Use AI with confidence, not with crossed fingers.
The EU AI Act and GDPR apply to the AI you already use — chatbots, scoring, hiring tools, generated content. We inventory your AI systems, classify their risk, close the gaps (transparency, human oversight, data protection, staff literacy) and leave you a governance kit your team can maintain. Practical, documented, not legal advice.
What it solves
You don't know which AI you use
Tools with AI inside arrive through every department, with no inventory.
Clients and partners ask for proof
Procurement questionnaires now include AI governance questions.
The calendar keeps moving
Transparency duties, high-risk deadlines and Spain's own law — hard to track alone.
Deliverables, not promises.
AI inventory
Every system and tool with AI, its purpose, data and owner.
Risk classification
Prohibited, high-risk, transparency or minimal — with the reasoning documented.
Transparency
AI disclosure for chatbots and voice agents, labelling of generated content.
GDPR alignment
Legal bases, DPIAs where needed, DPAs with vendors, data minimisation.
Human oversight & literacy
Who reviews what, escalation rules and staff AI literacy (art. 4).
Governance kit
Policy, registers, templates and a yearly review calendar.
How we deliver it
Fixed steps, clear deliverables and a go/no-go at each checkpoint.
KPIs we track
- Systems inventoried and classified
- Open gaps by risk
- Staff trained (art. 4)
- Vendor DPAs signed
Inventory
Interviews and a tool scan to list every AI system in use, including the ones inside SaaS.
- AI register
Classify & assess
Risk level per system and the obligations that follow, under the AI Act and GDPR.
- Risk assessment
Gap analysis
What's missing — notices, oversight, contracts, logs, training — ranked by risk.
- Gap list with priorities
Remediate
We fix what we can directly (disclosures, policies, configurations) and brief your lawyers on the rest.
- Updated notices & policies
Keep it current
Quarterly review against regulatory changes, tracked in our AI Radar policy segment.
- Review calendar
How the world's best do it
We study what leading AI companies and early adopters do — and bring the principles that work to companies of every size. Every claim links to its source.
Log every AI decision
Allianz and Anthropic are building an audit layer that records AI interactions, decisions and data sources for traceability and regulatory compliance.
Source: FinTech Global ↗Give staff a safe option fast
AXA built AXA Secure GPT in three months precisely to stop data leaks through public AI tools.
Source: AXA ↗Know the moving calendar
The EU's Digital Omnibus deal moves stand-alone high-risk obligations to 2 December 2027, while transparency duties largely keep their original dates.
Source: Gibson Dunn ↗Where it works
Insurance
Claims and underwriting models classified and documented.
Healthcare & Life Sciences
Clinical documentation assistants with consent and oversight rules.
Banking & Financial Services
Credit and fraud models reviewed for high-risk obligations.
Legal & Professional Services
Firm-wide AI policy and client-confidentiality safeguards.
AI Act & GDPR audit from 950 € · quarterly review available as an add-on.
Common questions
Is this legal advice?
No. We do the technical and organisational work and prepare your lawyers; legal opinions come from them.
Does the AI Act affect a small company?
Yes, if you use or deploy AI. Most SME obligations are about transparency, literacy and not using prohibited practices.
Who supervises AI in Spain?
AESIA, the Spanish AI Supervision Agency based in A Coruña, together with the AEPD and other authorities depending on the area.
Let's find your edge.
Tell us what slows your business down. In 30 minutes we'll show you where AI pays back first — and what it costs.