01
Which tools can we use?
A company subscription, a personal account or AI built into an app? Establish a shared view of approved tools.
AI Governance · zemITis
Safe AI use
at work
Your team is already using AI. Give them clear rules to work with.
We assess the tools, set the rules and prepare your people. From the first question to everyday practice.
AI, data protection and information security, together. AI in everyday work One uploaded document.
One uploaded document.
Several business questions.
A summary, a customer email or an automated workflow involves tools, data and responsibilities. We help you make sense of them.
02
What data can we enter?
Customer data, internal documents, business information. We review data processing for the specific tool and use case.
03
Who checks the output?
Make it clear who approves new uses, who checks the output and where staff can turn for help.
ChatGPT, Copilot, Gemini, Claude, browser extensions and AI agents: we start with how your people actually work.
What the service covers Clear rules.
Clear rules.
Practical results.
Five connected areas, tailored to your tools, data and workflows.
After the assessment, we agree the work, documents and training you need, then provide a tailored proposal.
01
AI assessment and tool list
Based on the information available, we assess the AI tools, company subscriptions and integrations in use.
- Generative AI tools, plug-ins, AI features and agents
- Review of intended uses, data and access
- Approved tools and conditions of use
What you receive
An AI inventory and an approved tool list tailored to your organisation.
02
AI usage policy
We create clear internal rules for introducing new tools and using them day to day.
- Permitted, restricted and prohibited uses
- Data uploads and responsibilities
- AI agent creation and prior approval
What you receive
A practical policy with clearly assigned responsibilities.
03
Data protection documentation
We tailor personal data handling and its documentation to the specific AI use case.
- Purposes, legal bases, controller and processor roles
- Privacy notices, data retention and transfers
- A legitimate interests assessment where needed
What you receive
New or updated documents needed for the specific data processing.
04
Impact assessment where needed
We assess whether a data protection impact assessment (DPIA) is needed. If it is, we identify risks and measures to reduce them.
- Review of the specific use case
- Privacy risks and protective measures
What you receive
A documented assessment of the need for a DPIA, followed by a DPIA where warranted.
05
Staff training
We translate the rules into guidance for people’s roles and the tools they actually use.
- AI basics, prompts, hallucinations and checking outputs
- Safe data handling and company usage rules
- Presentations, e-learning or knowledge checks
What you receive
Role-specific learning materials and staff prepared to use AI.
Personal expertise Three specialists.
Three specialists.
Complementary expertise.
Dr Szabolcs Gyurkovics delivers the AI service, backed by zemITis expertise in data protection and information security.
AI compliance and data protection
Dr Szabolcs Gyurkovics
Lawyer and cybersecurity law specialist. More than eight years of data protection experience, supporting AI and digitalisation projects.
Data protection and legal compliance
Dr Fanni Mikoss
Lawyer and cybersecurity legal specialist with five years at Hungary’s data protection authority. Data processing, privacy notices, impact assessments and staff training.
Information security and controls
Dávid Meisitz
CISA, CISM and ISO/IEC 27001 Lead Auditor. More than ten years of experience in IT compliance, audit and risk management.
Your expert
Who supports your safe use of AI?
Dr Szabolcs Gyurkovics LL.M.
Lawyer and cybersecurity law specialist; data protection and AI compliance expert
LinkedIn profileSzabolcs has more than eight years of experience in data protection, in both corporate and regulatory settings. He earned his law degree at the University of Pécs, followed by a postgraduate qualification in cybersecurity law at Széchenyi István University. He has worked as a data protection expert at Takarékbank, Hungary’s National Authority for Data Protection and Freedom of Information (NAIH), and Szerencsejáték Zrt.
In recent years, he has focused on data protection support for IT, digitalisation and AI development projects. His work has included handling personal data breaches, preparing privacy notices and cookie policies, and carrying out legitimate interest assessments.
He has also developed an AI solution for data protection professionals. He regularly contributes to Jogi Fórum, writing about data protection compliance in modern technologies.
- Areas of expertise
- AI and data protectionDigitalisation projectsPersonal data breaches
- Documentation
- Privacy noticesCookie policiesLegitimate interest assessments
- Professional expertise
- Corporate data protectionData protection authority experienceProfessional publications
How we work together
From assessment to everyday practice.
We help establish regulatory and data protection frameworks for existing and planned AI use.
- 01
A shared picture
We discuss your goals, tools and existing rules, then agree the scope of the assessment.
- 02
Rules tailored to you
Based on the findings, we prepare your tool list, usage policy and the data protection documents you need.
- 03
Handover and training
We walk you through the materials, prepare your staff and agree the next steps for the people responsible.
FAQ
Questions worth asking
Yes. We assess existing tools, subscriptions and usage habits. We use the findings to develop the rules and training you need.
The service focuses on regulatory, information security and data protection frameworks for AI use.
Not automatically. We assess the need for a DPIA based on the nature, context and risks of the specific processing. Under the GDPR, it is required when processing is likely to result in a high risk to individuals’ rights and freedoms.
We agree on the applicable requirements and the content of AI literacy training. The precise compliance work is agreed based on the assessment.
No. The service is available on its own, working with your existing DPO or security team. If you are also building a management system, we align the work with your ISO/IEC 42001 project.
Cost and timing depend on your tools, data processing, existing documentation and the staff who need training. We agree the tasks and deliverables, then provide a tailored proposal.
Get started
AI is already part of your work.
Make safety part of it, too.
Let’s start with the tools your team uses and where clearer rules would help.