The tag view groups articles by a concrete operational problem or implementation type, without exposing hundreds of raw frontmatter labels.
With only a DPA in place, OpenAI keeps API prompts in its logs for up to 30 days and may process them outside the EU. What ZDR, MAM and an EU-region project change, and how Anthropic, Google, Microsoft and AWS compare.
The AI Act, Regulation (EU) 2024/1689, applies in Poland directly and in stages. AI literacy and the prohibitions apply from 2 February 2025 and transparency from 2 August 2026. From 28 October 2026 Poland's new AI supervisory body, KRiBSI, can inspect companies and impose fines. A company that uses ChatGPT, Claude or Copilot has three tasks: the team's AI literacy, a notice at the chatbot and respecting the prohibitions.
Microsoft 365 Copilot can be used in line with the GDPR. Microsoft processes prompts and responses as a processor under the Data Protection Addendum, does not train foundation models on them, and for EU customers Copilot is covered by the EU Data Boundary. Three places need checking: Bing web search, Anthropic models and oversharing of files in SharePoint.
DeepSeek Harness is DeepSeek's open agent environment in worldwide public preview, with work on files, code, search and background tasks, and a plugin architecture. A local app does not settle where data goes: the model, search and plugins may process files elsewhere. In a trial on 60 document comparisons a month, at 25 minutes by hand and 8 with checking, you get back 17 hours.
Turning off training in ChatGPT or Claude covers one way the vendor uses data. It does not set the purpose of processing in the company, the scope of the contract, retention or who will open an attached file. No training does not mean no storage. An AI Act and GDPR audit at Syntalith costs from €700 net and ends with a register of tools, a list of settings changes and a training plan.
Do not put customer data, employee data or confidential documents into a personal AI account until the company approves how it is used. An employee's paid subscription gives the company no contract, no access control and no way to take the account back. Moving 10 people to a business plan with rules and training costs from €1,150 net at Syntalith and pays back in 0.9 months.
Limit customer data before you send it to ChatGPT or Claude, because the instruction "anonymise it first" comes too late. Pasting a full document with that request already hands it to the vendor. A draft reply to a complaint usually needs only a description of the problem and a passage from the terms, with no name, address or order number. Removing a name is often pseudonymisation, which the GDPR still covers.
Shadow AI is the use of AI outside the approved way of working: personal subscriptions, browser extensions, note-taking apps. The aim of the review is to give the team an approved way to do the same work, and a policy is only part of it. Moving 15 people to a business plan with rules and training costs €2,300 net at Syntalith and pays back in 1.2 months at an hour saved a week.
Bielik 11B or PLLuM 12B in 4-bit quantisation takes about 7 GB of GPU memory, so it fits on Hetzner's cheapest GPU server with 24 GB. That server costs €214 a month net, and with 8 hours of upkeep about €493. At documents with 3,000 input tokens and 1,000 output tokens, the Claude Sonnet 5.5 API is cheaper up to about 34,500 documents a month.
PLLuM makes sense when a company needs a Polish language model in a controlled environment and has a repeatable, high-volume task. The model files are free, but a GPU server with upkeep costs about €493 a month. At a case with 3,000 input tokens and 500 output tokens, the Claude Sonnet 5.5 API costs €0.0098, so your own server wins on price only from about 50,200 cases a month.
Bielik makes sense for a company that wants to keep processing in its own environment, has many similar cases and a person responsible for data and updates. The v3.0 versions are licensed under Apache 2.0, but the terms of use forbid processing personal data, so plan the first trial on documents without such data.
Claude can be rolled out in line with the GDPR if you use a business plan or the API with Anthropic's data processing agreement, choose the place of processing on purpose and limit the data to what is needed. The direct Anthropic API processes requests in the US or globally. Processing in Europe comes with Claude through Amazon Bedrock or Google Vertex AI with a European region.
An AI system register is a list of the systems in use, with an owner, the company's role, the risk status and the missing documentation. The register's rules run before the model, and a person approves the risk classification. The transparency obligations in Article 50 of the AI Act apply from 2 August 2026. At Syntalith the application costs from €3,000 net. At 40 register entries a month of 90 minutes each, it pays back in 2.0 months.
Permission-aware RAG checks access before the model sees a document: the search filters by the employee's groups, and PostgreSQL enforces the row access rule again. At Syntalith an AI application on company documents costs from €3,000 net. At 400 questions a month that each take 10 minutes of searching, it pays back in 1.5 months.
An AI agent for translation makes sense when translations form a repeated stream: hundreds of product descriptions in several languages with a company glossary, the brand's tone and a write to your systems. A ready-made tool translates a single text, and a person checks contracts. The automation costs from €3,000 net at Syntalith and, with 1,500 description translations a month at 8 minutes each, pays back in 0.7 months.
Automatic meeting notes make sense when every deadline and every responsible person leads to a moment in the recording you can play back. Then a participant checks an action item in a few seconds instead of listening to the whole conversation. At Syntalith the app costs from €3,000 net, and with 120 meetings a month at 25 minutes each it pays back in 2.3 months.
A useful company AI policy names approved tools, data classes, review duties, incident reporting, training, and an owner. Build the rules around the tools and data your people actually use, then keep the document short enough to follow.
A company can use ChatGPT in line with the GDPR if the team works on a company account with a data processing agreement, and the company sets the purpose, the scope of data and access. Data from ChatGPT Business, Enterprise and the API does not train models by default. A company in the EEA signs the agreement with OpenAI Ireland. Employees' private accounts give the company none of the same contract terms or administration.
OpenClaw has sensible defaults: the Gateway listens only locally, and an unknown sender gets a pairing code. Tool isolation is off by default, though, so commands can run on the server. Before company data, switch isolation on, narrow the tools and require approval for writes. Approving only writes at 600 actions a month means 1.5 hours of checks instead of 10.
A data processing agreement, or DPA, is needed when an AI vendor processes personal data on your behalf as a processor, under Article 28 GDPR. It need not be a separate signature on a PDF, because the OpenAI and Anthropic DPAs are part of their commercial service terms. The agreement alone does not let you send any document to AI, though. An AI Act and GDPR audit at Syntalith costs from €700 net.
Next step
Walk an engineer through it in 30 minutes. Within 2 business days you get, in writing, what it costs, what to do first and the starting price.
Times are shown in your own time zone. We work with clients across time zones.
See where to startOpenAI makes ChatGPT and Anthropic makes Claude. We belong to the partnership programs of both companies, so we work with their tools every day and learn from the creators themselves.
Claude Partner NetworkParticipation in programs does not mean that OpenAI or Anthropic endorses our services.