The platform
One platform instead of a legal team
ETHYX turns simple questionnaires into the documentation GDPR and the EU AI Act require of you, keeps it current as your business changes, trains your team, and gives you an external DPO (data protection officer) when you need one.
How it goes
Simpler than you would expect
Today
You do not know which obligations apply to you.
After onboarding
One questionnaire answered. The gaps are identified, not guessed at.
From there
Documents, training and status in one place.
Ongoing
Kept current, with someone who knows your business.
Today
You do not know which obligations apply to you.
After onboarding
One questionnaire answered. The gaps are identified, not guessed at.
From there
Documents, training and status in one place.
Ongoing
Kept current, with someone who knows your business.
That is the whole path. No project plan, no legal team, no six-month rollout.
Onboarding
It starts with onboarding. Everything else is built on it
One guided questionnaire about your company, your team, and the tools they use. It produces your company profile. That profile is the foundation for everything ETHYX does for you.
Plain language
Broken into clear categories, so you always know which part of your business a question is about.
Yes or no
Most questions are answered with one click. No essays, no legal drafting, no blank fields staring back at you.
Prompts where it matters
Where a question needs context, the context is right there. You are never left guessing what is being asked.
Nothing gets missed
The questionnaire is written so the gaps surface here, rather than waiting to be found by an inspector.
At your pace
Stop in the middle and continue later. Your progress is kept exactly where you left it.
One profile, several laws
GDPR, the EU AI Act and German federal data protection and digital services law all draw on the same answers. No legal background needed at any point.
What you have answered once is not asked again. Later modules build on this profile instead of starting over.
Capabilities
What the platform actually does
ETHYX groups its modules into a few clear categories.
Documentation
Your documents are generated from your company profile and updated as your business changes: a new AI tool, a new vendor, a new process.
- RoPA, the Art. 30 GDPR register
- AI system inventory and Art. 26 deployer documentation
- Privacy policy, legal notice and data processing agreements (DPAs)
The file a supervisory authority, an insurer or an enterprise customer asks for already exists, with your company name on it.
Control
Your documentation does not quietly go out of date. You are told before something is due, not after. When German authorities publish new guidance, our compliance experts read it so you do not have to, and explain in plain language what it means for you.
You stop carrying the compliance calendar in your head, and nothing falls off it.
Action
When a clock starts, you get a checklist, not a research project. Someone asks what data you hold on them. An incident happens and the law gives you 72 hours. The deadline is in front of you and the essential information is already in the system.
The worst day to start learning the process is the day the deadline begins.
Training
Staff who use AI tools need documented training under Article 4 of the AI Act. Data protection training is expected under GDPR as well. ETHYX covers both, assigns it to the people who need it, and keeps the record.
Other providers cap how many people you can train. We do not count heads.
Your time
We respect your time
Compliance software that takes as long as doing it by hand defeats the point. The same is true of everything you do with us, not just the first form.
Pre-filled
Part of the questionnaire is filled from your own company website before you start.
Carried forward
Where an answer follows from what you already told us, the next field is filled in for you.
Asked once
One answer serves every part of the platform that needs it. Nothing is asked twice.
On your schedule
Break off whenever you need to and pick up later, without losing your progress.
We keep working on making this even shorter: more automation, fewer steps, less of your attention spent on it.
That does not change the documentation you get. It changes how much of your week it costs.
People
When you need a person, not only documents
ETHYX is not only technology. There are people behind it. Your external DPO is the clearest example.
When ETHYX acts as your DPO, you have a person rather than an address: a name, a direct line, and someone who learns how your business works and keeps that context from one conversation to the next.
Included in Expert and Scale
Appointed on record, inside the same subscription and the same fixed price.
By the hour on any plan
Including Starter. As many hours as you need, when you need them.
The same person
Someone who already knows your context, not a queue and not a new stranger each time.
Templates cannot make a judgment call. When one is needed, you have someone to ask.
In practice
How this looks in practice
To make this easier to picture, we went for the human touch: concrete stories, told through fictional companies and situations most of us will recognise.
