GDPR-compliant AI chatbot: what to check before you buy

A GDPR-compliant AI chatbot is one you can use under a signed data processing agreement, with a published subprocessor list, a written promise not to train on your inputs, a stated retention period, and a named transfer mechanism for any party outside the EU. No vendor is compliant on its own: the GDPR governs your processing, not their product. So the job before you buy is to check that the vendor gives you every piece you need to make your own processing lawful, in writing.

This post is that check, item by item, with severity. For each line we also say how Union AI answers it, including the two lines where we fall short.

What makes an AI chatbot GDPR compliant for business?

The arrangement, not the tool. When your team pastes a customer email into a chatbot, you are the controller of that personal data and the vendor is your processor. The GDPR then asks you to pick a processor that gives "sufficient guarantees", and to put the relationship in a contract.

That is why the same model can be fine for one company and a problem for the next. The consumer app and the business tier of a big AI product often run the same model under very different terms. We covered that split in is ChatGPT GDPR compliant for company data. This post is the next step: you have decided to buy a business tool, and you need to know what to ask.

The vendor cannot make you compliant. It can only hand you the pieces, or fail to. Your job is to check that none are missing.

The checklist below has fifteen lines. Four are critical: without them, keep personal data out entirely. Five are important. Six are useful and often decide between two otherwise equal vendors.

Does the vendor offer an article 28 DPA?

This is the first question and the only one that can end the conversation on its own. Article 28 of the GDPR requires processing by a processor to be governed by a contract that sets out, among other things, that the processor:

1. acts only on your documented instructions, including on transfers outside the EU,
2. binds its staff to confidentiality,
3. takes the security measures of article 32,
4. follows the rules for engaging other processors,
5. helps you answer data subject requests,
6. helps you with security, breach notification and DPIAs,
7. deletes or returns the data when the service ends,
8. gives you the information needed to show compliance, and allows audits.

If an AI chatbot vendor has no DPA, it is out for anything but public material. If the DPA only appears after three sales calls, that is a signal too. The European Data Protection Board's Guidelines 07/2020 on controller and processor are the reference if you want to know what "sufficient guarantees" means in practice.

How Union AI answers: the DPA page publishes a summary of our agreement, covering roles, subprocessors, transfers, security, breaches and audits. The signable text is sent by email on request, because it is still under legal review and we would rather not have a dated file doing the rounds. You are the controller for what goes in your prompts; we are the processor.

Can you see every subprocessor, with region and legal entity?

A subprocessor is any party your vendor hires that touches your data: the cloud provider running the model, the database, the payment processor, the email service. Under article 28(2), your vendor may only use them with your authorisation, and if that authorisation is general, it must tell you about changes so you can object.

The EDPB sharpened this in Opinion 22/2024, adopted in October 2024. Its conclusion is that controllers should have the identity of all processors and subprocessors down the chain readily available at all times, whatever the risk of the processing. In other words: a vague "we use trusted cloud partners" is not enough.

What a good subprocessor list shows

• The legal entity, not just a brand. "AWS" is a brand; which company signed the contract is the useful fact.
• The processing region for each party.
• The role: what that party does, and ideally what it can see.
• The parent company's country, because jurisdiction follows the company, not the cable.

Change notice and the right to object

Ask how much notice you get before a new subprocessor is added, and what happens if you object. Without an exit, a right to object is decoration.

How Union AI answers: our subprocessors page lists five entries: Scaleway for AI inference and for transactional email, Cloudflare for hosting and CDN, Neon (Databricks) for the database in an EU region, and Stripe for payments through Stripe Payments Europe in Ireland. It names the legal entity country for each and says what each layer can see of your prompt. The DPA commits to announcing changes at least 30 days in advance. If you object and we cannot resolve it, you may terminate the agreement, and any unused prepaid API credit is refunded.

Where does inference run, and who owns the company?

