GDPR and AI: using AI without breaching privacy

GDPR, EU AI Act and customer data: SMBs are flying blind.

60% of Italian companies use ChatGPT informally with no privacy assessment.

3 risk levels

L1 consumer tools: high. L2 enterprise: medium with no-training. L3 self-hosted/EU: low.

Special categories, significant decisions, systematic monitoring, new tech at scale.

Legitimate interest, contract performance, explicit consent.

4 risk levels. Most uses are limited risk with transparency duties.

Inventory, policy, vendors with DPA + no-training + EU, DPIA before go-live, train people.