GDPR · NIS2 · AI Act

    AI at work and GDPR, NIS2 and the AI Act: using it by the rules

    Generative AI raises new questions: where personal data goes, who is responsible for it and how to show that the company has AI use under control. FutuGen AI Gateway does not replace a lawyer or a DPO, but it gives you technical measures and records you can rely on.

    Start freeTry the demo Arrange a pilot

    CZK 100 to try it out, no card needed, then you pay only for usage (no monthly fee). Your employees then use the chat at chat.futugen.com.

    Demo without registration: sample (synthetic) data, 2 hours, read-only with limited chat.

    GDPR: personal data should not leave without control

    When an employee pastes a client e-mail or a CRM export into a public chatbot, personal data goes to another party – often outside the EU and without a contractual framework the company knows about.

    Gateway de-identifies personal data before anything is sent to an external model, and the hosted instance runs in the EU (Frankfurt). Data-class rules decide what may go to which model; the most sensitive data can stay with a local model. We publish the list of subprocessors on the FutuGen Gateway page.

    NIS2: managing risks, including suppliers

    The new Czech Cybersecurity Act (transposing the NIS2 directive) requires covered organisations to manage risks, including risks from suppliers and services they use. Unmanaged AI tools are exactly that kind of risk.

    Gateway gives you a single entry point for AI: central access management, rules, budgets and an audit log of every request – material you can use in your security documentation.

    AI Act: literacy and usage rules

    Since February 2025, companies using AI must ensure sufficient AI literacy of their staff (Art. 4 AI Act). Besides training, it helps when the rules are built into the tool: employees use only approved models, sensitive data stays inside and management sees how AI is really used.

    What Gateway does not do

    Gateway is a technical measure, not a certificate. Compliance with GDPR, NIS2 and the AI Act also depends on your internal processes, risk assessment and documentation. We are happy to show you which records and settings you can use in your documentation.

    Start in minutes

    Start freeTry the demo Arrange a pilot

    CZK 100 to try it out, no card needed, then you pay only for usage (no monthly fee). Your employees then use the chat at chat.futugen.com.

    FAQ

    Does Gateway make us GDPR compliant automatically?

    No. Gateway reduces risk by de-identifying personal data before external models, keeping data in the EU and keeping an audit log. The legal basis for processing, informing people and internal rules remain your responsibility.

    Does NIS2 apply to us?

    It depends on your sector and size – you can check it against the criteria of the Czech National Cyber and Information Security Agency (NÚKIB). Visibility and rules for AI use are useful even for companies the act does not cover.

    What exactly is de-identification?

    Gateway replaces personal data such as names, national ID numbers, contacts, addresses or account numbers with placeholders before anything is sent to an external model, so the model works without the real data. You can add other sensitive items (e.g. client names or internal codes) with your own rules.

    Where is data processed?

    The hosted instance runs on Google Cloud in region europe-west3 (Frankfurt). External models (OpenAI, Anthropic, Google) are called through FutuGen's company accounts or through your own keys. Gateway can also run on-premise.