FAQ, AI, GDPR & EU AI Act in the mid-market | DropD.

Question 1

What does AI consulting for mid-market companies cost at DropD.?

Accepted Answer

We deliberately do not name a flat fee. The investment depends on how many departments and processes we touch, and on whether we only advise or also implement. There is a lean starting point, a fixed-price operations check, and full implementation across every area. In the free first conversation we place your case honestly and give you a clear range, with no sales pitch.

Question 2

Where is DropD. based, and do you work across Germany?

Accepted Answer

DropD. is based in Ratingen in Kreis Mettmann, in the Düsseldorf region. We work remotely across Germany for mid-market companies in the DACH region, and we come on site for workshops in Düsseldorf, Essen, Cologne, the Ruhr area, and to you nationwide.

Question 3

What sets DropD. apart from other AI consultants?

Accepted Answer

Three points. First, vendor-neutral: no commission agenda. Second, practice instead of theory: dozens of AI applications in live operation at a mid-market company, across five departments. Third, department logic: we understand that sales needs different tools than purchasing, and the office needs different workflows than the job site. Some departments do not need AI at all. They need clean processes.

Question 4

How long does an AI implementation take in a mid-market company?

Accepted Answer

The operating check (potential analysis) delivers a report with ranked starting points after 2 to 3 weeks. Ready-made workflows are usable from handover. A full rollout across several areas runs in stages over 3 to 6 months, with a visible result each week. Where personnel data or your ERP is touched, access-rights review and works-council involvement come first, and that takes longer.

Question 5

From what company size does AI consulting pay off?

Accepted Answer

From about 20 employees we work with every size. The difference is in the approach. 20 to 50 employees: One area, one workflow, where the bottleneck costs the most. Only once that holds do we add the second. 50 to 100 employees: Here it pays to go across several areas, because the levers work together: what is written down in costing helps purchasing. 100 to 250 employees: Now the rollout decides, not the technology. That means change management and training across departments, with one contact person per department. We clarify access rights and co-determination first. 250 employees and up: Several sites, often several legal entities, an in-house IT team with its own rules. We proceed site by site, work alongside your IT, and document so your people can take over. Below about 20 employees, our approach rarely pays off. We tell you that in the first conversation, instead of selling you a project.

Question 6

Do I need technical prior knowledge?

Accepted Answer

No. Everything is built for users, not for developers. And your people are trained before anything goes live. Where we develop ourselves, we hand over with documentation. Your IT or another provider can take over.

Question 7

What do I actually get, and does it belong to me? Does it keep running if DropD. is not there one day?

Accepted Answer

You do not get a black box. You get a documented setup: workflows, agents and, where we develop ourselves, the tailored AI plus handover. Where we build on your infrastructure or a dedicated server in Germany, what runs there belongs to you, including data and configuration. No lock-in. What you get in hand (license, workflow files, your own server) we set in writing before we start.

Question 8

Do you build your own AI, or do you only sell third-party tools?

Accepted Answer

Both, depending on which path is cheaper to the goal. Where a standard tool is enough, we save you the custom build. Where data protection, specialist knowledge or independence matter, we develop ourselves: we take a strong open-source model and tailor it to your company, hosted in Germany or on-premise if you want.

Question 9

Are you vendor-neutral?

Accepted Answer

Yes. We work with no commission agenda. Whether Copilot, ChatGPT Team, an open-source model or another platform: we recommend what fits your situation, not what pays us a commission.

Question 10

What if AI tools change?

Accepted Answer

They do change. That is why there is the AI Compass: monthly update calls, current recommendations, security notes, exchange with other business owners. No spam, only signal. Your setup stays current without you having to research constantly.

Question 11

Who are you the wrong choice for?

Accepted Answer

Below about 20 employees our approach rarely pays off. If you want a group transformation with a six-figure budget and slides for the board, you are better with a Big 4. If you only want to roll out Copilot licences, a Microsoft partner is often enough. We do not run prompt courses or reseller deals.

Question 12

What can you not do?

Accepted Answer

We do not train large language models from scratch. We do not replace tax advice, legal advice or an ISO certification body. We do not deliver quiet headcount cutting. We do not put high-risk AI into production without a human making the final decision.

Question 13

What does AI actually do for a mid-market company?

Accepted Answer

AI pays off where a process happens often and can be described clearly: pre-sorting emails, drafting quotes, making documents searchable, checking invoices, knowledge search, answering applicant follow-up questions. The value does not appear in abstract places. It appears in processes that currently take hours from someone. That is why we always start with process analysis, not with a tool recommendation.

Question 14

Is AI even ready for productive use?

Accepted Answer

For many use cases yes, for others no. Text, classification, summarization, first drafts and data extraction work reliably. High-precision numbers, legally binding texts and final decisions are better left with people. We separate that cleanly: AI does the draft and the pre-sort, a human reviews and decides.

Question 15

Does AI make jobs redundant?

