You can use AI on company data in the EU if three things are in place: your data is classified so you know what must never be sent, processing happens on EU territory, and a filter sits between your data and the model. The hard part is the classification, not the technology.
You are considering AI for strategy work. Financials, customer data, sales results.
Then the question arrives. What about GDPR? What about the EU AI Act? What if sensitive data goes into a system and comes out somewhere else?
The concern is legitimate. But the answer is not to abstain. It is to know what goes where.
The two things that actually go wrong
Data escapes. You send something to a system, and it is stored, reused or trained on in a way you never pictured.
Data is processed somewhere it may not be. You send something to a system outside the EU. For certain data types that is not permitted, however good the vendor is.
The two risks have different fixes, and you need both. EU hosting does not help if you send a customer list. Classification does not help if the processing happens in Virginia.
Classify data before you do anything else
This is the work. The rest is settings.
PUBLIC. Anything already public. Company name, website, published prices, your own case studies. Can go anywhere.
INTERNAL. Company-specific but not confidential. Sales pipeline, internal notes, strategy documents, the competitor analysis you produced yourself. Can go to systems you control.
CONFIDENTIAL. Things that damage the business if they become known. Customer contracts, partner terms, how you actually earn. Only to systems processing your data alone. Note that exact figures such as revenue, margin and EBITDA do not belong here but in RESTRICTED.
RESTRICTED. Personal data about other people. National ID numbers, email addresses from the customer list, names coupled with private details. Not sent. Full stop.
Set aside an hour and build the table. Write down your ten most important data sources and give each one a level. Be strict. It is easier to move something down from CONFIDENTIAL later than to recall a customer list you already sent.
The four levels are described in detail, with examples of what belongs where, in the four classification levels.
The filter between your data and the model
Classification only works if something enforces it. Otherwise it is a spreadsheet nobody reads.
In practice there are three layers, each doing a different job:
Field level. Fields marked sensitive are stripped based on what kind of document or model is involved, before anything leaves the system. This is the only one of the three that can guarantee something is never sent, because it does not guess. It knows in advance which field is which.
Credentials. A scanner catches keys, passwords, tokens and the like in free text. Those turn up in notes and meeting minutes surprisingly often.
Personal data in transit. Names, emails, phone numbers, national ID, IBAN and card numbers are handled on the way to the model, by the layer closest to the provider.
The order matters. The first layer is the only categorical one. The other two are pattern matching, and pattern matching can err in both directions. Which is why classification carries the responsibility, not the scanner.
A concrete example. A company wanted to know which customer segments were most profitable. The customer list with contact details is RESTRICTED. Instead of sending the list they grouped customers by geography and size into A, B and C, and sent only the groups and the numbers. Same analysis, same answer, no personal data anywhere.
That is data minimisation in practice, and it is almost always possible.
What the EU AI Act means for you
The law arrives in stages. For an ordinary small or mid-sized company three things genuinely matter.
High risk must be documented. If you use AI to make decisions about people, meaning hiring, credit assessment or who receives a service, documentation requirements apply. If you use AI to analyse your market and make the decision yourself, it is not high risk.
Most companies are in the second category. It is worth writing that down, because it is the first question anyone asks.
Transparency. If AI influences a decision affecting a specific person, that person should know.
Data minimisation. Send only what you need. Analysing market trends means sending aggregate numbers, not customer rows.
What has to be documented, and which requirements do not apply to you, is covered in the EU AI Act for SMEs.
The EU question is where, not who
This is where advice usually goes vague. "Use a European vendor" is not the rule. The rule is about where data is processed and who can be compelled to hand it over.
A US provider running in an EU data centre can be perfectly fine. A European provider forwarding to a US subprocessor is not.
So ask three questions instead of asking about nationality:
- Which country holds the data centre that processes our requests?
- Is our data used to train models? The answer should be no, and it should be in the contract.
- Who are the subprocessors, and where are they?
Clear answers to those three make nationality secondary. No clear answers, and a European flag does not help you.
A security plan you can build in a morning
- Inventory, one hour. Write down your key data sources. Finance, customers, pipeline, HR, contracts.
- Classification, one hour. Give each source one of the four levels. Disagree about it out loud, that is where the work is.
- Rule, ten minutes. Write one sentence: RESTRICTED never leaves the building. Put it on the wall.
- Vendor questions, thirty minutes. Send the three questions above to whichever provider you use today. Including if it is a free account.
- Decide what to do with the answer. This is the only step that needs management.
If you are unsure about a particular dataset, treat it as one level higher than you think. That costs a little friction and no risk at all.
Why RESTRICTED is hardcoded on our side
The reason classification usually fails is that it is a setting. Someone switches it off on a busy Friday, and then it is off for good.
In 360° Sprint, fields classified RESTRICTED are therefore hardcoded per node type and never sent to any AI provider. It is not a setting a user can turn off, and that is deliberate. On top of that sits the secrets scanner and the handling of personal data in transit. There is also a check on the model's response on the way out, but it does not yet cover every path through the system, so do not treat it as a last line of defence. The guarantee lives at the entrance.
Processing happens on EU territory. That is the same rule as above, applied to ourselves.
How this fits with GDPR day to day is covered in GDPR and AI-assisted strategy.
The whole decision, from classification through vendor questions to what to do on the first morning, is collected in can we use AI on our own data.