Do AI tools need a Data Processing Agreement under GDPR?

Yes. Any AI tool that processes personal data on your behalf is a data processor under GDPR Article 28, which requires a written Data Processing Agreement before processing begins. This applies to tools like ChatGPT Teams, Microsoft Copilot, Slack AI, and any other AI product where personal data may appear in prompts or outputs.

What does SOC 2 require for AI tools?

SOC 2 requires you to inventory AI tools as vendors under CC9.1, control access to those tools under CC6, and have a written acceptable use policy under CC1. If you build AI into your product, additional controls apply including audit logging of AI calls, per-tenant rate limiting, and incident response procedures for AI provider outages or breaches.

Which AI tools are GDPR compliant?

The major enterprise-tier AI tools are GDPR compliant when properly configured: OpenAI API and ChatGPT Teams/Enterprise, Microsoft Copilot for M365, GitHub Copilot Business and Enterprise, Google Gemini for Workspace, Anthropic Claude API, Slack AI on Business+ and Enterprise Grid, and AWS Bedrock. In every case, GDPR compliance requires signing the provider's Data Processing Agreement and using the enterprise or API tier rather than a free consumer plan.

Does using AI tools affect my SOC 2 audit scope?

Yes. AI tools expand your vendor inventory, create new data flows that auditors will trace, and require documented policies and access controls that may not have existed before. Auditors now routinely ask which AI tools your team uses, whether you have DPAs, what data classification rules apply, and whether your AI vendors are included in your CC9.1 vendor risk program.

What is the EU AI Act's impact on SaaS companies using AI tools?

For most SaaS companies, the EU AI Act's main impact is documentation requirements rather than prohibitions. General-purpose AI tools used for internal productivity fall into limited-risk categories. If your product uses AI to make decisions affecting individuals in areas like HR, credit, or healthcare, higher-risk obligations apply including transparency requirements and human oversight processes. The EU AI Act compliance deadline for most obligations is August 2026.

AI tools and GDPR/SOC 2 compliance: the complete 2026 guide

Your team uses AI tools. Almost certainly more than you know. Engineers paste code into ChatGPT to debug it. Sales reps draft emails with Claude. GitHub Copilot writes a meaningful percentage of production code. Customer support feeds tickets into a model to get summaries. Each of these tools is, from a compliance standpoint, a third-party data processor. That changes your audit scope, your GDPR obligations, and the vendor management program you need to run.

AI tools GDPR and SOC 2 compliance checklist for 2026

This guide covers what GDPR and SOC 2 actually require when your company uses AI tools, and what you need to do before an auditor or a customer's security team asks.

Why every AI tool is a compliance event

When your team sends data to an AI provider, something specific happens from a legal and control standpoint. A new data processor relationship is created. Data leaves your environment and enters theirs. The provider receives that data under terms you may have never read.

Under GDPR, sending personal data to any external processor requires a Data Processing Agreement (DPA). No DPA means an unlawful transfer, regardless of whether the AI provider has good security practices. Under SOC 2, every vendor that receives your data must be inventoried under CC9.1, scoped appropriately, and assessed periodically for risk.

Most companies discovered this the hard way in 2023 and 2024 when auditors started asking for their AI tool inventory and DPA documentation. In 2026, these questions are standard fieldwork. The companies that prepared have clean answers. The ones that did not are remediating during the audit, which is the worst possible time.

What GDPR requires for AI tools

GDPR Article 28 requires a written DPA before any processor handles personal data on your behalf. For AI tools, this means:

You need a DPA with every provider that receives personal data. This includes: OpenAI, Anthropic, Microsoft (for Copilot), Google (for Gemini and Workspace AI), GitHub (for Copilot), Notion, Slack, Zoom, HubSpot, Salesforce, and any other tool where personal data might flow into an AI model.

Consumer tiers do not provide DPAs. ChatGPT free, Notion free, and most free-tier AI features operate under consumer terms that do not include GDPR-compliant data processing terms. You need to be on a paid enterprise or API tier that explicitly provides a DPA and data processing terms.

Training opt-out matters. GDPR does not just require a DPA. It requires that personal data is processed only for the purpose you specify. If a provider trains on your prompts by default, your employees have created a new unauthorized processing purpose. Every major provider offers API and enterprise tiers that explicitly disable training on your data. Verify the tier you are actually on.

Data transfer mechanisms for non-EU providers. If you are subject to GDPR and your AI provider is US-based, you need a valid transfer mechanism. For most providers, this is Standard Contractual Clauses (SCCs), which should be included in the DPA. Verify they are there.

The EU AI Act adds a layer starting from August 2026. If you use AI in high-risk categories (HR decisions, credit scoring, medical assessment), you have new transparency and human oversight obligations that sit on top of GDPR. For most SaaS companies using AI for internal productivity or product features, the risk category is limited and the Act's main impact is documentation requirements.

What SOC 2 requires for AI tools

SOC 2 does not name AI tools specifically, but the Trust Services Criteria apply clearly.