Two questions that vendors love to merge into one. Data residency is where the machine sits. Jurisdiction is which government can compel the company that controls it. An EU datacentre run by a subsidiary of a US company is still reachable by US law, which is the subject of our post on the US CLOUD Act and EU-hosted data.

For an AI chatbot, the row that matters most is inference: the moment the model reads your prompt and writes the answer. That machine has your text in memory, in the clear. Storage in Frankfurt means little if inference happens in Virginia. The whole request path is walked through hop by hop in where your prompts go: EU AI data residency.

Question	Weak answer	Strong answer
Where does inference run?	"Global infrastructure"	A named region inside the EU
Who operates it?	A brand name	A legal entity and its country
Which parents sit outside the EU?	Not mentioned	Listed, with what they can see
What is claimed about the rest?	"Your data never leaves the EU"	Exactly which parts are in the EU and which are not

How Union AI answers: all AI inference runs at Scaleway, a European company, on infrastructure inside the European Union. Prompts and outputs never go to the United States or China. Hosting runs in Cloudflare's EU region and the database in an EU region. Three parties in our chain (Cloudflare, Neon and Stripe) have a US parent entity, and the full list with regions and entities is on our subprocessors page.

Which transfer mechanism covers the non-EU parts?

The GDPR does not require data to stay in the EU. It requires a valid basis for any transfer out of it. The usual three:

• An adequacy decision for the destination country.
• The EU-US Data Privacy Framework, the adequacy decision the European Commission adopted on 10 July 2023. It only covers US companies that have signed up to it.
• Standard contractual clauses (SCCs), the Commission's model clauses, usually with a transfer impact assessment.

Ask the vendor which one applies to each non-EU party, or to each EU party with a foreign parent. "We are GDPR compliant" is not an answer to this question.

How Union AI answers: the DPA states that the Commission's standard contractual clauses apply to the hosting, database and payment providers with a US parent, along with the additional measures those parties take. It also says plainly that we do not claim this settles every jurisdictional question.

Is the AI trained on your inputs?

This line is critical for a reason that is easy to miss. Training on your prompts is not just a leak risk. It changes the purpose of the processing, and purpose limitation is one of the GDPR's core principles. If your customer's email becomes training data, you now need to explain that purpose in your own privacy notice, which you probably cannot.

Check three places: the terms of service, the DPA, and any "product improvement" clause. Search for "train", "improve" and "service improvement", and read every hit. The promise has to be in the contract you sign.

How Union AI answers: the models run under our management and are not trained on customer data. The privacy notice adds that we do not use the content of your prompts and responses to train or improve models, and do not sell or share them. We also do not train a base model of our own: we run published open-weight models. By the standard above, you should want that promise in the agreement you sign, so ask for it there, from us too.

How long are prompts, responses and logs kept?

Retention is where vague vendors get caught. The GDPR's storage limitation principle means data may be kept no longer than needed for its purpose, so you need a number for each type of data, not a general promise.

The three things to ask about

1. Prompts and responses. Kept at all? For how long? Used for abuse monitoring, and who can read them?
2. Request logs and metadata. Timestamps, token counts, IP addresses. Metadata is personal data too when it is linked to an account.
3. Deletion. What happens when you delete a conversation, close your account, or end the contract? Article 28(3)(g) requires deletion or return at the end.

How Union AI answers: the privacy notice gives a period per data type. Prompts and responses in the processing of a request are held in memory only and not stored. Token counts, tier, timestamp, duration and error code per request are kept 13 months for metering and faults. Reroute events are kept 13 months, separated from your account where possible. IP address and user agent at sign-in are kept 90 days. Financial records stay seven years, because tax law says so. The chat also shows your earlier conversations so you can pick a thread back up, and you can delete a conversation yourself. If chat history matters for your own assessment, ask us for the details in writing, as you would any vendor.

Which security certifications should an AI chatbot vendor have?

