AI features configured within your existing rights, roles, and approval processes, so nothing goes live without review
The EU AI Act isn’t coming - it's already here
The AI Act regulates AI by risk, and it applies to companies that use AI as well as those that build it. Its obligations arrive in stages.
For most marketing AI, the question isn’t whether it’s permitted. Rather, it's about demonstrating how it's governed.
Source: Regulation (EU) 2024/1689 (AI Act), as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI). General guidance only; see the note at the end of this page.
The bigger risk is AI nobody governs
When teams don’t have approved AI, they use their own. Drafts, product plans, and customer details end up in consumer chatbots, outside any contract. Governed AI starts with four questions, and clear answers to each.
Will our data train the model?
No. Your data is protected by contract, by design, and by technology from being used to train or improve AI models.
Where is it processed?
In the European Economic Area, as a matter of principle. Any exception, such as an established provider with a third-country connection, follows Art. 44 et seq. GDPR and needs your prior consent.
Who else gets access?
No one new without approval. Using AI doesn’t open uncontrolled data sharing, and any new sub-processor goes through the existing contractual approval process.
Who decides?
A person, every time. The AI drafts and suggests; it makes no decisions with legal or similarly significant effects on individuals.
AI plays a supporting role. The final decision always rests with a person.
Seven ways data leaks through AI, and how each one is closed
Leakage rarely comes from a single breach. It comes from routes nobody mapped.
Where data leaks
Shadow AI. Employees paste drafts, customer data, or plans into consumer chatbots, outside any contract or control.
Model training. Prompts and content are used to train or improve the provider’s models.
Unvetted third parties. New services gain access to your data without anyone signing off.
Third-country transfers. Data is processed in regions without an equivalent level of protection.
Mixing between customers. Your data ends up alongside other organizations’ data.
Access beyond a person’s role. The AI sees or changes more than the user is allowed to.
Personal data in AI analytics. Visitor-level data feeds AI insights.
How governed AI closes it
AI is built into the workspace your team already uses, covered by your existing contracts, rights, and roles.
Excluded by contract, by design, and by technology.
New sub-processors are engaged only through the existing contractual approval process.
Processing in the EEA as a matter of principle. Exceptions require Art. 44 et seq. GDPR safeguards and your prior consent.
Strict tenant isolation. Your data and prompts stay yours.
AI works within your existing permissions, roles, and approval workflows. It drafts; a person reviews and activates.
etracker AI works only with data that has been anonymized and aggregated first, with no reasonable means of re-identifying individual users.
What's on the table at the end
The answers, documents, and setup your stakeholders need to decide.
AI on hold
Open questions
Marketing wants AI. Legal, data protection, and the works council don’t yet have what they need to say yes.
AI approved
Clear rules
Every requirement mapped, every stakeholder answered, and AI running inside the rights and roles you already have.
A compliance mapping
Each relevant requirement of the GDPR and the EU AI Act, set against how it’s met: legal basis, transfers, oversight, data governance, transparency.
Answers for your works council
How AI is used, what it can and can’t do, and where people stay in control. The basis for co-determination talks.
A setup that fits your approvals
A clear activation decision
Activate now, or pause the AI features while your internal decision is still in progress.
AI literacy support
Guidance for the people who’ll use AI day to day, in line with the AI Act’s duty to support AI literacy.
Ten questions we answer with your legal team
Five on the EU AI Act, five on the GDPR and data protection, each tied to the provision behind it.
Area A · EU AI Act
Your role (Art. 3)
Provider or deployer? Companies using AI under their own authority are deployers, with a different set of obligations from those who build it.
Risk class per use case (Art. 6, Annex III)
Each planned use is placed in a risk tier. Content creation, translation, and analytics assistants are typically low risk; HR or credit decisions are not.
Prohibited practices (Art. 5)
Confirmation that no use touches a banned practice, such as manipulative techniques, social scoring, or emotion recognition in the workplace.
Transparency (Art. 50)
When AI interaction or AI-generated content must be disclosed, and when human editorial review and responsibility apply instead.
AI literacy (Art. 4)
What it takes to support AI literacy among the people using AI, scaled to their roles and the tools they use.
Area B · GDPR and data protection
Data minimization and privacy by design (Art. 5, 25 GDPR)
What data the AI sees, and whether it needs to. Less input, less exposure.
International transfers (Art. 44 et seq. GDPR)
Where processing happens, and what safeguards apply to any exception outside the EEA.
Processors and sub-processors (Art. 28 GDPR)
Who processes what on your behalf, under which agreement, and how new parties are approved.
Automated decisions (Art. 22 GDPR)
Confirmation that no decision with legal or similarly significant effect on a person is left to AI alone.
Guardrails and security (Art. 32 GDPR)
How the system limits misinformation and problematic content, and how AI fits your security model and approval workflows.
Four tiers, and where marketing AI sits
The AI Act regulates the use, not the technology. The same model can be minimal risk in one application and high risk in another.
Infographic of the four AI risk tiers under the EU AI Act. Tier 1, prohibited AI (since 2 February 2025): manipulative techniques that cause harm, social scoring, emotion recognition at work or in education, and untargeted scraping of facial images are banned outright. Tier 2, high-risk AI (from 2 December 2027): AI used in recruitment and HR, creditworthiness, education, access to essential services and biometric identification requires risk management, data governance, documentation, human oversight and registration. Tier 3, transparency obligations (since 2 August 2026): chatbots, AI-generated media and deepfakes must be disclosed or marked, so people know when they interact with AI. Tier 4, minimal risk: writing and editing assistants, translation support, spam filters and analytics assistance have no specific obligations beyond AI literacy.
