Your AI Product Has EU Customers
The GDPR Doesn't Care That You're a Startup
GDPR compliance templates for AI companies processing EU personal data. Full DPIA, automated decision-making assessment, EU AI Act risk classification, cross-border transfer guide, and compliance checklist.
Version 3.0, updated 19 October 2026. Instant download by email after payment. Licensed to one organization, every employee included. Licence terms. 14-day refund, any reason. How refunds work. Download a sample (PDF), the opening pages of one document.
Why GDPR Catches AI Companies Off Guard
Most AI startups know GDPR exists. Few have actually worked through what it means for their specific product. The regulation was written before large language models were widespread, and applying it to AI systems involves interpretation that general compliance checklists don't address.
Article 22 governs automated decision-making - and depending on how your AI product works, you may be triggering its requirements without realizing it. Data minimization requirements apply to training data, not just the data your users submit today. Cross-border transfer rules apply even if your servers are in the US and your users happen to be in Europe.
The EU AI Act adds another layer. Since 2 August 2026, chatbots and synthetic media carry disclosure duties; from 2 December 2027, high-risk uses in hiring, credit, insurance, and education bring deployer duties. Knowing where your system falls, and whether you are a provider or a deployer, is not optional for companies with EU users.
This kit was built by a CISSP with active compliance experience to address the specific intersections between GDPR and AI that general legal templates miss: automated profiling, consent architecture for AI training, DPIA requirements for high-risk processing, and the documentation EU supervisory authorities actually ask for. Every judgment, date, and citation in it was checked against a primary source in October 2026.
What's Inside
Five documents and a tracker workbook, covering the GDPR requirements most AI companies have not addressed yet.
DPIA Template for AI Processing
Built on Article 35(7): the nine screening criteria, the systematic description, necessity and proportionality including the legitimate interest test, a 15-risk AI register (fabricated output, cross-tenant leakage, prompt injection, training on your data, memorisation, children's data), the measures table, the Article 36 decision, and a completed example for a fictional dental group.
Article 22 Assessment
Five questions that decide whether Article 22 applies, built on the Court of Justice's SCHUFA (2023) and Dun & Bradstreet (2025) judgments: what counts as a decision, what counts as meaningful human involvement, the three exceptions, the safeguards, and what explanation the person is owed. With a decision record.
EU AI Act Risk Classification
Seven steps under the Regulation as amended in July 2026: provider or deployer, prohibitions, high-risk, transparency, general-purpose models, the dates that apply to your system, and an obligations matrix by role and tier, with the GDPR interface.
Cross-Border Transfer Guide
Whether data leaves the EEA by inference, storage, or support access; adequacy including the EU-US Data Privacy Framework and its litigation status; the 2021 standard contractual clauses and the transfer impact assessment; derogations; provider residency; the UK and Switzerland. TIA template and vendor transfer record included.
30-Item Compliance Checklist
Thirty requirements in seven groups, each with the article it comes from and the evidence that shows it is met, from lawful basis and transparency through vendors, transfers, security, automated decisions, and people. Delivered with an Excel tracker: status by group, the DPIA risk register with inherent and residual scoring, and the vendor transfer record.
Complete GDPR + EU AI Act compliance kit for AI companies.
- DPIA template with a 15-risk AI register and a completed example
- Article 22 decision tree built on the SCHUFA and Dun & Bradstreet judgments
- EU AI Act classification worksheet as amended in July 2026
- Transfer mechanism guide with TIA template and vendor transfer record
- 30-item GDPR AI compliance checklist with article references and evidence
- Excel tracker: checklist status, DPIA risk register, vendor transfer record
- Markdown source of every document for Notion, Confluence, or a wiki
Instant download. Five Word documents (.docx) and one Excel workbook (.xlsx), with the Markdown source of each document. Version 3.0, 19 October 2026.
Questions
Do we need this if we're US-only?
If any EU residents use your product, GDPR applies regardless of where your company is based. This kit helps you assess and address that exposure before a supervisory authority asks.
Does this cover the EU AI Act?
Yes. The classification worksheet follows the Regulation as amended by the July 2026 Digital Omnibus: transparency duties since 2 August 2026, high-risk duties for Annex III uses from 2 December 2027, Annex I from 2 August 2028. The obligations matrix separates deployer duties from provider duties, which most summaries blur.
Do we need a DPO to use this?
No. The templates are designed to be completed by whoever handles privacy at your company - whether that's a dedicated DPO, your legal team, or your CTO wearing the privacy hat.
How does this handle AI training data under GDPR?
The DPIA records the legal basis for processing, asks whether the data collected is limited to what is necessary, and rates the risk of personal data being used for model training without consent. The checklist adds data minimization and confirming training opt-out with your AI provider.
What if our product is classified as high-risk under the EU AI Act?
The worksheet walks through the Annex III categories and separates what a provider owes (risk management, technical documentation, conformity assessment, registration) from what a deployer owes (use per instructions, human oversight, log retention, worker notice, informing affected people), with the dates each arrives. If you fine-tune, rebrand, or repurpose a vendor system, it also tells you when you become the provider.
Is this legal advice?
No. These are compliance templates and frameworks created by a security professional, not a lawyer. For legal advice specific to your situation, consult an EU-qualified privacy attorney. These templates are a practical starting point that reduces the time and cost of that legal engagement by giving your counsel a completed first draft to review.
Complete Your Compliance Stack
GDPR is one piece. Cover the rest.
AI Compliance Toolkit - $247
HIPAA, the EU AI Act, FTC and TCPA, legal ethics, and US state AI laws for AI deployments. 85-item assessment with a scoring workbook and a remediation matrix.
Incident Disclosure Kit - $197
Filing-ready disclosure templates for SEC, NIS2, DORA, HIPAA, and state breach laws. Be crisis-ready before the crisis.
David A. Moline, CISSP | CISM
Your AI automation, built by someone who secures DoD systems.
Get Compliant Before a Supervisory Authority Asks
Your AI product processes EU personal data. The GDPR homework isn't optional. Get it done now.