Service
Employees have long been using AI services – often without approval and without clarity about which data leaves the company. We create transparency, enforce practical rules technically and prepare you for the requirements of the EU AI Act.
Request an inventoryWhether a writing assistant in the browser, an AI feature in office software or a free translation service: AI tools are only a click away. If customer data, contracts or internal source code are entered there, confidential information leaves the company – usually unnoticed.
A blanket ban rarely helps, because usage then shifts to private devices. A clear framework is more effective: approved tools, transparent rules and technical controls that prevent mistakes without blocking productive work.
On top of that comes the EU AI Act. Since February 2025, companies that use AI systems must, among other things, ensure adequate AI literacy among their staff; further obligations are coming into force step by step.
We determine which AI services and integrations are actually used in the company – based on network, proxy and application data, evaluated in a privacy-compliant way.
Together with IT, data protection and business units we create clear rules: which tools are allowed, which data may be entered, and who approves new applications?
Policies are enforced technically – for example through allow lists, detecting sensitive data before it is transmitted (data loss prevention) and rules as code with OPA/Rego.
We record the AI systems in use, assign them to the risk classes of the EU AI Act and derive concrete measures – from documentation to training.
You want to know which AI services are used in your company and which data flows out in the process.
You want to offer your employees an approved AI assistant instead of tolerating uncontrolled use.
Customers, auditors or insurers ask about rules and controls for the use of AI.
You develop or use AI systems and need to clarify which obligations apply to you.
For ongoing monitoring we use our own platform. It makes the actual use of AI applications visible and helps enforce policies technically.
More about the platformWe record the AI services in use, the AI systems deployed and existing rules.
We assess data flows, providers and use cases and map them to the requirements of the GDPR and the EU AI Act.
We draw up policies and implement them technically – as strict as necessary, as open as possible.
New services and changes are detected continuously; reports document the status for data protection, IT security and management.
Shadow AI refers to AI services that employees use without the knowledge or approval of IT – for example freely available chat assistants or AI features in browser extensions. The risk: confidential data is transmitted to providers whose data processing nobody has checked.
Very likely, as soon as you use AI systems – not only if you develop AI yourself. Which obligations apply depends on your role (provider or deployer) and the risk class of the applications. The obligation regarding the AI literacy of staff has applied since February 2025.
Yes, if it is implemented correctly. We do not evaluate what individuals enter, but which services are used – aggregated and pseudonymised wherever possible. We involve the works council and data protection officers early on.
A ban is hard to enforce and usually shifts usage to private devices, where it is no longer visible at all. An approved offering with clear rules is better – then employees use AI productively and safely.
No. We are responsible for the technical and organisational implementation and work closely with your data protection officer or legal advisers on legal assessments.
Published on 8 min read
Even companies that only use AI are affected by the EU AI Act. We show which obligations already apply to deployers, what the Digital Omnibus has postponed and what you should do now.
We start with an inventory and show you where action is needed – and where it is not.