JustRelate’s AI features are built as assistants: they draft, analyze, and suggest, and a person reviews before anything goes live. None of them is designed for high-risk use.
What governed AI looks like in daily work
Two examples from the JustRelate platform, each designed around the same principles.
Web Builder AI
Create, improve, and translate web pages inside the workspace your team already uses.
- Generate a new page from a prompt, with your drafts as input
- Analyze content for spelling, SEO and GEO, and editorial guideline compliance
- Rewrite, shorten, correct, and translate without leaving the editor
- Draws on your editorial guidelines and brand tone of voice
- Works within your rights, roles, and approval processes, so nothing is published without review
etracker AI
Turn web analytics into answers in plain language, built on consent-free measurement.
- Ask questions like “Why did conversions drop last week?” and get charts with the metrics behind them
- Describe an event to track; the AI drafts the trigger, variable, and tag
- The AI never changes live website code. An administrator reviews and activates each draft.
- Dashboard widgets are staged for review before they’re shared
- Works only with anonymized, aggregated data. Analytics data is stored in EU-based data centers.
Built for manufacturers with a distribution network to manage
Four situations this plan is built to solve.
Marketing and digital leaders
You want AI in your team’s daily work. You need a clear case for the people who have to approve it.
Legal and compliance
You need to know where obligations sit under the GDPR and the EU AI Act, and evidence of how each is met.
Data protection and IT security
You need to see data flows, processing locations, sub-processors, and how AI fits your security model.
Works councils
You want to understand how AI is used, what it can and can’t do, and where people stay in control.
Questions from legal? Bring them.
Talk them through with a JustRelate solutions advisor.
We hold our own AI to these rules
The principles on this page aren’t advice. They’re how our platform is built.
30+ years of experience
Digitalizing customer relationships for mid-sized and large organizations.
Trusted by 4,000+ companies
Global manufacturers, luxury brands, and public infrastructure run on JustRelate.
AI built in, not bolted on
Our AI runs inside the platform, within the rights, roles, and approval processes you already use. It isn’t a separate tool your IT team has to contain.
European by design
Processing in the EEA as a principle. Analytics data in EU-based data centers. Teams in France, Germany, and Poland.
Questions about tracking and consent
Clear answers to the questions teams ask before they book.
No. Customer data is protected by contract, by design, and by technology from being used to train or improve AI models. Prompts and content stay within your tenant and aren’t exposed for model retraining.
No. Customer data is protected by contract, by design, and by technology from being used to train or improve AI models. Prompts and content stay within your tenant and aren’t exposed for model retraining.
In the European Economic Area, as a matter of principle. Exceptions, for example an established provider with a third-country connection, follow the requirements of Art. 44 et seq. GDPR and need your prior consent. etracker analytics data is stored and processed in EU-based data centers.
In the European Economic Area, as a matter of principle. Exceptions, for example an established provider with a third-country connection, follow the requirements of Art. 44 et seq. GDPR and need your prior consent. etracker analytics data is stored and processed in EU-based data centers.
JustRelate’s AI features are designed as assistants for content creation, translation, and analytics. They aren’t designed for any of the high-risk uses listed in the AI Act, such as recruitment, credit scoring, or biometric identification. Classification always depends on how a system is used, so we map your planned use cases together.
JustRelate’s AI features are designed as assistants for content creation, translation, and analytics. They aren’t designed for any of the high-risk uses listed in the AI Act, such as recruitment, credit scoring, or biometric identification. Classification always depends on how a system is used, so we map your planned use cases together.
It depends on the content. Since 2 August 2026, deployers must disclose deepfakes, and AI-generated text published to inform the public on matters of public interest. That text duty doesn’t apply where a person has reviewed the text and taken editorial responsibility. Separate marking duties apply to the providers of generative AI systems. Have your legal team confirm how this applies to your content.
It depends on the content. Since 2 August 2026, deployers must disclose deepfakes, and AI-generated text published to inform the public on matters of public interest. That text duty doesn’t apply where a person has reviewed the text and taken editorial responsibility. Separate marking duties apply to the providers of generative AI systems. Have your legal team confirm how this applies to your content.
Since 2 February 2025, companies that provide or use AI must take measures to support AI literacy among the people working with it. Following the Digital Omnibus on AI in 2026, this duty doesn’t require guaranteeing any specific level of literacy for each individual.
Since 2 February 2025, companies that provide or use AI must take measures to support AI literacy among the people working with it. Following the Digital Omnibus on AI in 2026, this duty doesn’t require guaranteeing any specific level of literacy for each individual.
Yes. If your internal decision process is still underway, including co-determination with your works council, the AI features can be paused on request.
Yes. If your internal decision process is still underway, including co-determination with your works council, the AI features can be paused on request.
JustRelate currently integrates Claude via AWS Bedrock, with multi-layered guardrails that reduce the risk of misinformation and problematic content. The AI also draws on your editorial guidelines and brand tone of voice.
JustRelate currently integrates Claude via AWS Bedrock, with multi-layered guardrails that reduce the risk of misinformation and problematic content. The AI also draws on your editorial guidelines and brand tone of voice.
Start with a conversation
Talk to an expert about your consent setup, and which check-up to start with.
Bring us your setup. We'll scope the checkups with you.
- A first conversation
You talk with an expert about your website, email program, and markets. - A session with your stakeholders
We go through your requirements with legal, data protection, IT security, and works council representatives.
- Your decision
You activate the AI features, or pause them until your internal process is complete.
Disclaimer
This page provides general information only and does not constitute legal advice. Organizations remain responsible for their own assessment under the GDPR, the EU AI Act, and national law.