Accepted Answer

We automate tasks, not people. The goal is that your team sheds the routine and focuses on what they were hired for, not that jobs are cut. Anyone who still plans that has to discuss it openly with the works council. We do not deliver a quiet headcount-cutting machine.

Question 16

Where is the best place to start, which tool first?

Accepted Answer

Not with the tool, with the process. A serious consultant first looks at where time is lost, then finds the tool for that. Anyone who recommends a specific AI solution in the first conversation without knowing your workflows is a warning sign. Typical sensible first steps: knowledge search in your own material, email triage, or quote drafting.

Question 17

ChatGPT, Copilot, or your own AI: what fits whom?

Accepted Answer

For internal texts, brainstorming and non-critical tasks, ChatGPT Team or Copilot is often enough. As soon as customer data, personnel files, design drawings or confidentiality come into play, it gets tight. Then you need an EU-hosted or in-house solution. We classify that per use case, not as a blanket rule for the whole company.

Question 18

How much time does AI really save?

Accepted Answer

Realistically: 50-80% on email classification, 40-60% on quote drafting, 70-90% on document extraction. The important question after that: what does the status quo cost me? A process that eats two employee hours a day adds up to €25,000-40,000 a year at full cost. That is the measure of whether AI pays off, not buzzwords.

Question 19

What is a custom AI agent, and do I need one?

Accepted Answer

An agent is an AI set up for a concrete task in your company, with your data, your rules, your tone. DropD. has six standard agents (e.g. recruiter Mara for applicant follow-up questions, Christian for call transcripts, Paula for mail triage). You need that from the moment standard ChatGPT is no longer enough, because it does not know your internals.

Question 20

Is a proof of concept worth it first?

Accepted Answer

Yes, on larger projects. A PoC shows on a real use case whether the AI delivers what it promises, before you go into full implementation. We do that as part of the potential analysis: measure first, then decide whether it pays off. That way you avoid investing in castles in the air.

Question 21

Can a company even use AI in a GDPR-compliant way?

Accepted Answer

Yes, but only with the right conditions. Company data must not flow unprotected into public tools. What you need: a legal basis (Art. 6 GDPR), information duties (Art. 13/14), a data protection impact assessment where required (Art. 35), and a data processing agreement (Art. 28) with external AI providers. We put that in place with you, including DPA and documentation.

Question 22

What is the EU AI Act, and does it affect me as a mid-market company?

Accepted Answer

The AI Act (Regulation (EU) 2024/1689) is in force and applies directly in the EU, including to SMEs. It splits AI systems into four risk classes: prohibited (e.g. social scoring), high risk (e.g. applicant scoring), limited risk (chatbots, transparency duty) and minimal risk (spam filters). Most mid-market applications fall into the lower classes. The transparency duties for chatbots and AI content have applied since August 2026, the high-risk duties for HR and scoring systems apply from 2 December 2027 (postponed by the AI Omnibus of July 2026).

Question 23

When does an AI count as high risk?

Accepted Answer

In particular for AI in hiring, performance monitoring, promotion or termination decisions, and credit scoring. These systems need risk management, human oversight, documentation and traceable results. DropD. supplies the AI Act classification per use case and does not put anything live that is not legally clean.

Question 24

Do I have to train my employees on AI?

Accepted Answer

Yes, mandatory since 2 February 2025 (Art. 4 AI Act, AI literacy). Every company must ensure that employees who operate AI have a sufficient level of AI literacy. In practice: documented training with a learning-goal check. That is not a bonus, it is a duty, and breaches can lead to fines.

Question 25

Do I need an internal AI policy?

Accepted Answer

The AI Act does not expressly require one, but in practice it is indispensable. It sets: which tools are allowed, which data may be entered (and which may not), how AI outputs are labeled, who the contact person is, and what happens in case of breaches. Without a policy you have shadow AI in the house that nobody controls. That is the biggest risk in most companies.

Question 26

What is the difference between GDPR and the AI Act?

Accepted Answer

GDPR governs the protection of personal data, including when AI is used. The AI Act regulates the AI systems themselves: safety, transparency, risk assessment. Both apply in parallel and complement each other. A clean AI policy plus a data-flow architecture often satisfies both at once. That is why we think them together, not in silos.

Question 27

Where do ChatGPT and Copilot stand under GDPR?

Accepted Answer

ChatGPT Plus ($20) is only partly suitable for company use: no central administration, insufficient data-protection guarantees. ChatGPT Team/Enterprise offers admin consoles, SSO and data-protection commitments (no training on your data). Still: anything that is personal or confidential should not flow into a US SaaS until DPA and transfer basis are clarified.

Question 28

What fines apply for AI breaches?

Accepted Answer

Prohibited AI practices: up to €35 million or 7% of worldwide annual turnover. High-risk duty breaches: up to €15 million or 3% (lower for SMEs). False information to authorities: up to €7.5 million or 1%. GDPR breaches: up to €20 million or 4%. SMEs get relief: the lower of the fixed amount or the turnover percentage applies. What actually matters in practice is above all the AI literacy duty, which already applies.

Question 29

What happens to our data? Can this be done in a GDPR-compliant way?

