Before deciding which AI system to use, three questions should be answered. They sound technical, but they aren't: they're decisions about who gets to see your data and who is accountable for it.
Our Safeguards →
There are three paths, and they differ less in the technology than in how much control you give up.
In your own environment. The model runs on your hardware or in your data center. Nothing leaves your premises. This is the most involved path and often the only viable one for sensitive data.
With a provider processing within the EU. Your data leaves your premises but stays within the European legal area. For most use cases, this is the practical middle ground.
With a provider outside the EU. The path with the broadest functionality and the greatest need for clarification. It requires additional contractual safeguards and a documented assessment of whether the risk is acceptable for your specific case.
This question belongs at the beginning, not the end. Whoever asks it last has usually already bought the technology.
What Is Never Fed In
.svg)
Personal data of your employees or customers
Production data or real data from your systems
Passwords, access credentials, API keys
Sensitive business or financial data
What Is Fed In
.svg)
Abstract code logic and algorithms
Source code fragments (project-related)
Technical configuration data (pseudonymized)
Telemetry data from the development environment
The GDPR has no special rules for AI. The same principles apply as for any other processing; they simply come up more often with AI use. You need a legal basis for the processing. You need a data processing agreement with every provider that processes personal data on your behalf. You must record the processing in your register. And you need to know how long data is retained and how it's deleted again. The most common mistake in practice isn't any of these points, but an organizational one: employees use AI tools that management doesn't know about. No technology helps against that, only a policy that states which tools are allowed and for what.
All three AI providers are based in the US. The transfer is legally safeguarded through multiple protection mechanisms.
Contractual agreement with each AI provider covering the processing, protection, and deletion of data. In place for all three tools.
Clauses approved by the European Commission under Art. 46(2)(c) GDPR. Ensure EU-equivalent data protection even with US processing.
Risk analysis assessing US government access. Result for Claude and ChatGPT: low risk, technical development data isn't a typical intelligence target.
GitHub Copilot is additionally certified under the EU-US Data Privacy Framework, currently the highest level of protection for US transfers.
Most of the regulation has applied since August 2, 2026. For most companies, it brings two obligations that exist independently of the GDPR. You must disclose where AI is involved. And you must ensure that the people working with it know enough about it. It only becomes more extensive if your system falls into one of the eight areas the regulation classifies as high-risk, such as personnel selection or creditworthiness. This doesn't apply to AI used in text drafts, customer inquiries, or scheduling. Which deadlines actually apply and how to assess the classification yourself if in doubt is covered in the article on what the EU AI Act means for mid-sized companies.
Risks & Our Measures
US government access → TIA confirms: low risk
Data disclosure → contractually excluded via DPA
AI training on your data → business account, disabled
Faulty suggestions → manual review by developers
Data leak → internal policy & training
Opportunities for Your Project
Faster development, shorter time-to-market
More consistent, higher-quality code
Fewer bugs through AI-assisted code reviews
Technical documentation created alongside
No higher hourly rate – the benefit goes to you
The only alternative without a US data transfer: AI models on your own infrastructure. We explain honestly what that means.
We guide you transparently through the entire process – from the first question to go-live and beyond.
Frequently Asked Questions
Yes. The GDPR doesn't prohibit AI; it sets requirements for the processing. What matters is which data the system sees, where it's processed, and whether there's a legal basis and a data processing agreement in place for it.
Under the same conditions as with any other system: it requires a legal basis, a contract with the provider, and an entry in the processing register. Many use cases work without personal data if designed accordingly. That's usually the simpler route.
Yes, as soon as the provider could process personal data on your behalf. That's the case with most cloud-based AI services. Free accounts and personal accounts usually don't offer this agreement, which is why they don't belong in business use.
That depends on the contract, not the provider. Business accounts usually contractually exclude training on your data, personal accounts often don't. This commitment should be in writing before any productive work begins.
Nothing. It applies alongside it. The GDPR regulates what may be done with personal data. The EU AI Act regulates which AI systems may be used under which conditions. A system can be GDPR-compliant and still be impermissible under the AI Act.
When the processing is likely to result in a high risk to the people affected. This is regularly the case with AI systems that evaluate people or make decisions about them. Whether it applies to your use case is one of the questions clarified before the project starts.
Devware is certified to ISO/IEC 27001:2024 and ISO 9001:2015. We maintain a processing register (Art. 30 GDPR), have appointed an external data protection officer (heyData GmbH), and regularly train our developers on the privacy-compliant use of AI tools.
Yes. The data processing agreement grants you a right to object with a 14-day period. We then work together to clarify whether the project can be realized without AI tools. Opting out can affect the timeline and costs.
After the project ends, all provided data is returned or, upon request, verifiably deleted. The AI providers have defined deletion periods and processes in their DPAs, which we've contractually required.
Theoretically yes, via FISA Section 702 and the CLOUD Act. However, the TIAs we conducted conclude: low risk. Abstract code fragments aren't a typical intelligence target.
This article is for general information purposes only and does not constitute legal advice. Whether and to what extent the obligations described apply to your company depends on the individual case. For a binding assessment of your AI use, please consult your data protection officer or a qualified attorney.
Praxiswissen, Tipps und Neuigkeiten für den Mittelstand: kompakt und ohne Spam. Abmelden jederzeit möglich.
Praxiswissen, Tipps und Neuigkeiten für den Mittelstand: kompakt und ohne Spam. Abmelden jederzeit möglich.
