known. The free web version of ChatGPT and a business plan from the same vendor are two different products from a data protection perspective. The same applies to Copilot. Write down exactly which variant is in use.
3. You know which data goes into which tool. General text, internal documents, customer data, health data, client secrets? This question drives almost every other point. The 5 questions before you start help here.
4. Each tool has a named owner. Someone who knows who has access and who reacts when the vendor changes something. In small businesses this is often the managing director. That is fine, as long as it is decided.
Part 2: Contracts and legal basis
5. A data processing agreement under Art. 28 GDPR is in place with every vendor that processes personal data. With the business plans of the large vendors, the DPA is usually part of the contract terms. Free versions usually have none. The consequence: free versions are normally not suitable for personal data.
6. Data location is clarified. Where does the vendor process the data, and are there transfers to third countries? For the US, the question is whether the vendor is certified under the EU-US Data Privacy Framework or relies on standard contractual clauses. More in the post on data location and cloud AI.
7. Every AI processing of personal data has a legal basis under Art. 6 GDPR. Usually this is performance of a contract or legitimate interest. What matters is that you can name the basis before someone asks.
8. Professional secrecy is covered separately. For law firms, tax advisors and other professionals bound by secrecy, a DPA alone is not enough. Section 203 of the German Criminal Code (StGB) requires that service providers involved in the work are bound to confidentiality. Details are in the post on client data and Section 203 StGB.
Part 3: Documentation
9. There is a written AI acceptable use policy. Which tools are allowed, which data may go in, who checks the output. Two to four pages are enough. You will find an outline in the post on the AI acceptable use policy.
10. AI processing is listed in your records of processing activities. Art. 30 GDPR requires a record of all processing activities. AI use involving personal data belongs in it, either as its own activity or as an addition to existing entries. What that looks like is shown in the post on documenting AI use.
11. A DPIA exists for high-risk processing, or there is a documented reason why none is needed. Art. 35 GDPR requires a data protection impact assessment when processing is likely to result in a high risk to the people concerned. For AI tools with access to customer data, that is often the case. A reasoned decision against a DPIA should also be put in writing. The steps are in the post DPIA for AI tools step by step.
12. The documents reference each other. Policy, records of processing, DPIA and training record should refer to the same tools and the same version. An auditor spots contradictions fast.
Part 4: Technical settings
13. Use of your inputs for vendor training has been checked. Many tools offer a setting that stops your inputs from being used to train the models. On business plans this is often the default, but not always. Check it for each tool individually.
14. Access runs through company accounts, not private ones. When employees work with private accounts, you have no control over settings, history or deletion. And when an employee leaves, the data stays in their private account.
15. For Copilot, permissions have been reviewed. Copilot sees everything the user can access in Microsoft 365. Overly broad SharePoint sharing becomes a data protection problem as a result. The settings that matter are in the post on configuring Copilot for GDPR.
Part 5: People
16. Employees are trained, and the training is documented. Art. 4 of the EU AI Act requires measures for the AI literacy of staff, regardless of company size. The GDPR requires that staff know what they may do with personal data. What belongs in the record is covered in the post on employee AI training.
17. Everyone knows who checks AI output before it leaves the building. AI text can sound plausible and still be wrong. Make it a rule that a person reviews output before it goes to customers or clients.
18. The works council is involved, if you have one. Under Section 87(1) No. 6 of the German Works Constitution Act (BetrVG), AI tools that are capable of monitoring employee behaviour or performance require co-determination. With Copilot this comes up regularly. More in the post on the AI works agreement.
Part 6: Ongoing operations
19. There is a process for mistakes. What happens when someone pastes customer data into the wrong tool? Who is informed, and who assesses whether a report to the supervisory authority is required? Art. 33 GDPR generally allows 72 hours for that. That deadline is short if you only then work out who is responsible.
20. The checklist is repeated regularly. AI tools change faster than any other office software. New features, new sub-processors, new plans. I recommend a review with every new tool and at least once a year.
How do I evaluate the checklist?
Don’t count the yes answers. Look at the no and “don’t know” answers in Part 1 and Part 2. If you don’t know which tools are in use or whether a DPA exists, every other point rests on assumptions.
A sensible order for small businesses:
- Finish the inventory (points 1 to 4). Without it, everything else is guesswork.
- Stop or replace free tools for personal data (point 5). This is usually the biggest gap and the quickest to fix.
- Write the policy and train people (points 9 and 16). This is what changes everyday behaviour.
- Catch up on documentation (points 10 to 12). Records of processing, DPIA, cross-references.
- Set up ongoing operations (points 19 and 20).
For a business with 15 employees and two or three AI tools, this is doable in a few weeks, not months. In my experience, the time goes not into writing but into finding out what is actually being used.
What this checklist does not cover
I deliberately leave out three areas because they don’t apply to most small businesses and need their own review:
- Building your own AI. If you offer AI systems yourself, you have significantly more obligations as a provider under the EU AI Act.
- High-risk use cases. AI for candidate selection, creditworthiness or similar decisions about people falls under separate rules. The post on the EU AI Act for small firms gives an overview.
- Sector-specific supervisory law. Financial services firms supervised by BaFin have additional requirements for outsourcing and IT.
The next step
If you only do one thing today: answer point 1 honestly. Send a short message to your team and ask which AI tools each person used for work in the last month. The answers are the foundation for the other 19 points.
If you want to know where your business stands on these points, take my free AI compliance check. It takes 2 minutes and shows you where to start.
Jose Lugo is a CISSP-certified AI compliance consultant. He advises law firms, tax advisors and financial services firms in Germany on introducing AI tools in a GDPR-compliant way.