Skip to content

Using AI
under EU rules.

Five practical guides for the people who sign off on AI: what the AI Act requires and when, how to keep personal data out of prompts, and how to assess an AI provider. Each one ends with a checklist.

Browse the guidesWhere our facts come from

Five guides.
Free to read.

Written for CISOs, DPOs and heads of platform and procurement. Use the checklists in a DPIA, a vendor review or your AI policy.

Measured on 105 synthetic test cases

Pattern matching removed 57% of personal details. Adding a trained model removed 98.7%.

Keeping personal data out of AI prompts

Every prompt that reaches an AI provider is a disclosure.

Share of annotated personal details removed from 105 held-out synthetic test cases, measured on 15 September 2026. This does not measure whole-document anonymity. The guide explains the method and its limits.

Read the guideData protection · 9 min
Regulation · 8 min

The AI Act for organisations that use AI

Most organisations will never train a model. They buy AI tools, call model APIs and build assistants on top of them.

Procurement · 7 min

Sovereign AI due diligence: sixteen questions for any provider

"Sovereign" appears in almost every AI provider's marketing, and it can mean four different things: where data is processed, who owns the provider, which…

Risk assessment · 6 min

Assessing CLOUD Act exposure for AI services

When an AI provider is controlled from the United States, US authorities can in principle order it to hand over your data, wherever that data is stored.

Evaluation · 6 min

Choosing an EU AI inference provider: a scorecard

There is now a real choice of European providers for running AI models, from Mistral's own platform to model services from European cloud providers.

Where the facts
come from.

Dates and court findings come from the official text: EUR-Lex, the Court of Justice and the European Commission. When a guide relies on a company announcement or press reporting, the sentence says so.

Official text first
Regulations, judgments and guidance are cited at source, with article or paragraph numbers.
Reporting is attributed
Deals, product claims and anything we could not confirm at source name the company or outlet that published them.
Dated and kept current
Each guide shows when it was last checked, and is updated when the law or a provider's terms change.
Both sides of a disputed risk
Where a risk is contested, the guide gives the main argument against it too.

Key sources

Questions about your own set-up?

We can go through your data flows, providers and controls with you.

Talk to our team