# Answers, honestly. Source: https://dropdigital.de/en/faq Language: en Site: DropD., https://dropdigital.de ## Answers, honestly. AI consulting, GDPR, EU AI Act, data sovereignty and labour law: what mid-market firms really need to know before they introduce AI. Searchable, categorised, no buzzword bingo. Answers on AI consulting, GDPR, the EU AI Act, data sovereignty and labour law: what mid-market firms need to know before they introduce AI. Searchable and categorised. AI consulting, GDPR, EU AI Act, data sovereignty and labour law: what mid-market firms really need to know before they introduce AI. Searchable, categorised, no buzzword bingo. Link: https://dropdigital.de/en/faq Id: page-faq ## What does AI consulting for mid-market companies cost at DropD.? What does AI consulting for mid-market companies cost at DropD.? What does AI consulting for mid-market companies cost at DropD.? We deliberately do not name a flat fee. The investment depends on how many departments and processes we touch, and on whether we only advise or also implement. There is a lean starting point, a fixed-price operations check, and full implementation across every area. In the free first conversation we place your case honestly and give you a clear range, with no sales pitch. Link: https://dropdigital.de/en/faq Id: faq-dropd-1 ## From what company size does AI consulting pay off? From what company size does AI consulting pay off? From what company size does AI consulting pay off? From about 20 employees we work with every size. The difference is in the approach. 20 to 50 employees: One area, one workflow, where the bottleneck costs the most. Only once that holds do we add the second. 50 to 100 employees: Here it pays to go across several areas, because the levers work together: what is written down in costing helps purchasing. 100 to 250 employees: Now the rollout decides, not the technology. That means change management and training across departments, with one contact person per department. We clarify access rights and co-determination first. 250 employees and up: Several sites, often several legal entities, an in-house IT team with its own rules. We proceed site by site, work alongside your IT, and document so your people can take over. Below about 20 employees, our approach rarely pays off. We tell you that in the first conversation, instead of selling you a project. Link: https://dropdigital.de/en/faq Id: faq-dropd-5 ## What do I actually get, and does it belong to me? Does it keep running if DropD. is not there one day? What do I actually get, and does it belong to me? Does it keep running if DropD. is not there one day? What do I actually get, and does it belong to me? Does it keep running if DropD. is not there one day? You do not get a black box. You get a documented setup: workflows, agents and, where we develop ourselves, the tailored AI plus handover. Where we build on your infrastructure or a dedicated server in Germany, what runs there belongs to you, including data and configuration. No lock-in. What you get in hand (license, workflow files, your own server) we set in writing before we start. Link: https://dropdigital.de/en/faq Id: faq-dropd-7 ## Are you vendor-neutral? Are you vendor-neutral? Are you vendor-neutral? Yes. We work with no commission agenda. Whether Copilot, ChatGPT Team, an open-source model or another platform: we recommend what fits your situation, not what pays us a commission. Link: https://dropdigital.de/en/faq Id: faq-dropd-9 ## What if AI tools change? What if AI tools change? What if AI tools change? They do change. That is why there is the AI Compass: monthly update calls, current recommendations, security notes, exchange with other business owners. No spam, only signal. Your setup stays current without you having to research constantly. Link: https://dropdigital.de/en/faq Id: faq-dropd-10 ## Who are you the wrong choice for? Who are you the wrong choice for? Who are you the wrong choice for? Below about 20 employees our approach rarely pays off. If you want a group transformation with a six-figure budget and slides for the board, you are better with a Big 4. If you only want to roll out Copilot licences, a Microsoft partner is often enough. We do not run prompt courses or reseller deals. Link: https://dropdigital.de/en/faq Id: faq-dropd-11 ## What can you not do? What can you not do? What can you not do? We do not train large language models from scratch. We do not replace tax advice, legal advice or an ISO certification body. We do not deliver quiet headcount cutting. We do not put high-risk AI into production without a human making the final decision. Link: https://dropdigital.de/en/faq Id: faq-dropd-12 ## What does AI actually do for a mid-market company? What does AI actually do for a mid-market company? What does AI actually do for a mid-market company? AI pays off where a process happens often and can be described clearly: pre-sorting emails, drafting quotes, making documents searchable, checking invoices, knowledge search, answering applicant follow-up questions. The value does not appear in abstract places. It appears in processes that currently take hours from someone. That is why we always start with process analysis, not with a tool recommendation. Link: https://dropdigital.de/en/faq Id: faq-ki-grundlagen-1 ## Is AI even ready for productive use? Is AI even ready for productive use? Is AI even ready for productive use? For many use cases yes, for others no. Text, classification, summarization, first drafts and data extraction work reliably. High-precision numbers, legally binding texts and final decisions are better left with people. We separate that cleanly: AI does the draft and the pre-sort, a human reviews and decides. Link: https://dropdigital.de/en/faq Id: faq-ki-grundlagen-2 ## Does AI make jobs redundant? Does AI make jobs redundant? Does AI make jobs redundant? We automate tasks, not people. The goal is that your team sheds the routine and focuses on what they were hired for, not that jobs are cut. Anyone who still plans that has to discuss it openly with the works council. We do not deliver a quiet headcount-cutting machine. Link: https://dropdigital.de/en/faq Id: faq-ki-grundlagen-3 ## Where is the best place to start, which tool first? Where is the best place to start, which tool first? Where is the best place to start, which tool first? Not with the tool, with the process. A serious consultant first looks at where time is lost, then finds the tool for that. Anyone who recommends a specific AI solution in the first conversation without knowing your workflows is a warning sign. Typical sensible first steps: knowledge search in your own material, email triage, or quote drafting. Link: https://dropdigital.de/en/faq Id: faq-ki-grundlagen-4 ## ChatGPT, Copilot, or your own AI: what fits whom? ChatGPT, Copilot, or your own AI: what fits whom? ChatGPT, Copilot, or your own AI: what fits whom? For internal texts, brainstorming and non-critical tasks, ChatGPT Team or Copilot is often enough. As soon as customer data, personnel files, design drawings or confidentiality come into play, it gets tight. Then you need an EU-hosted or in-house solution. We classify that per use case, not as a blanket rule for the whole company. Link: https://dropdigital.de/en/faq Id: faq-ki-grundlagen-5 ## How much time does AI really save? How much time does AI really save? How much time does AI really save? Realistically: 50-80% on email classification, 40-60% on quote drafting, 70-90% on document extraction. The important question after that: what does the status quo cost me? A process that eats two employee hours a day adds up to €25,000-40,000 a year at full cost. That is the measure of whether AI pays off, not buzzwords. Link: https://dropdigital.de/en/faq Id: faq-ki-grundlagen-6 ## What is a custom AI agent, and do I need one? What is a custom AI agent, and do I need one? What is a custom AI agent, and do I need one? An agent is an AI set up for a concrete task in your company, with your data, your rules, your tone. DropD. has six standard agents (e.g. recruiter Mara for applicant follow-up questions, Christian for call transcripts, Paula for mail triage). You need that from the moment standard ChatGPT is no longer enough, because it does not know your internals. Link: https://dropdigital.de/en/faq Id: faq-ki-grundlagen-7 ## Is a proof of concept worth it first? Is a proof of concept worth it first? Is a proof of concept worth it first? Yes, on larger projects. A PoC shows on a real use case whether the AI delivers what it promises, before you go into full implementation. We do that as part of the potential analysis: measure first, then decide whether it pays off. That way you avoid investing in castles in the air. Link: https://dropdigital.de/en/faq Id: faq-ki-grundlagen-8 ## Can a company even use AI in a GDPR-compliant way? Can a company even use AI in a GDPR-compliant way? Can a company even use AI in a GDPR-compliant way? Yes, but only with the right conditions. Company data must not flow unprotected into public tools. What you need: a legal basis (Art. 6 GDPR), information duties (Art. 13/14), a data protection impact assessment where required (Art. 35), and a data processing agreement (Art. 28) with external AI providers. We put that in place with you, including DPA and documentation. Link: https://dropdigital.de/en/faq Id: faq-dsgvo-ai-act-1 ## What is the EU AI Act, and does it affect me as a mid-market company? What is the EU AI Act, and does it affect me as a mid-market company? What is the EU AI Act, and does it affect me as a mid-market company? The AI Act (Regulation (EU) 2024/1689) is in force and applies directly in the EU, including to SMEs. It splits AI systems into four risk classes: prohibited (e.g. social scoring), high risk (e.g. applicant scoring), limited risk (chatbots, transparency duty) and minimal risk (spam filters). Most mid-market applications fall into the lower classes. The transparency duties for chatbots and AI content have applied since August 2026, the high-risk duties for HR and scoring systems apply from 2 December 2027 (postponed by the AI Omnibus of July 2026). Link: https://dropdigital.de/en/faq Id: faq-dsgvo-ai-act-2 ## When does an AI count as high risk? When does an AI count as high risk? When does an AI count as high risk? In particular for AI in hiring, performance monitoring, promotion or termination decisions, and credit scoring. These systems need risk management, human oversight, documentation and traceable results. DropD. supplies the AI Act classification per use case and does not put anything