Accepted Answer

We build it so you can meet the requirements. When data protection or confidentiality is critical, we process on dedicated servers in Germany or directly at your site, with no US cloud. Your expertise sits in a searchable store, not in the model weights: a single document stays deletable, and access rights stay in force. DPA, data location, technical measures and access logic are in writing before we start. The data-protection assessment itself is made by your data protection officer. We supply the documents for it.

Question 30

What does data sovereignty mean, and why does it matter?

Accepted Answer

Data sovereignty means: you know where your data sits, who can access it, and that it does not flow unasked into the training of someone else's models. For customer data, personnel files or design drawings that is not optional, it is business-critical. Lose sovereignty and you risk GDPR fines, loss of secrets, and dependence on a US vendor.

Question 31

On-premise, German hosting or US cloud: when which?

Accepted Answer

US cloud (ChatGPT, Copilot) for non-critical texts and brainstorming. German/EU hosting as soon as personal or confidential data comes into play and a DPA has to apply. On-premise at your site when confidentiality, independence or regulatory requirements demand it. We recommend per use case, not putting the whole company on one track.

Question 32

What is an in-house AI, and how does it differ from ChatGPT?

Accepted Answer

An in-house AI is typically based on a strong open-source model that we tailor to your company and run on your infrastructure. The difference from ChatGPT: in an on-premise setup your content stays on your network, outbound connections are limited to the update path you approve. Your expertise sits in the knowledge store, not in the model weights, and you are not dependent on a US vendor. Similar to how specialized AI products take an open base model and turn it into something of their own.

Question 33

Can I prevent my data from being used for model training?

Accepted Answer

Yes. ChatGPT Team/Enterprise has contractual commitments that your data does not flow into training. With in-house or EU-hosted AI the boundary is in the architecture: the model runs isolated on your infrastructure, your content does not go to a vendor. For truly sensitive data we recommend the latter, because the guarantee is architectural, not only contractual.

Question 34

Do I need a data processing agreement (DPA) with the AI provider?

Accepted Answer

Yes, as soon as an external provider processes personal data for you (Art. 28 GDPR). That also applies to AI hosts and SaaS tools. With US providers, transfer comes on top: secured via standard contractual clauses or the EU-U.S. Data Privacy Framework decision. We handle DPA and documentation before anything goes live.

Question 35

What is a data protection impact assessment, and when do I need one?

Accepted Answer

The DPIA (Art. 35 GDPR) is a systematic risk analysis for projects with high risk to the rights of data subjects. For AI that processes personal data it is often required, e.g. for applicant scoring or employee monitoring. We help you assess whether one is due, and we set it up with you. Better documented cleanly than explaining after the fact to the state data protection authority.

Question 36

Does the works council have a say when AI is introduced?

Accepted Answer

Yes. Where AI can capture employee behavior or performance, that is subject to co-determination under section 87(1) no. 6 BetrVG, already when the technology is objectively capable of it, regardless of whether it is actually used for monitoring. We involve the works council early and help with the works agreement.

Question 37

AI scores applications, reads mail, logs calls. Is that allowed?

Accepted Answer

Only when it is set up cleanly. Applicant scoring counts as a high-risk application under the EU AI Act: with us always a pre-sort only, with a human making the final decision, a traceable rationale and discrimination safeguards. No automatic rejection. Call transcripts need the right announcement and legal basis. Mail triage needs the consent of employees and the works council. We supply the classification per use case.

Question 38

What about Art. 22 GDPR: may an AI decide automatically?

Accepted Answer

Fully automated decisions with legal or similarly significant effect are in principle not permitted (Art. 22 GDPR). The final decision must stay with a human. The AI may only pre-sort, draft, suggest. With the high-risk duties from December 2027, Art. 86 of the AI Act also adds a right to an explanation of an AI-supported decision. We implement it so a human always sits at the button.

Question 39

Can AI discriminate?

Accepted Answer

Yes, if the training data are skewed. AI reproduces the biases that sit in the data. In applicant scoring that is an AGG risk (German Equal Treatment Act). We check results for systematic distortion, keep inputs and outputs traceable, and build in human control. Nobody gets an automatic rejection from a machine with us.

Question 40

What must a works agreement on AI contain?

Accepted Answer

Cornerstones: purpose and scope of AI use, which data are processed, who has access, audit and information rights of the works council, deletion concept, human final decision, and a complaints path. A good works agreement protects both sides. It gives predictability and prevents shadow AI. We support the negotiation, not only the technology.

Question 41

Do employees have to be informed when AI is used?

Accepted Answer

Yes. Section 81(4) BetrVG requires information about the use of AI, Art. 13/14 GDPR require transparency about data processing, and from December 2027 Art. 26(7) of the AI Act expressly requires informing employees about high-risk systems. Openness is not optional. It is a legal duty and a question of trust at the same time.

Answers, honestly.

DropD. & working together

AI in the company

GDPR & EU AI Act

Data sovereignty, hosting & own AI

Employment law & works council