AI GDPR compliance checklist
In an era of rapid AI development, more and more organisations deploy systems based on AI models to improve operational efficiency and automate key processes. However, AI deployment raises significant legal challenges, particularly under the GDPR and the EU Artificial Intelligence Act.
To support organisations in this process, we created a comprehensive tool to assess quickly and effectively whether deployed AI systems comply with applicable rules. Our AI Checklist is a practical, intuitive solution that guides you step by step through key legal and technical aspects, enabling informed and lawful use of artificial intelligence.
Checklist structure
The checklist is divided into six sections covering the most important issues related to GDPR and AI. Before you proceed to the checklist, you can complete the metadata section the tool. It will help you document the key information about that tool.
General issues
The first section covers general issues such as legal basis, processing purposes, and categories of data subjects and data. This helps you inventory this important information. It can also support a data protection impact assessment (DPIA).
Relationship with the supplier
The second section concerns the relationship with the supplier that provides the tool. It mainly addresses re-use of data by the supplier, e.g. training its models on data relating to your customers, employees, etc.
Automated decisions
Using AI may lead to decisions based solely on automated processing or profiling within the meaning of Article 22 GDPR. The control questions and explanations help you assess whether the outcome of the AI system will amount to an automated decision.
Data quality
The "Data quality" section relates primarily to the principle of accuracy of personal data, but is also relevant to the principle of lawfulness and fairness.
Security
The "Security" section focuses on the safe use of the tool by employees in your organisation.
Accountability
The checklist ends with a section on accountability. Your organisation should not only comply, but also be able to demonstrate compliance. Helpful measures include data protection impact assessments, maintaining a record of processing activities, and internal policies.
Why is it worth ensuring AI compliance with the law?
- Avoiding the risk of significant GDPR fines — infringements related to personal data processing in AI can result in penalties of up to tens of millions of euros.
- Reducing legal and reputational risk — using artificial intelligence without adequate safeguards can undermine customer and business partner trust.
- Preparing for the EU Artificial Intelligence Act — new EU rules will impose additional obligations on organisations deploying AI, so it is worth preparing now.
What does our tool offer?
- A quick review of key compliance aspects — from legal bases to security and relationships with AI suppliers.
- AI tool metadata — document essential information about the system being deployed to support audits and reporting.
- A checklist divided into six key sections — covering legal bases, data security, profiling, automated decision-making, and relationships with AI suppliers.
Who is this tool for?
- Organisations deploying ready-made AI solutions such as content generation tools, chatbots, data analytics systems, or decision-support tools.
- Data protection and compliance specialists who need to verify that deployed AI solutions are compliant.
- Managers and IT teams looking for effective tools to assess AI risk and compliance.
Check AI compliance with the GDPR
Metadata
General requirements
RequiredRelationship with the supplier
RequiredDecision-making
RequiredData quality
RequiredSecurity
RequiredAccountability
RequiredDisclaimer
The checklist is designed for organisations that want to use ready-made tools, mainly generative artificial intelligence. It does not cover situations in which the organisation:
- Deploys its own tool
- Develops and trains an AI model
- Fine-tunes an AI model
The checklist concerns compliance with the GDPR. It does not cover the EU Artificial Intelligence Act or the requirements referred to therein.
- Each processing operation is an individual case and may require additional assessments not covered by this checklist.
- This is a supplementary and educational tool; the explanations provided do not constitute legal advice.
- The checklist must not be used as the sole basis for decision-making by any entity or person using it at their own risk.
ODO 24 sp. z o.o. shall not be liable to any entity or person for any consequences arising from direct or indirect use of the checklist, in particular for damages including an obligation to pay compensation or compensation, administrative penalties, loss of benefits or other negative other negative consequences.