live that is not legally clean. Link: https://dropdigital.de/en/faq Id: faq-dsgvo-ai-act-3 ## Do I have to train my employees on AI? Do I have to train my employees on AI? Do I have to train my employees on AI? Yes, mandatory since 2 February 2025 (Art. 4 AI Act, AI literacy). Every company must ensure that employees who operate AI have a sufficient level of AI literacy. In practice: documented training with a learning-goal check. That is not a bonus, it is a duty, and breaches can lead to fines. Link: https://dropdigital.de/en/faq Id: faq-dsgvo-ai-act-4 ## Do I need an internal AI policy? Do I need an internal AI policy? Do I need an internal AI policy? The AI Act does not expressly require one, but in practice it is indispensable. It sets: which tools are allowed, which data may be entered (and which may not), how AI outputs are labeled, who the contact person is, and what happens in case of breaches. Without a policy you have shadow AI in the house that nobody controls. That is the biggest risk in most companies. Link: https://dropdigital.de/en/faq Id: faq-dsgvo-ai-act-5 ## What is the difference between GDPR and the AI Act? What is the difference between GDPR and the AI Act? What is the difference between GDPR and the AI Act? GDPR governs the protection of personal data, including when AI is used. The AI Act regulates the AI systems themselves: safety, transparency, risk assessment. Both apply in parallel and complement each other. A clean AI policy plus a data-flow architecture often satisfies both at once. That is why we think them together, not in silos. Link: https://dropdigital.de/en/faq Id: faq-dsgvo-ai-act-6 ## Where do ChatGPT and Copilot stand under GDPR? Where do ChatGPT and Copilot stand under GDPR? Where do ChatGPT and Copilot stand under GDPR? ChatGPT Plus ($20) is only partly suitable for company use: no central administration, insufficient data-protection guarantees. ChatGPT Team/Enterprise offers admin consoles, SSO and data-protection commitments (no training on your data). Still: anything that is personal or confidential should not flow into a US SaaS until DPA and transfer basis are clarified. Link: https://dropdigital.de/en/faq Id: faq-dsgvo-ai-act-7 ## What fines apply for AI breaches? What fines apply for AI breaches? What fines apply for AI breaches? Prohibited AI practices: up to €35 million or 7% of worldwide annual turnover. High-risk duty breaches: up to €15 million or 3% (lower for SMEs). False information to authorities: up to €7.5 million or 1%. GDPR breaches: up to €20 million or 4%. SMEs get relief: the lower of the fixed amount or the turnover percentage applies. What actually matters in practice is above all the AI literacy duty, which already applies. Link: https://dropdigital.de/en/faq Id: faq-dsgvo-ai-act-8 ## What happens to our data? Can this be done in a GDPR-compliant way? What happens to our data? Can this be done in a GDPR-compliant way? What happens to our data? Can this be done in a GDPR-compliant way? We build it so you can meet the requirements. When data protection or confidentiality is critical, we process on dedicated servers in Germany or directly at your site, with no US cloud. Your expertise sits in a searchable store, not in the model weights: a single document stays deletable, and access rights stay in force. DPA, data location, technical measures and access logic are in writing before we start. The data-protection assessment itself is made by your data protection officer. We supply the documents for it. Link: https://dropdigital.de/en/faq Id: faq-datenhoheit-1 ## What does data sovereignty mean, and why does it matter? What does data sovereignty mean, and why does it matter? What does data sovereignty mean, and why does it matter? Data sovereignty means: you know where your data sits, who can access it, and that it does not flow unasked into the training of someone else's models. For customer data, personnel files or design drawings that is not optional, it is business-critical. Lose sovereignty and you risk GDPR fines, loss of secrets, and dependence on a US vendor. Link: https://dropdigital.de/en/faq Id: faq-datenhoheit-2 ## On-premise, German hosting or US cloud: when which? On-premise, German hosting or US cloud: when which? On-premise, German hosting or US cloud: when which? US cloud (ChatGPT, Copilot) for non-critical texts and brainstorming. German/EU hosting as soon as personal or confidential data comes into play and a DPA has to apply. On-premise at your site when confidentiality, independence or regulatory requirements demand it. We recommend per use case, not putting the whole company on one track. Link: https://dropdigital.de/en/faq Id: faq-datenhoheit-3 ## What is an in-house AI, and how does it differ from ChatGPT? What is an in-house AI, and how does it differ from ChatGPT? What is an in-house AI, and how does it differ from ChatGPT? An in-house AI is typically based on a strong open-source model that we tailor to your company and run on your infrastructure. The difference from ChatGPT: in an on-premise setup your content stays on your network, outbound connections are limited to the update path you approve. Your expertise sits in the knowledge store, not in the model weights, and you are not dependent on a US vendor. Similar to how specialized AI products