ISO 27001 is an international standard for an information security management system, certified by an external auditor. SOC 2 is an audit report on security controls, common with US vendors. Neither is required by the GDPR. Both are useful evidence that a vendor's security claims have been checked by someone other than the vendor.

Two things to watch for. First, whose certificate is it? A vendor running on a certified cloud provider is not itself certified. Second, what is in scope? A certificate that covers the office network but not the production system proves little.

How Union AI answers: honestly, we do not have either. We hold no ISO 27001 certificate and no SOC 2 report today. What we do publish, in the DPA, is the list of measures: encryption in transit and at rest, need-to-know access, API keys stored only as a hash, secrets in a key vault rather than code, and periodically tested database backups. The DPA also gives you a yearly audit by an independent party, or our reporting on request. If your procurement policy requires a certificate, that is a real gap. Weigh it as one.

Will the vendor help with DPIAs, breaches and data subject requests?

A data protection impact assessment (DPIA) is required under article 35 when processing is likely to result in a high risk to people. For an AI chatbot, that usually depends on what you put in, not on the chatbot. Summarising public reports is low risk. Sifting job applications is not. Our post on whether you can put customer data into an AI chatbot works through that decision for your own side of the arrangement.

What you need from the vendor is cooperation: facts for the DPIA, fast breach notices so you can meet your own 72-hour deadline, and help when a customer asks what happened to their data.

How Union AI answers: the DPA commits to informing you without undue delay in case of a breach, with what you need for your own notification, and to helping with data subject requests, a DPIA and questions from the supervisory authority, as far as can reasonably be asked of a processor.

What does the AI Act add?

Less than people fear, for a buyer. The transparency obligations in article 50 of the AI Act apply from 2 August 2026. If you deploy a system that talks to people, they must know they are talking to a machine. The European Commission's guidance on article 50 says that has to happen clearly, from the first interaction.

For vendor selection, the practical question is simple: will the vendor tell you which model you are running, so you can pass that on?

How Union AI answers: our AI transparency page names the open-weight model and licence behind every tier and publishes the chat's system prompt in full.

Union AI against the checklist

Here is the full picture in one table. Tick the same boxes in the checklist above with the "Fill in Union AI" button and you get the same result.

Check	Severity	Union AI
Article 28 DPA	Critical	Yes, summary published, signable text on request
No training on inputs	Critical	Yes, on the subprocessors page and in the privacy notice
Full subprocessor list	Critical	Yes, five entries with role, region and entity
Transfer mechanism named	Critical	Yes, SCCs for the parties with a US parent
Change notice, right to object	Important	Yes, 30 days, with a right to terminate
Inference inside the EU	Important	Yes
Retention per data type	Important	Yes, see the privacy notice
Deletion at the end	Important	Yes, except legally required financial records
Breach notification	Important	Yes
Logs documented	Useful	Yes, 13 months for request metadata
Audit rights	Useful	Yes, yearly independent audit or reporting
DPIA and request support	Useful	Yes
ISO 27001 or SOC 2	Useful	No
AI Act transparency	Useful	Yes
No non-EU parent in the chain	Useful	No, three US parents

The chat plan is €13 a month, or €11 a month billed yearly, with 2,000 messages included; the details are on the pricing page. If you are comparing us with others, the ranked list of European AI chatbots runs the same kind of test across the market. And if you are moving a team off a consumer tool, how to switch your team from ChatGPT covers the rollout.

How to run this check in one afternoon

1. Open the vendor's DPA. No DPA, no personal data. Done.
2. Open the subprocessor list. Count the entities, the regions and the parents outside the EU.
3. Search the terms for "train". Read every hit.
4. Find the retention table. One period per data type, or ask for one.
5. Ask about certificates and audits. Whose certificate, what scope.
6. Write your own privacy notice paragraph. If you cannot describe the processing honestly in three sentences, the vendor has not given you enough.

Run it on us as well. A vendor that is confident in its answers should be glad you asked.