AI and GDPR assessment for your business in Barcelona

AI is already in your business; the policy isn’t yet

It’s what we see in almost every SME, law firm and clinic we talk to in Barcelona: someone on the team uses ChatGPT to summarise a contract, someone else pastes a client spreadsheet into a free assistant, and nobody has decided what is and isn’t allowed. In the legal sector, more than a quarter of professionals admit to having entered real client data into ChatGPT, according to the Barómetro Sector Legal Digital 2026.

The risk isn’t theoretical. Uploading personal data to a tool without a data processing agreement conflicts with the GDPR. If you work under professional secrecy, it is also a matter of professional ethics. And the EU AI Act already applies: since February 2025, Article 4 has required your team to have sufficient AI literacy; since 2 August 2026, Article 50 has required you to tell people when they are talking to an AI. If your business also falls under NIS2, or works for one that does, you will be asked to keep control over every supplier that touches your data.

The assessment answers a simple question: which AI you can use, with which data, and where it has to run so that the data doesn’t leave the office when it shouldn’t.

How we do it, step by step

1. Free 30-minute call. We get to know your case and tell you whether the assessment makes sense. If it doesn’t, we tell you that too.
2. Preliminary questionnaire. Which tools you use, what types of data you handle and which systems you have (ERP, CRM, document management, email).
3. A 2 to 3-hour working session with management and the people who use AI the most, in person in Barcelona or by video call.
4. Analysis. We classify the data into three levels (public, internal and confidential), review obligations and prioritise use cases by impact, effort and risk.
5. Delivery and presentation of the report, with a roadmap and a fixed-scope proposal for the next phases, with no obligation to commission them.

The options we compare, in plain words

We don’t assume everything has to be local. For each use case we compare three routes:

• Cloud with safeguards: business plans with a data processing agreement and servers in the EU. Enough for a lot of work that doesn’t involve sensitive data.
• Local or on-premise AI: open models running on an AI server in your business, with a private ChatGPT-style chat (Open WebUI), an inference engine (vLLM or Ollama) and, if needed, search over your documents with Qdrant. The data never leaves the building.
• Hybrid: sensitive work stays local and generic work goes to the cloud, with a gateway (LiteLLM) that decides what goes where and logs every request.

For each option we state which model fits on which hardware, how many people can use it at once, how much energy it uses and what maintenance it needs. That way you can compare measured data rather than brochures.

When we DON’T recommend it

If you are a team of two or three, don’t handle sensitive data and just want to use ChatGPT or Copilot sensibly, you don’t need a full assessment: on the free call we’ll tell you which business plan to choose and which three rules to give your team. Nor does it make sense if you have already made the decision and have a clearly defined project; in that case we go straight to preparing the fixed-scope proposal for the local AI installation.

Why we can size it with real data

We don’t speak from hearsay. Our Barcelona lab runs two clustered NVIDIA DGX Spark units and a server with an RTX GPU, serving open models with up to a million tokens of context. Our private gateway has served around 11.15 billion tokens in 2026 to several people and dozens of agents, with no per-token cost. When we tell you a model fits on your machine, or doesn’t, it’s because we have measured it.