Multiple laws.
One platform.
One fixed monthly fee

Most likely yes. The EU AI Act applies to any company whose employees use AI tools for work – ChatGPT, Microsoft Copilot, AI hiring tools, AI customer service. That makes your company an official "AI Deployer" under the regulation, regardless of size. AI literacy obligations have been in force since 2 February 2025. Most companies have not caught up: in a 2025 Bitkom survey of German companies with 20 or more employees, only 8% train all their staff on AI, 21% train most, 25% train selected people, and 43% offer no AI literacy training at all. Training courses are not the only way to meet this requirement, but they are the easiest thing to show a regulator who asks how you met it. There are no exemptions based on company size.

Probably not. In a 2025 Bitkom survey of German companies with 20 or more employees, 86% said data protection is never fully done, and 82% were unsure what the rules actually require. The single biggest burden they named: documenting processing activities (73%). That is exactly where gaps accumulate quietly – outdated or incomplete Records of Processing Activities (RoPA), vendor Data Processing Agreements that don't reflect the tools you use today, missing or inadequate Technical and Organisational Measures (TOMs). Not one company in that survey reported a shrinking workload; for 69% it grew. On top of that, adding AI tools to your operations requires GDPR documentation updates – two laws with different triggers, and a GDPR compliance exercise done once doesn't cover the AI Act.

If your lawyer is a practising DPO specialising in both GDPR and the AI Act, and is continuously keeping your documentation current – you may genuinely be covered. If the advice was a one-time consultation or from a general corporate lawyer: GDPR requires continuous monitoring, and the AI Act requires structured documentation that updates every time your AI tool usage changes. It's a platform for keeping your compliance documentation current, continuously. That said, our platform doesn't replace legal advice from an attorney.

At that point, market surveillance authorities have full powers to inspect AI deployers for AI Act compliance and prohibit the use of non-compliant systems. A company that has done nothing is a company with no documentation, no AI system register, no evidence of staff training. Those are exactly the first things inspectors look for. The regulatory message is unambiguous: a company that can document having taken steps in advance is in a fundamentally stronger position than one that took no action.

In 2026, the EU amended the AI Act, deferring some deadlines. The deferral covers high-risk systems: AI used in hiring, credit scoring, or similar high-stakes decisions (Annex III, now due 2 December 2027), and AI embedded in regulated products like medical devices or vehicles (Annex I, now due 2 August 2028). This applies to providers and deployers alike, including the deployer duties for high-risk systems (Article 26) – human oversight, record-keeping, and informing the people affected. Two obligations are not deferred and already apply: AI literacy, meaning your staff know how to use AI responsibly (Article 4, in force since February 2025), and transparency, meaning people are told when they're dealing with AI (Article 50, from 2 August 2026). If you don't use high-risk AI, nothing has changed for you. If you do – for example in hiring or staff monitoring – your AI literacy and transparency obligations already apply now, and the safest move is to prepare for full high-risk compliance early, rather than wait for the 2027 deadline.

That figure is real, and it is the ceiling for prohibited AI practices under Article 5, such as social scoring. That is conduct the law does not allow at all, not a documentation gap you can close. The duties you actually carry as a deployer, including transparency and human oversight, sit one tier lower: up to €15M or 3% of worldwide annual turnover (Article 99(4)). The same tier covers provider duties, which you take on yourself if you put your own name on a high-risk system or substantially modify one (Article 25). For SMEs and start-ups Article 99(6) applies the lower of the two figures rather than the higher, and the GDPR has no equivalent rule: both of its tiers apply whatever your size.

No. Different triggers, different documentation. GDPR applies because you process personal data. The AI Act applies because you use AI tools. They overlap where AI processes personal data – but they are two separate laws with separate requirements. Managing them separately, through different consultants or tools, means paying twice, coordinating manually, and risking gaps at the intersection. ETHYX covers both in one platform: faster, cheaper, no duplication.

A DPO (Data Protection Officer) is the person formally appointed in a company to monitor compliance with GDPR. Mandatory DPO appointment applies under GDPR Article 37 to companies that carry out large-scale processing of personal data, and under Section 38 BDSG to German companies where 20 or more employees regularly process personal data. In practice, this covers most mid-sized companies. An external DPO fulfils the same function as an in-house DPO without the cost of hiring: formally appointed, on record, available within SLA, and professionally accountable for their assessments. Included in Expert and Scale plans.

A law firm or external consultant charges €300-500/hour and handles GDPR and the AI Act as separate projects – you get advice, not a system. ETHYX generates, stores, and automatically updates your documentation when things change, with a certified DPO included in the subscription. For ongoing compliance, the economics are not comparable. That said, our platform doesn't replace legal advice from an attorney.

Most compliance platforms cover one law – either GDPR or the AI Act – and are designed for large organisations with dedicated compliance teams. ETHYX supports any company short on data protection know-how, time, or resources, whether or not it already has its own DPO. Both laws are covered in one subscription, with a straightforward interface and transparent pricing. In Expert and Scale plans, a certified external DPO is already included – not a chatbot, not a template library.

You complete the onboarding questionnaire and the platform generates your personalised compliance documentation right away. On Expert and Scale plans, your DPO is in touch within 48 hours.

The platform monitors your compliance profile continuously. When something changes – a new tool, a new vendor, a regulatory update – your documentation is updated and the necessary actions appear in your dashboard.

The platform includes ready-made workflows for the situations that matter most: data subject requests, data incidents, and regulator notifications. On Expert and Scale plans, your DPO guides you through each step.

The AI Act and GDPR apply to any company operating in the EU or processing data of EU residents – regardless of where the company is registered. ETHYX is built in Germany, to German and EU legal standards. Reach out before signing up and we'll confirm how the platform applies to your situation.

No – all plans run for 12 months. The reason lies in the service itself: compliance is not a one-off project but continuous work. By law, your documentation has to stay current at all times, and an external DPO (on Expert and Scale plans) is formally appointed for your organisation and stays active year-round, not month to month. You always have a choice: pay monthly, or pay for the year upfront and get one month free.