AI tooling governance for startups

A startup that uses artificial intelligence tools, to write code, answer customers or analyse documents, needs governance that is light but written down. The practical answer is this: know which tools are used and for what, decide which data may go into them, check supplier contracts when they process personal data, train the team, and understand which AI Act category your uses and your product fall into. You do not need a committee: you need one page of rules, an inventory and an owner.

In short

• Build an inventory of every AI tool used in the team, including those switched on by individuals.
• Classify data into three levels and write down which levels may go into which tools.
• If a tool processes personal data on your behalf, you need a contract with the content required by GDPR Article 28.
• The AI Act's AI literacy obligations have applied since 2 February 2025 to providers and deployers of AI systems.
• The AI Act has been applicable since 2 August 2026, with exceptions; rules for Annex III high-risk systems apply from 2 December 2027.

Why governance matters even with five people

In a startup, AI tools come in from the bottom up: someone tries a coding assistant, someone else a service that transcribes calls, a third person uploads a customer's documents to a chatbot to summarise them. Each choice may be sensible, but together they create three concrete risks:

• data leaving without control: customer information, proprietary code or personal data ends up with suppliers whose terms you do not know;
• contract commitments broken: many B2B contracts limit where and how you may process the customer's data;
• questions you cannot answer: enterprise customers increasingly ask in supplier questionnaires which AI systems you use and with what safeguards.

Minimal governance lets you keep using these tools, with more confidence.

The tool inventory

The first step is knowing what is in use. Prepare a table with, for each tool:

• name and supplier;
• who uses it and for what;
• plan or licence (free personal, paid, business);
• which data goes into it;
• whether the supplier uses data to train its own models, under the terms of your plan;
• where the data is processed, according to the supplier's documentation;
• the internal owner.

Ask everyone to report tools they are only trialling too. The goal is not to ban, but to see.

Data rules in three levels

A simple rule works better than a long policy. Split data into three levels:

1. public or non-sensitive: content already published, generic documentation, open-source code. May go into approved tools.
2. internal: proprietary code, strategy documents, non-personal product data. Only in tools on a business plan with verified terms.
3. confidential or personal: customer data, personal data, information covered by confidentiality agreements. Only in tools explicitly approved for that use, with an appropriate contract, and only if the customer contract allows it.

Write the rule on one page and put it where the team sees it. Review it when a supplier changes or an important customer asks for specific guarantees.

Suppliers and the GDPR

When an AI tool processes personal data on your behalf, the supplier is generally a processor. GDPR Article 28 requires you to use only processors providing sufficient guarantees and to govern the relationship with a contract setting out, among other things, the subject matter, duration, nature and purpose of the processing, the types of data and the categories of data subjects. The contract must require the processor to act only on documented instructions, ensure staff confidentiality, implement appropriate security, follow the rules on sub-processors, and delete or return the data when the service ends.

In practice: check that the supplier offers a data processing agreement, read its list of sub-processors and keep a copy of what you accepted. If you process customer data through an AI tool, that tool becomes your sub-processor and you may need to tell the customer.

The AI Act: what to know today

According to the European Commission's page on the regulatory framework for AI:

• the AI Act entered into force on 1 August 2024 and has been applicable since 2 August 2026, with some exceptions;
• prohibitions and AI literacy obligations have applied since 2 February 2025;
• obligations for general-purpose AI models have applied since 2 August 2025;
• transparency rules have applied since August 2026: for example, people must be told when they are interacting with a machine, and generated content such as deepfakes must be identifiable;
• rules for Annex III high-risk systems, such as biometrics, education and employment, apply from 2 December 2027; those for AI embedded in regulated products from 2 August 2028.

There are four risk categories: unacceptable, high, transparency risk, and minimal or no risk. For minimal-risk AI, the AI Act introduces no rules.

Article 4 asks providers and deployers of AI systems to take measures to support the AI literacy of their staff and other people operating the systems on their behalf, without requiring them to guarantee a specific level for each individual. For a startup, a short, documented internal training on how to use the tools, their limits and the data rules is a good starting point.

If your product uses AI in one of the Annex III areas, recruitment for example, the 2027 deadline belongs in your product roadmap now and should be checked with a professional.

What to do in the next four weeks

1. Compile the inventory of AI tools used in the team.
2. Write the three-level data rule and share it.
3. Check data processing agreements and sub-processors for tools that handle personal data.
4. Run an internal AI literacy session and keep a record of it.
5. Classify internal uses and your product's AI features against the four risk categories.
6. Prepare a standard answer on AI use for customer questionnaires.
7. If you want help working out where to start in your case, get in touch.

You will find a tool-inventory template in Resources.

Sources

• European Commission, regulatory framework on AI
• AI Act, Article 4, AI literacy
• GDPR, Article 28

This article is general guidance and does not replace a legal or compliance assessment of your specific case.

Subscribe to Dispatch, the PATAVIUM newsletter, for updates on regulation, deadlines and tools for your startup.