GDPR checklist: ten points before you put an AI assistant on your website

Why now: most points can only be settled before signing the contract

The General Data Protection Regulation (EU 2016/679) and the EU AI Act (2024/1689) together determine what applies to an AI assistant placed on your website. The Hungarian supervisory authority is NAIH (the Hungarian National Authority for Data Protection and Freedom of Information). Most points are things that need to be clarified before the contract is signed: afterwards they can only be made up for with additional measures.

The ten points on the list concern the provider, and you are responsible for checking them. Our assistant processes the data in an EU region, retention is 90 days, and the disclosure is built in. Some of the remaining points – AI literacy and use in line with the intended purpose – always have to be taken on by you.

A verbal promise cannot be proven, so ask for a written answer to each of the ten points, and keep it together with the contract.

1. Where is the data stored?

Ask in which country or region the conversations and the knowledge base are stored. Storage in an EU region reduces the risk. In the case of storage in a third country, the conditions must be set out in the data processing agreement under Article 28 of the GDPR or in a clause. With us, the data stays in the EU, including model calls.

2. Data processing agreement

Ask for the data processing agreement in writing before signing the contract. Article 28 of the General Data Protection Regulation obliges the controller to have a written agreement with the processor. If a provider cannot give you one, the other points no longer matter.

3. How long is the data kept?

Retention can range from days to months. We store conversations for 90 days and then delete them. If a provider would keep the data indefinitely or for years, that is a risk.

4. Logging and traceability

It is worth logging each AI interaction: timestamp, incoming and outgoing message, source citation. This is needed partly because of the record of processing activities under Article 30, and partly because it gives you a reference point for tracing a wrong answer.

5. The list of sub-processors

The provider also uses further subcontractors for the infrastructure and the model calls. Ask for the full list and the contracts that go with them. If a provider considers it confidential and does not disclose it, it is hard to check.

6. Exercising the visitor’s rights

The provider must support the fulfilment of access, erasure and data portability requests under Articles 15–22. Ask whether there is a designated contact and a written process for this. With us, requests can be submitted at .

7. The data does not train the model

Business conversations must not be used to train a third party’s model. Ask whether the model provider’s contract excludes use for training purposes. This is a question of contractual guarantee.

8. Risk classification under the AI Act

Under the EU AI Act, a customer service assistant is usually limited risk: here transparency towards users is mandatory. If the assistant made automated decisions about people, it would be high risk, with a much greater compliance burden.

9. Privacy notice

The privacy notice must be updated when the assistant is introduced: what data the assistant processes, which provider handles it, and where it is stored. Where the visitor meets the assistant, place a link to the privacy page.

Visitor information and AI disclosure meet here. The disclosure says that artificial intelligence is answering; the notice says what data the assistant handles. Together they give the visitor the full picture.

10. Security baseline

The minimum: encryption of communication and of data at rest, and two-factor login to the admin interface. If the provider does not guarantee this, it is worth withdrawing before the contract is signed.

Interpretation

Ten out of ten: the provider complies. Between seven and nine, there is a manageable risk, with additional technical measures. Below seven points, signing the contract is not recommended. Our assistant has most of the points above built in; we describe the details on the data security page.

The ten points at a glance, in one table:

Point	What to check	Red flag if
EU storage	region, model calls	third country, not set out in the contract
Data processing agreement	written, Article 28	they do not provide one
Retention	duration	indefinite
Logging	per interaction	nothing can be traced back
Sub-processors	full list	they do not disclose it
Visitor rights	designated contact, written process	no process
Model does not learn	contractual exclusion	trains by default
Risk classification	transparent	hidden high risk
Privacy notice	updated, linked	not updated
Security	encryption, two-factor login	the baseline is missing

Next step

You can find the details of data handling and disclosure on the data security page. Request a demo on your own website, or see the prices. If you have a question, write to .

Methodology

The checklist was put together from the requirements of the General Data Protection Regulation and the EU AI Act, our own data protection onboarding work and our 90-day platform data. The titles and locations of the legal texts are given in the list of sources.

Changelog

• 2026-10-15: rewritten from the smartaichat.hu article “GDPR-compliant chatbot checklist”

Sources

• General Data Protection Regulation (EU 2016/679), Articles 28, 30 and 15–22 · eur-lex.europa.eu
• EU AI Act, Regulation (EU) 2024/1689 (transparency: Article 50) · eur-lex.europa.eu
• Own platform data, 90 days of use, 2026-07-08 – 2026-10-06 · own data · smartaiassist.eu/data/after-hours-questions/

Found a mistake, or do you have more recent data? Write to

and we will review it.

Frequently asked questions

GDPR checklist for an AI assistant