Voss Transports
Family freight forwarder, third generation
EXPERT PLAN- Location
- Near Bremen
- People
- 87
- Sector
- Road freight
- Routes
- Germany, Poland, the Netherlands
Nobody at Voss Transports would call it an AI company.
Where the AI actually is
- Dispatch drafts customer replies with ChatGPT
- A tool reads incoming waybills and drops the data into their system
- The back office answers Polish and Dutch mail through a translator that writes the reply
- Incoming mail is read with the browser's own translation
- Meeting notes in Teams are written by an AI assistant
- The chat widget on their website was switched to an AI model, and nobody told them
All of it counts under the EU AI Act. None of it was ever a decision anyone made.
The managing director found out the way most people do. He read that the AI Act applies to companies using AI at work, went looking for whether it applied to his, and landed on an ETHYX article. At the end of it was a free three-minute check.
It confirmed the laws apply. It also turned up something he had not gone looking for: his GDPR documentation, which he had assumed was settled years ago, had gaps in it. He signed up for the ETHYX Expert plan.
A welcome message arrived the next day with the next steps, and an invitation to a free onboarding webinar where our team walks new clients through the questionnaire live.
He filled in the questionnaire one evening after work. The company details were already there, taken from his own website. The rest was mostly yes or no, sorted into categories: who uses what, and for what.
Every department used its own tools. Nobody had ever put them in one list.
Then the documents arrived with his company name and registration details on them. Training on AI literacy and data protection went out to the people who needed it. Something that had been sitting at the back of his mind for a long time turned out to be far less work than he had feared.
One evening, a few clicks, one platform. What came back wasn't more open questions. It was a clear picture of the concrete steps to compliance.
Brömmer Bürsten
Industrial brushes since 1971
STARTER PLAN- Location
- Bremen
- People
- 18
- Sector
- Manufacturing
- External DPO
- Not required
Most of the team is in production. The office uses ChatGPT for customer quotes, a translation tool for export paperwork, the AI note-taker in Zoom for internal meetings, and an AI tool for first drafts of catalogue text. Ordinary tools, ordinary work, and the AI Act applies all the same.
They do not reach the threshold in §38 BDSG, Germany's federal data protection act, where appointing a DPO becomes mandatory, so the Starter plan, without a bundled DPO, is the right fit. It still produces their documentation and keeps it somewhere they can rely on if anyone asks.
Then a new accounting software vendor sent back its own data processing agreement, with clauses the owner did not fully understand and did not want to sign on a guess. He bought DPO time by the hour, got a specialist's read on those clauses, and signed. Minimal effort, exactly where it counted.
The same platform fits an 87-person forwarder with a DPO on record and an 18-person manufacturer without one. What changes is what you add to it, not which product you buy.
Afterwards
What happens over the following year
Compliance is not a project that ends. Here is the year after, at Voss Transports. It looks like this when the modules are filled in carefully and our recommendations are followed.
A department picks up something new
Customer service starts using a chatbot plug-in. It goes into the company profile, and the documents that depend on it are regenerated. Nothing rebuilt by hand.
Someone asks what you hold on them
A customer submits a data access request. Whoever has platform access works through the steps and answers inside the legal deadline. The response is assembled, not researched.
A big customer asks for proof
Before renewing a multi-year contract, a manufacturing client wants compliance evidence. It gets exported from the platform, not assembled from scratch under time pressure.
New guidance is published
German authorities publish guidance on the AI Act for deployers in logistics. Our compliance experts read it and send a plain-language note: what changed, what needs attention.
An authority runs a spot check
Supervisory authorities check SMEs selectively under both laws, and Voss Transports comes up. Everything is in one place and current. Their DPO reviews what goes out before it goes.
None of it needed a specialist on staff
That is the point of the year after.
Security
Where your data lives
- Hosted in the EU, on ETHYX's own infrastructure
- No US or other non-EU cloud services or APIs in it
- Encrypted at rest and in transit
- Every document template legally reviewed by our own team before it reaches your account
Compliance is our product, so we start with our own
See where your company stands
Three minutes. No email required to see your result.