First, employees start using a public chatbot. Then the company buys team access, connects its own documents or adds a customer support tool. Only at one of the later stages do these questions come up: What data goes into the system? Is the company allowed to process it that way?
This isn鈥檛 just a hypothetical scenario. The Personal Data Protection Office says outright that the question of legal compliance usually comes up when an AI tool is already running and the decisions about the provider and the data being used have already been made. That means legal analysis doesn鈥檛 precede deployment. It鈥檚 trying to catch up.