CC9.1 vendor inventory. AI providers are vendors. They belong in your vendor inventory the same way AWS or GitHub does. Each provider should be documented with the data it receives, the risk tier assigned, the DPA or data processing terms on file, the relevant SOC 2 or ISO 27001 reports, and the next reassessment date.

CC6 logical access controls. Who can access the AI tools your company uses? Can a contractor paste customer data into ChatGPT? CC6 requires you to control access to systems that process your data, and AI tools are in scope.

CC1 acceptable use policy. You need a written policy covering which AI tools are approved, which data classifications are permitted in each tool, what the approval process is for new tools, and what the consequences of violation are. Auditors will ask to see this document.

AI in your product. If you build AI features into your product, the scope expands further. You will need access controls on model calls, rate limiting, per-tenant cost caps, audit logging of AI interactions, and a process for handling AI errors. Prompt injection becomes a security risk worth documenting. Fully autonomous AI decisions on sensitive customer data require human review processes.

The AI tools you are probably using and what each requires

This is a summary of the most common AI tools and their compliance status as of mid-2026. Detailed posts on each tool are linked below.

Tool	DPA Available	SOC 2 Report	Training Opt-Out	Zero Retention Option
OpenAI API	Yes (Enterprise)	SOC 2 Type II	Yes (API default)	Yes (Enterprise)
ChatGPT Team/Enterprise	Yes	SOC 2 Type II	Yes	Yes
Microsoft Copilot (M365)	Yes (DPA addendum)	ISO 27001 + SOC 2	Yes (enterprise)	Yes
GitHub Copilot Business	Yes	SOC 2 Type II	Yes	Yes
Google Gemini for Workspace	Yes (Google DPA)	ISO 27001 + SOC 2	Yes (admin toggle)	Yes
Anthropic Claude API	Yes	SOC 2 Type II	Yes (API default)	Yes
Notion AI (Business+)	Yes	SOC 2 Type II	Yes	Yes
Slack AI (Enterprise Grid)	Yes	SOC 2 Type II	Yes	Yes
HubSpot Breeze AI	Yes (included in MSA)	SOC 2 Type II	Yes	Yes
AWS Bedrock	Yes (AWS DPA)	ISO 27001 + SOC 2	Yes	Yes (no persistent storage)
Azure OpenAI	Yes (Microsoft DPA)	ISO 27001 + SOC 2	Yes	Yes
Zoom AI Companion	Yes (Zoom DPA)	SOC 2 Type II	Yes (admin toggle)	Yes

The pattern is consistent: enterprise and API tiers provide the compliance documentation you need. Consumer and free tiers do not. The DPA, SOC 2 report, and training opt-out are what auditors and your customers' security teams will ask for.

The practical steps to get compliant

Getting AI tool compliance right breaks down into four workstreams.

01Inventory every AI tool in use

Run a survey or check your SSO logs. You will almost certainly find tools you did not know about. Shadow AI is common. The inventory is the starting point for everything else.

02Classify the data each tool receives

For each tool, document what categories of data flow into the model. Customer PII, source code, internal financials, and system credentials all carry different risk levels and require different controls.

03Collect DPAs and SOC 2 reports for every tool that receives personal data

Most providers publish these through their trust or security portals. For Microsoft, Google, and AWS, these are available through their enterprise documentation portals. Set calendar reminders to reassess annually.

04Write and distribute an AI acceptable use policy

The policy should name approved tools, specify which data classifications each tool can receive, define the approval process for new tools, and require annual acknowledgment. It does not need to be long. Two pages is enough.

The AI audit DPA checklist

When a customer's security team sends you a questionnaire about your AI usage, these are the questions they will ask. Have answers ready before they arrive.

Which AI tools does your company use in its products or internal workflows?
Does your company have a DPA with each AI provider that processes personal data?
Do your AI providers offer zero data retention or short retention with no training?
Where are your AI providers' data centers, and do any involve transfers outside the EU/EEA?
Does your company have an AI acceptable use policy in writing?
Are your AI tools included in your vendor risk management program?
What controls prevent employees from sending customer PII to unapproved AI tools?
If AI decisions affect customers, what human oversight processes exist?

If you can answer all eight of these with documentation in hand, you are ahead of the curve. If any requires digging, fix it before your next audit or customer questionnaire lands.

Per-tool guides

For a detailed breakdown of each specific tool, see the individual posts in this series:

If your company builds AI into its product or is evaluating a formal AI governance program, see the ISO 42001 AI management system guide for the certification framework that maps directly to SOC 2 and GDPR controls.

Keeping a growing list of AI tools audit-ready means mapping each one to the right SOC 2, GDPR, and ISO 27001 controls, pulling evidence from each provider's trust portal, and tracking DPA expiration dates before they lapse. That ongoing work is what a fractional CISO owns for you. Book a call.

Want a security leader to run this?

Xorabyte is a fractional CISO for startups who can answer a blocked security questionnaire, so a blocked deal or an audit stops being your problem to carry alone. Book a call and you will leave with a clear path, not a sales pitch.