GDPR and AI customer service: a checklist for small businesses.

The short version.

You may use AI to answer your customers in the EU. The GDPR asks of it what it asks of any service that handles your customers' data: a reason to use the data, telling customers about it, a contract with the provider, keeping the data safe and only as long as needed, and answering your customers when they ask what you hold about them. On top of that, since 2 August 2026 the EU AI Act asks that people are told when they are talking to an AI, unless it is obvious.

The checklist.

1. A reason to process. Answering a customer's own question is usually part of dealing with their request or their contract with you (GDPR Article 6(1)(b)). Marketing is different, and usually needs their consent.
2. Tell your customers. Your privacy notice says that messages are answered with the help of AI providers, who receives the data, whether it leaves the EU and how long you keep it (Article 13).
3. Say that it is AI. People must be told they are interacting with an AI system, at the latest at the first interaction, unless it is obvious (AI Act, Article 50). A short line on every AI-written message does it.
4. A contract with the provider. A provider that handles your customers' data for you needs a data processing agreement (Article 28), and you should be able to see which sub-processors it uses.
5. Transfers outside the EU. If an AI provider processes the data outside the European Economic Area, the transfer needs a legal basis, such as an adequacy decision or standard contractual clauses (Articles 44 to 46).
6. Not for training. Read whether the provider uses your customers' messages to train its models, and choose one that does not.
7. Only what is needed. The AI should see what it needs to answer, not whole customer files. Health and other sensitive data need special care (Article 9).
8. A time limit. Keep conversations only as long as you need them, and decide how long that is (Article 5).
9. Answer requests. A customer may ask to see their data (Article 15) or to have it erased (Article 17). You answer without undue delay and within one month, or three for complex cases if you tell them in the first month (Article 12(3)). So you must be able to find everything about one customer, in the AI tool too.
10. A person for decisions that matter. Decisions with legal or similarly significant effects, made by automated means alone, are restricted (Article 22). Answering questions is not such a decision; refusing a contract may be.
11. Security and breaches. Keep the data safe (Article 32). A breach that risks harm to people is reported to your data protection authority within 72 hours of learning of it (Article 33).
12. Write it down. Add the AI customer service to your record of processing activities (Article 30).

How Neaion answers them.

• Hosted in the EU. To write an answer, a customer's message is read by the AI providers named on our sub-processors page, under our data processing agreement.
• Not used to train AI. Neither your data nor your customers' data is used to train AI models.
• Every automated message says it was written with AI, and a customer who asks whether they are talking to a person always gets the true answer.
• One customer, found and erased in one place. Download everything about a customer for their request, or erase them on request, conversations included. Invoices you must keep by law stay.
• A customer's records only to that customer, once they have proved who they are.
• Each business apart. Your records are kept apart from every other business's, and closing your account deletes everything 14 days later.

See what your office may never do, and what always waits for you.