Unknown AI usage
Teams use AI tools without a central overview of systems, purposes, data flows and responsibilities.
Embed responsibility in technology and organisation
Data protection, AI governance & compliance
We help companies use data and AI systems in a controlled way, with clear responsibilities, traceable processes and appropriate technical measures.
Assess compliance needs ↗Trust through clear structures
AI expands the data protection challenge
AI raises new questions: Which systems are used? What data goes in? Who decides on deployment? What risks and documentation and transparency duties apply?
evival combines privacy expertise with technical experience in software, data and AI, turning requirements into processes businesses can implement and maintain.
GDPRControl data processing
AI ActAssess roles and risks
GovernanceEstablish responsibility
Common starting points
Where businesses need direction
Unclear roles
It is unclear whether the company is an AI provider or deployer and what duties follow.
Missing evidence
Decisions, checks, training and technical measures are not documented consistently.
Our service areas
From overview to sound governance
Data protection management
Maintain processing activities, technical and organisational measures, processor arrangements and privacy processes systematically.
AI inventory and roles
Record current and planned AI systems, purposes, data, responsibilities and provider and deployer roles.
Risk and classification
Assess use cases by their characteristics, prioritise risks and define required next steps.
AI governance
Define policies, approvals, responsibilities, human oversight, monitoring and escalation paths.
Documentation
Document decisions, checks, data sources, system boundaries and measures transparently.
AI literacy
Train employees according to their roles in opportunities, limits, data protection, security and responsible AI use.
Approach
Compliance as an ongoing process
Take stock
We record systems, data processing, use cases, providers, contracts and existing rules.
Assess roles and risks
Duties and risks are prioritised; open issues receive owners and realistic deadlines.
Develop the framework
Policies, approval processes, documentation requirements and controls are designed to fit the organisation.
Implement technically
Permissions, logging, data minimisation, system boundaries and other measures are incorporated into solutions and workflows.
Train and review
Employees are equipped with skills; systems, risks and rules are updated regularly.
Practical
Rules must work in everyday practice
Documents alone do not create compliance. We ensure requirements fit existing processes, owners understand them and technical systems support the rules.
Note: evival supports technical and organisational data protection and compliance tasks. Where binding legal advice is required, an appropriately authorised legal adviser should be involved.
- Traceable responsibilities
- Verifiable approval processes
- Role-based training
- Controlled data sources
- Human oversight
- Regular updates
Frequently asked questions
AI compliance questions
Does the AI Act also affect companies that only use AI tools?
Depending on the system and use, a company may have duties as a deployer. Role, purpose and risk level should therefore be assessed for each relevant use case.
What belongs in an AI inventory?
System and provider, purpose, users, affected processes, data used, responsibilities, company role, risk level and existing measures, among other things.
Is a general AI policy enough?
A policy is an important component. Practical approvals, responsibilities, training, documentation and ongoing controls are also needed.
How do the GDPR and AI Act interact?
Both may apply in parallel. The AI Act does not replace data protection duties; both perspectives must be considered together, especially for personal data.
Assessment
Is your AI usage already under control?
Together, we assess the current situation and identify the most important organisational and technical next steps.
Arrange a call ↗