Skip to content

Using AI
under EU rules.

Five practical guides for the people who sign off on AI: what the AI Act requires and when, how to keep personal data out of prompts, and how to assess an AI provider. Each one ends with a checklist.

Browse the guidesWhere our facts come from

Five guides.
Free to read.

Written for CISOs, DPOs and heads of platform and procurement. Use the checklists in a DPIA, a vendor review or your AI policy.

Measured on 105 synthetic test cases

Pattern matching removed 57% of personal details. Adding a trained model removed 98.7%.

Keeping personal data out of AI prompts

What ends up in prompts, how well each detection method removes it, what placeholders achieve under the September 2025 judgment of the Court of Justice, and what you still have to do.

Share of annotated personal details removed from 105 held-out synthetic test cases, measured on 15 September 2026. This does not measure whole-document anonymity. The guide explains the method and its limits.

Read the guideData protection · 9 min
Regulation · 8 min

The AI Act for organisations that use AI

Which obligations reach you as a user of AI tools and models, from which date, and a 90-day plan to meet them. Updated for the July 2026 amendments.

Procurement · 7 min

Sovereign AI due diligence: sixteen questions for any provider

Residency, ownership, jurisdiction and data handling as questions you can send in writing, with what a good answer and a warning sign look like.

Risk assessment · 6 min

Assessing CLOUD Act exposure for AI services

How US disclosure orders reach data stored in the EU, where the Data Privacy Framework stands, and a four-factor assessment with worked examples.

Evaluation · 6 min

Choosing an EU AI inference provider: a scorecard

Seven criteria scored from 0 to 4, the evidence to ask for under each, recent market events and a two-week test plan.

Where the facts
come from.

Dates and court findings come from the official text: EUR-Lex, the Court of Justice and the European Commission. When a guide relies on a company announcement or press reporting, the sentence says so.

Official text first
Regulations, judgments and guidance are cited at source, with article or paragraph numbers.
Reporting is attributed
Deals, product claims and anything we could not confirm at source name the company or outlet that published them.
Dated and kept current
Each guide shows when it was last checked, and is updated when the law or a provider's terms change.
Both sides of a disputed risk
Where a risk is contested, the guide gives the main argument against it too.

Key sources

The guides are published in English. Case names, article numbers and official titles stay in their original form.

Questions about your own set-up?

We can go through your data flows, providers and controls with you.

Talk to our team