AI and GDPR: what changes when the model runs inside the company

Which data protection obligations arise when using AI with documents containing personal data, and which ones go away — and which do not — when the system is on-premise.

Polaris AI Team · Updated on 2026-09-29

First: this is not legal advice

This article explains the concepts involved when a business uses AI with personal data. Each specific processing activity needs its own analysis, which is what the company’s data protection officer or a specialist lawyer is for. The official sources are linked at the end.

Obligations that arise when using cloud AI

• Data processing agreement (GDPR Art. 28)

  If the AI provider processes personal data on the company’s behalf, it is a data processor. A contract is needed setting out what it may do with the data, the security measures, and what happens to the data at the end. You also need to verify that the provider offers sufficient guarantees.

• International transfers (GDPR Chapter V)

  If the provider’s servers are outside the European Economic Area, sending data there is an international transfer, which requires a legal basis: an adequacy decision, standard contractual clauses, or another safeguard provided for in the Regulation.

• Use of the data by the provider

  You need to know whether the provider uses the content to train or improve its models, and under what conditions. This varies by product and contract type, and changes over time: check the current terms rather than assuming.

• Data protection impact assessment (GDPR Art. 35)

  When processing is likely to result in a high risk to people’s rights — for example, large-scale processing of special categories or the use of new technologies in certain contexts — an impact assessment is required before starting.

Special categories and professional secrecy

Article 9 of the GDPR gives enhanced protection to certain categories of data: health, genetic and biometric data, political opinions, sexual orientation, among others. A clinic using AI with medical records is processing health data, which raises the bar for everything above.

Professional secrecy — for lawyers, healthcare professionals, advisors — is an obligation separate from the GDPR that adds to it. Sending documentation covered by secrecy to a third party, even a contracted technology provider, is something each professional must weigh against the rules of their profession and its governing body.

What changes with on-premise AI

• The AI provider no longer receives the data

  If the model runs on the company’s servers and the content does not leave its network, there is no AI provider receiving the documents. That part of the processor agreement and the transfer analysis no longer applies to the AI.

• The company is still the data controller

  On-premise AI does not exempt anyone from the GDPR. The company keeps all its obligations: legal basis, information to data subjects, records of processing, security measures, handling of rights requests and, where applicable, an impact assessment.

• There may still be processors

  If whoever installs or maintains the system has access to the data, they may act as a data processor and need their own agreement. And if the AI connects to other services — email, messaging — those services keep their own arrangements.

• Security now depends on the company

  The data is in-house: protecting it from unauthorized access, backups, and controlling who sees what all depend on how the system is set up.

And the EU Artificial Intelligence Act

Regulation (EU) 2024/1689, known as the AI Act, regulates AI systems according to their level of risk and applies in phases. It does not replace the GDPR: both apply at the same time when an AI system processes personal data.

For most administrative uses in a small business — classifying documents, extracting invoice data, answering questions about the internal archive — the bulk of the most demanding obligations, designed for high-risk systems, does not usually apply. But it is worth checking case by case and following the timeline at the official source, because it has been under review.

How Polaris AI handles it

Polaris AI runs on the company’s own servers or a private virtual machine. The container network where the models run has no internet access, and the only outbound connections are to services the company already uses — its own Google Workspace and WhatsApp. Outbound traffic can be audited.

That removes the AI provider as a recipient of the documents. It does not remove the company’s obligations as data controller, and we say so in every conversation.

Official sources and related reading

• What is on-premise AI? What it means for the model to run inside the company.
• On-premise AI versus cloud AI The full comparison.
• AI for clinics and medical centers Health data and GDPR Article 9.
• AI for law firms Professional secrecy.

Official texts: General Data Protection Regulation (EU) 2016/679 · Artificial Intelligence Act (EU) 2024/1689 · Spanish Data Protection Agency (AEPD).