take an open base model and turn it into something of their own. Link: https://dropdigital.de/en/faq Id: faq-datenhoheit-4 ## Can I prevent my data from being used for model training? Can I prevent my data from being used for model training? Can I prevent my data from being used for model training? Yes. ChatGPT Team/Enterprise has contractual commitments that your data does not flow into training. With in-house or EU-hosted AI the boundary is in the architecture: the model runs isolated on your infrastructure, your content does not go to a vendor. For truly sensitive data we recommend the latter, because the guarantee is architectural, not only contractual. Link: https://dropdigital.de/en/faq Id: faq-datenhoheit-5 ## Do I need a data processing agreement (DPA) with the AI provider? Do I need a data processing agreement (DPA) with the AI provider? Do I need a data processing agreement (DPA) with the AI provider? Yes, as soon as an external provider processes personal data for you (Art. 28 GDPR). That also applies to AI hosts and SaaS tools. With US providers, transfer comes on top: secured via standard contractual clauses or the EU-U.S. Data Privacy Framework decision. We handle DPA and documentation before anything goes live. Link: https://dropdigital.de/en/faq Id: faq-datenhoheit-6 ## What is a data protection impact assessment, and when do I need one? What is a data protection impact assessment, and when do I need one? What is a data protection impact assessment, and when do I need one? The DPIA (Art. 35 GDPR) is a systematic risk analysis for projects with high risk to the rights of data subjects. For AI that processes personal data it is often required, e.g. for applicant scoring or employee monitoring. We help you assess whether one is due, and we set it up with you. Better documented cleanly than explaining after the fact to the state data protection authority. Link: https://dropdigital.de/en/faq Id: faq-datenhoheit-7 ## Does the works council have a say when AI is introduced? Does the works council have a say when AI is introduced? Does the works council have a say when AI is introduced? Yes. Where AI can capture employee behavior or performance, that is subject to co-determination under section 87(1) no. 6 BetrVG, already when the technology is objectively capable of it, regardless of whether it is actually used for monitoring. We involve the works council early and help with the works agreement. Link: https://dropdigital.de/en/faq Id: faq-arbeitsrecht-1 ## AI scores applications, reads mail, logs calls. Is that allowed? AI scores applications, reads mail, logs calls. Is that allowed? AI scores applications, reads mail, logs calls. Is that allowed? Only when it is set up cleanly. Applicant scoring counts as a high-risk application under the EU AI Act: with us always a pre-sort only, with a human making the final decision, a traceable rationale and discrimination safeguards. No automatic rejection. Call transcripts need the right announcement and legal basis. Mail triage needs the consent of employees and the works council. We supply the classification per use case. Link: https://dropdigital.de/en/faq Id: faq-arbeitsrecht-2 ## What about Art. 22 GDPR: may an AI decide automatically? What about Art. 22 GDPR: may an AI decide automatically? What about Art. 22 GDPR: may an AI decide automatically? Fully automated decisions with legal or similarly significant effect are in principle not permitted (Art. 22 GDPR). The final decision must stay with a human. The AI may only pre-sort, draft, suggest. With the high-risk duties from December 2027, Art. 86 of the AI Act also adds a right to an explanation of an AI-supported decision. We implement it so a human always sits at the button. Link: https://dropdigital.de/en/faq Id: faq-arbeitsrecht-3 ## Can AI discriminate? Can AI discriminate? Can AI discriminate? Yes, if the training data are skewed. AI reproduces the biases that sit in the data. In applicant scoring that is an AGG risk (German Equal Treatment Act). We check results for systematic distortion, keep inputs and outputs traceable, and build in human control. Nobody gets an automatic rejection from a machine with us. Link: https://dropdigital.de/en/faq Id: faq-arbeitsrecht-4 ## What must a works agreement on AI contain? What must a works agreement on AI contain? What must a works agreement on AI contain? Cornerstones: purpose and scope of AI use, which data are processed, who has access, audit and information rights of the works council, deletion concept, human final decision, and a complaints path. A good works agreement protects both sides. It gives predictability and prevents shadow AI. We support the negotiation, not only the technology. Link: https://dropdigital.de/en/faq Id: faq-arbeitsrecht-5 ## Do employees have to be informed when AI is used? Do employees have to be informed when AI is used? Do employees have to be informed when AI is used? Yes. Section 81(4) BetrVG requires information about the use of AI, Art. 13/14 GDPR require transparency about data processing, and from December 2027 Art. 26(7) of the AI Act expressly requires informing employees about high-risk systems. Openness is not optional. It is a legal duty and a question of trust at the same time. Link: https://dropdigital.de/en/faq Id: faq-arbeitsrecht-6