AI policy

I integrate AI systems for clients and use them in my own work too. This page states plainly which tools that actually means, how I handle data, and on what legal basis, so you know where you stand before we work together.

For my own, non-sensitive work (research, text drafts, code assistance without client data): Cloud models: ChatGPT, Claude, Microsoft Foundry Coding assistants: Claude Code, Cursor, Codex For projects where data cannot leave the building: Inference: Ollama, llama.cpp, vLLM, depending on hardware and throughput needs Open models: Llama, Mistral, Qwen, and comparable model families, depending on use case and language Embeddings: bge-m3 or comparable local embedding models Vector database: Qdrant or pgvector for retrieval-augmented generation (RAG) Orchestration: n8n for automation pipelines, self-hosted Tool bridging: Model Context Protocol (MCP) as the standard for accessing your systems (Excel, SQL Server, ERP) Agents: frameworks in the LangChain/LangGraph class, when a task needs to work through several steps autonomously, under control Deployment: Docker containers, on-prem GPU or CPU inference depending on model size and latency requirements Which combination makes sense depends on the project, not on trends.

I do not enter sensitive or confidential client data into cloud AI systems without asking first. Where AI genuinely helps on a project and data would need to leave the building for that, I discuss it with you concretely beforehand, including exactly which vendor would be involved. For sensitive data I prefer local models on my own or your infrastructure, where nothing goes outside. Where it is technically sufficient, I anonymize or pseudonymize data before it ever reaches an AI system.

For internal efficiency tools without client data (e.g. text drafts, assistance on my own code), I rely on legitimate interest under Art. 6(1)(f) GDPR. As soon as personal data from a client project is processed through an external AI vendor, that counts as sub-processing: it requires a data processing agreement (DPA) under Art. 28 GDPR with that vendor, and I will tell you on request exactly which sub-processor would be involved. For AI-related projects I do a rough upfront check of how the use case classifies under the EU AI Act. Most use cases in my work, reporting, document analysis, internal tools, fall under minimal or limited risk, not high risk.

AI-generated or AI-assisted code and text is reviewed by me before it reaches you. That applies to individual code suggestions just as much as to multi-step agent workflows: no automated step runs unsupervised against production data or client systems. I do not ship unreviewed AI output as a finished deliverable.

If you want no AI tools used on your project at all, or only local models instead of cloud ones, just tell me upfront. That is not a problem for me and I will plan accordingly.