GDPR-compliant AI

GDPR-compliant AI is the use of artificial intelligence where personal data is processed under the rules of the General Data Protection Regulation: with a legal basis, a data processing agreement, data minimisation and fixed retention periods. In customer service, the EU AI Act has also required since August 2026 that customers can tell they are writing with an AI.

What does GDPR-compliant AI mean?

As soon as an AI answers customer requests, it processes personal data: names, phone numbers, order numbers, sometimes health or financial details. The GDPR applies to that processing just as it does to your CRM or your email campaigns. GDPR-compliant AI does not mean the AI itself carries a seal. It means the provider and you as a business follow the data protection rules.

What should you look for in an AI provider?

  • Data processing agreement: without a DPA, you may not pass customer data to a service provider.
  • Where processing happens: where do the platform and the AI run? More under data residency.
  • Transfers to third countries: which data leaves the EU and on what basis? Background under Schrems II.
  • Model training: is your customer data used to train the AI model?
  • Security: encryption and documented technical and organisational measures.
  • Retention: can you set when messages and contacts are deleted (data retention policy)?

What does the EU AI Act add?

The GDPR and the EU AI Act are two separate sets of rules. The GDPR protects data, the AI Act regulates AI systems. For AI in customer service, the key part is the AI transparency obligation under Article 50, which has applied since 2 August 2026: customers must be able to tell that they are writing with an AI. What that looks like in a chat is covered under AI disclosure.

What are the common pitfalls?

An example: a physiotherapy practice uses an AI agent for appointment requests. A patient writes details about their diagnosis into the chat without being asked. Under Article 9 GDPR, health data is a special category of data. The practice should therefore decide beforehand how it handles such messages and set up the agent to ask only for what it needs for the appointment. Other typical issues:

  • privacy notices that do not mention the use of AI
  • no check whether a data protection impact assessment is needed
  • the assumption that everything stays in the EU on WhatsApp, Instagram and Messenger: delivery on those channels runs through Meta

This entry is not legal advice. Whether your specific use fits also depends on your legal basis and your privacy notices.

How does SendSeven handle GDPR-compliant AI?

SendSeven is GDPR-compliant and hosted in the EU, and the AI runs in the EU too. The DPA is available for every plan, and you can download it in the app at any time. Your data is not used to train the underlying AI model. Data is encrypted in transit and at rest, and you set the retention periods yourself. SendSeven's GDPR-compliant AI agents are EU AI Act ready: in Live Chat, customers see that they are writing with an AI, and you can edit the disclosure text yourself. The AI can be switched off at any time.