€20M · 4%
Administrative fines
Up to €10M or 2% of turnover (security, processor contracts); up to €20M or 4% (principles, transfers). The higher applies.
GDPR Art. 83(4) and 83(5)Data protection · AI at work
We know you use AI. Leaks cost money.
We know nothing about your firm. We know the rules.
- Demo on synthetic data
- Model on your own server
- Word, PDF and scans
- 19.95%of EU enterprises with 10+ employees used AI in 2025Eurostat
- 78%of AI users at work bring their own toolsMicrosoft and LinkedIn, Work Trend Index 2024
01 / What a leak can cost
Four costs. Each with its legal basis.
72 h
Breach notice
Unauthorised disclosure is a breach. Notify without undue delay and, where feasible, within 72 hours, unless a risk is unlikely.
GDPR Art. 4(12), 33(1), 34(1)Art. 13
Professional secrecy
National law, and it usually covers staff. In Croatia, attorney secrecy binds the whole office, computer records included.
e.g. Croatian Attorneys Act Arts. 13, 71–72; Code of Ethics for Attorneys points 26–33€2.26M
Clients and reputation
Croatia’s authority published a €2,265,000 fine with the company’s name in 2023. Not an AI case. Anyone harmed can claim damages.
AZOP fine notice (2023); GDPR Art. 82(1)Statutory ceilings, not an estimate for your case.
02 / What an outside AI sees
Anonymising hides names. Not the facts.
client-email.eml
Your document
Dear all, Thomas Berger, ID 12345678901, writes that the company loses its largest customer in January and will lay off 14 of 40 staff. The bank does not know yet. Reply to t.berger@mail.example.
Anonymised, for an outside AI
Dear all, [PERSON_1], ID [ID_1], writes that the company loses its largest customer in January and will lay off 14 of 40 staff. The bank does not know yet. Reply to [EMAIL_1].
No pattern catches the highlighted facts. The company is still recognisable.
Local model, in the firm
- The document stays as it is
- Nothing to hide or restore
- It never leaves the firm’s server
03 / How leaks happen
Eight layers of protection. Each one misses something.
- 01
An internal AI wrapper
prompts still go to the vendor
- 02
Redacting IDs, IBANs, emails
“selling the company” has no pattern
- 03
A classifier and a local model
email can still send the file anywhere
- 04
Human confirmation, an allowlist
it reads files the person may not
- 05
SSO and per-user permissions
outside documents carry hidden instructions
- 06
Clean output, egress control
without logs nobody knows
- 07
Logs and test attacks
it only sees what passes through
- 08
A personal chatbot on a phone
no layer applies; training is possible
What actually works
- A good sanctioned tool
- Written rules
- Staff training (AI Act Art. 4)
Illustration: the configuration is invented.
04 / A safe setup
Request, file and answer stay in the firm.
Employee
sign-in: SSO
Internal AI tool
per-user rights
Local model
your server
Logs + backups
restore tested
External AI
egress blocked
What the firm runs locally
- Summaries of files and contracts
- Drafts from your own templates
- Search across your own archive
05 / How we start
Three steps. The first needs no data.
One workflow
not the whole firm
A demo
on synthetic data
A written scope
then set-up and checks
06 / FAQ
Is it forbidden to use ChatGPT or Claude at work?
No general ban. What matters is which data goes in, which version of the tool, and whether a processor contract covers it (GDPR Art. 28). Consumer versions may train on chats unless you opt out.
Is pasting client data into a chatbot a breach?
It can be. GDPR counts unauthorised disclosure as a breach (Art. 4(12)). Whether a specific paste is one, and must be notified within 72 hours, is decided case by case.
Does the AI Act literacy duty still apply?
Yes, amended. Since 27 July 2026, Article 4 requires providers and deployers to take measures to support their staff’s AI literacy, without guaranteeing a specific level.
What does DORA mean for insurers using AI?
Since 17 January 2025, insurers apply DORA, except small undertakings outside Solvency II. A cloud AI service is ICT third-party risk: the firm stays responsible, and the contract needs set terms (Arts. 28, 30).
Do you need our files for the demo?
No. The demo runs on synthetic data. Access to real data only comes with a written scope and a data processing agreement.
08 / Sources
- General Data Protection Regulation (EU) 2016/679EUR-Lex · checked 2026-11-04
- AI Act, Regulation (EU) 2024/1689EUR-Lex · checked 2026-11-04
- Regulation (EU) 2026/1744 (Digital Omnibus on AI)EUR-Lex · checked 2026-11-04
- DORA, Regulation (EU) 2022/2554EUR-Lex · checked 2026-11-04
- Eurostat: Use of artificial intelligence in enterprisesEurostat · checked 2026-11-04
- Work Trend Index 2024: AI at Work Is HereMicrosoft & LinkedIn · checked 2026-11-04
- OpenAI: How your data is used to improve model performanceOpenAI · checked 2026-11-04
- Anthropic: Updates to Consumer Terms and Privacy PolicyAnthropic · checked 2026-11-04
- AZOP (Croatia): €2.26 million fine on a debt-collection agencyAZOP · checked 2026-11-04
- Croatian Attorneys Act (Zakon o odvjetništvu)Zakon.hr · checked 2026-11-04
- Croatian Code of Ethics for Attorneys (Kodeks odvjetničke etike)Hrvatska odvjetnička komora · checked 2026-11-04
This page is not legal advice. The legislation was checked on 4 November 2026; whether a given case is a breach, and what follows from it, is for your lawyer or data protection officer to assess.
Book a demo on synthetic data
Tell us which workflow in your firm you want to speed up. The demo needs none of your real data.
- Demo on synthetic data
- No obligation