7 Questions to Ask Before Building an AI Workflow That Touches Customer Data
Most AI projects begin with a capability: “We can automate replies,” or “We can score leads.” The questions about customer data tend to arrive later, often when a lawyer, a client or a regulator asks them.
It is cheaper to ask them first. This guide sets out seven questions to answer before building any AI workflow that handles customer data. It refers to three regimes that affect many businesses: the EU’s GDPR, the EU AI Act and India’s DPDP Act.
At Codiotic, we build AI-powered software and automation for businesses. These seven questions are the first thing we run through on any new AI workflow.
Important: This article is educational and is not legal advice. The rules differ by situation and keep changing. Confirm your obligations with a qualified lawyer.
AI Workflow Compliance: What Applies, and From When
Dates matter here, and several have recently moved. As of November 2026:
- GDPR has applied since 2018 to the personal data of people in the EU, including when a business outside the EU serves them.
- EU AI Act: Transparency duties under Article 50, such as telling people they are talking to an AI, have applied since 2 August 2026. The AI Omnibus moved the main obligations for high-risk systems listed in Annex III to 2 December 2027, and for AI embedded in regulated products to 2 August 2028. It did not delay the core transparency rules. One narrow exception: generative systems already on the market before 2 August 2026 have until 2 December 2026 to add machine-readable marking under Article 50(2).
- India’s DPDP Act: The Rules were notified on 13 November 2025. The main duties on businesses, including notice, consent, security safeguards and breach reporting, apply from 13 May 2027. Until then, older rules continue to apply.
The Seven Questions to Ask Before Building an AI Workflow
1. What data does this workflow use, and do we need all of it?
List every field the AI will read, from names and emails to message history and payment details. Then remove what the task does not need.
Why it matters: GDPR requires data to be limited to what is necessary for a stated purpose. DPDP also ties processing to a specified purpose. Less data means less risk, in addition to being easier to explain.
2. What is our lawful basis, and have people been told?
Every use of personal data needs a legitimate ground. Depending on the case, that may be consent, a contract, a legal duty or a legitimate interest. People also need a clear explanation of what happens to their data.
Why it matters: A new AI use is a new purpose. Using support emails to train or tune a model may not be covered by the notice you gave when the customer wrote in. Under DPDP, consent and notice become central duties from May 2027.
3. Where does the data go, and who else sees it?
Trace the journey of data through your AI workflow: which model provider, which cloud, which country and which subcontractors. Check whether the provider may keep your data or use it to train its own models.
Why it matters: Under GDPR, vendors that process data for you need a written agreement, and transfers outside the EU need a valid mechanism. India’s rules also address cross-border transfers. “We sent it to an API” is not an answer a regulator will accept.
4. Does the AI make or influence decisions about people?
There is a large difference between an AI that drafts a reply and one that decides who gets credit, a job interview or a discount.
Why it matters: GDPR gives people protections against solely automated decisions with significant effects. The EU AI Act classes certain uses as high-risk, including hiring, credit scoring, education and access to essential services, with stricter duties from December 2027. If the AI workflow touches these areas, plan for human review and documentation.
5. Will people know they are dealing with an AI?
If customers interact with a chatbot, or see AI-generated content, they should be told clearly.
Why it matters: Since 2 August 2026, the EU AI Act’s Article 50 requires providers and deployers to make AI interaction and certain AI-generated content transparent. Apart from the law, disclosure builds trust. Customers who feel misled rarely return.
6. How is the data protected, and what happens if something goes wrong?
Ask about access controls, encryption, logging and how long data is kept. Then write down the breach plan: who decides, who is told and how quickly.
Why it matters: GDPR generally requires reporting certain breaches to the authority within 72 hours. Under DPDP, failing to maintain reasonable security safeguards can lead to penalties of up to ₹250 crore, and breach reporting duties apply. GDPR fines can reach 20 million euros or 4% of global annual turnover, whichever is higher.
7. Who is accountable, and can we show our working?
Name one business owner for the AI workflow. Keep records of what data it uses, what decisions were made and why. For higher-risk uses, run a data protection impact assessment before launch. Make sure people can ask for their data to be corrected, deleted or explained.
Why it matters: Regulators ask for evidence, not intentions. A short, current record is worth more than a long policy nobody follows. Accountability is also one of the five gaps behind why AI projects stall.
A Practical Way to Use the Seven Questions
Turn the seven questions into a one-page check at the start of every AI project:
- Answer each question in two or three lines.
- Mark any question you cannot answer as “open” and assign it to someone.
- Do not go live while a question about data, vendors or decisions about people is open.
- Review the page when the AI workflow changes, and again when the rules do.
If you are choosing your first workflow, our AI workflow automation team can help you pick one that is low in risk and easy to measure.
Key Takeaway: Compliance Is a Design Step for Every AI Workflow
Compliance is not a stage at the end of an AI project. It is a set of design questions at the start: what data, on what basis, sent where, affecting whom, disclosed how, protected how and owned by whom.
Teams that answer these early build workflows that customers, clients and regulators can trust. This is also what separates AI that stays in a pilot from AI that reaches production, as we explain in our guide to the AI adoption gap.
How Codiotic Helps You Build a Compliant AI Workflow
At Codiotic, we design each AI workflow around the data it touches, the people it affects and the evidence you will need to show. Our custom software teams build in access controls, logging and human review from the first sprint, not as a late fix.
Planning an AI workflow that handles customer data? Talk to Codiotic and we will walk through the seven questions with you. You can also explore more at codiotic.com.
Which of the seven questions does your team find hardest to answer today?
FAQ
Does GDPR apply to an AI workflow that uses customer data?
Yes, if the AI workflow processes personal data of people in the EU, including when a business outside the EU serves them. You need a lawful basis, a clear purpose, only the data the task needs, and written agreements with vendors that process data for you.
Do I have to tell customers they are talking to an AI?
In the EU, yes in many cases. Since 2 August 2026, Article 50 of the EU AI Act requires providers and deployers to make AI interaction and certain AI-generated content transparent. Clear disclosure also builds customer trust.
When do India’s DPDP Act duties apply to businesses?
The DPDP Rules were notified on 13 November 2025. The main duties on businesses, including notice, consent, security safeguards and breach reporting, apply from about 13 May 2027. Older rules continue to apply until then.
Is an AI workflow that drafts customer replies high-risk under the EU AI Act?
Drafting replies is generally not on the high-risk list. Uses such as hiring, credit scoring, education and access to essential services are. Transparency duties can still apply to a reply-drafting AI workflow, so check your case with a lawyer.
What should I do before going live with an AI workflow?
Complete a one-page check of the seven questions. Answer each in two or three lines, mark unknowns as open, and do not launch while a question about data, vendors or decisions about people is still open. Review the page when the workflow or the rules change.