AI agents, data protection and the way to a first project

Most companies are not asking whether artificial intelligence is worth anything. They are asking where to start – and whether they are even allowed to use their data for it. This text answers both, in that order.

What an AI agent is – and what it is not

An AI agent is a program that carries out a clearly bounded task on its own: read data, check it, decide, hand it on. It is not an all-rounder, and it is not meant to be. The benefit appears where a task comes up often enough, is described clearly enough, and has a result you can check:

• Taking over repetitive work. Capturing data, sorting enquiries, compiling reports – work that costs time and contains no decision.
• Preparing decisions. Summarising large amounts of data, naming what stands out, making proposals. People still decide.
• Giving information. Round-the-clock first response based on your own documents – with sources, so it can be looked up.

An example: an incoming enquiry is read, matched to the right case, turned into a draft quote using your price list and template, and put in front of the responsible person for approval. The draft takes minutes; the approval stays with a human.

Where the models run: cloud, Europe or your own building

For data protection, where the computing happens is the decisive question. There are three routes, and we choose one together with you:

• A service outside the EU. Available fastest, but every record containing personal data needs a basis for the third-country transfer. Defensible for some tasks, not for others.
• Processing inside the EU. Models on European servers. The record does not leave your legal area, so the question of third-country transfer never arises.
• On your own premises. Open-weight models on your hardware. The most demanding route – and the only one where the data never leaves the building.

The decision is not made once for everything, but per use case. A marketing copy variant is not the same thing as a personnel file.

What the EU AI Act requires

The EU AI Act assigns every application a risk class. For most of what gets automated in a mid-sized company, the duties are manageable: label machine-generated content, stay traceable, name the people responsible. Some areas carry more – AI in HR counts as high-risk, which is why the selection decision has to stay with people there. And since February 2025, Article 4 has required that the people working with these systems also understand them. That is why training is part of the project for us, and not an add-on afterwards.

An approach, not a platform

We do not sell a platform that ties you down. We build along your task, connect the result to the systems you already run, and hand it over in a state where you could operate it without us. What you get from us is the work itself – and the documents you need to stand behind it.

In short

Start where the task comes up often enough, is clearly described, and eats time today. Settle beforehand where the data may be processed. And make sure every step stays traceable. Then artificial intelligence is not a gamble for a mid-sized company, but a tool.