The small business compliance journey

Meet Nordwind Goods. They sell home and garden products online and from two small shops, with around forty staff. Like most small businesses, they use AI every day, most visibly a customer support chatbot on their website.

Their compliance lead, Amara, has created the company account and signed in. This is where the work begins: the platform that will track the whole programme.

Both regulations rest on the same idea. GDPR Article 5 paragraph 2 does not just require you to comply, it requires you to be able to demonstrate that you comply. The AI Act extends the same duty with records, logs, and documentation.

Here is the whole journey. Tell the platform about the company, register every system, classify their risk, work the checklists that generates, produce the documents the law expects, and keep the evidence up to date.

A fresh account lands on an empty dashboard with one clear starting point: complete onboarding, and the platform will shape itself around the company.

Let us start onboarding for Nordwind Goods.

First, the company name. This appears throughout the platform and on every generated document, so it should match the registered legal name.

The questions map the company to the right obligations. Does Nordwind use or develop AI systems? Yes, the chatbot.

Nordwind bought the chatbot rather than building it, so it is a deployer: it uses an AI system under its own authority. That distinction matters because the AI Act puts different duties on providers and deployers.

Sector and company size. Retail, and small, with eleven to fifty employees. These answers tune which obligations the platform will surface.

Nordwind is a private company, so it is not a public authority, and the last two questions can be honest too: there is no steering committee yet, and no documented lifecycle policy. That is the point of the exercise.

Next, the frameworks. EU GDPR is always on, and because the company uses AI, the EU AI Act is switched on for them. Keep both.

Complete onboarding. The company profile is set, both regimes are enabled, and the obligation engine is now generating the checklist for everything that applies.

Go to My Obligations to see the result.

This is the generated obligation set. Every article that applies to Nordwind, across the AI Act and GDPR, with a platform-managed path, an action for you, and an overall posture score.

Now the system inventory. Nothing is registered yet, and nothing can be assessed, documented, or evidenced until it exists here.

Register Nordwind's first AI system, the support chatbot.

The name, the owner, and the vendor. Nordwind bought the chatbot from a vendor, so the vendor is named. These details go straight into the inventory and, later, the documentation.

The purpose is what makes it an AI system: it answers customer questions and handles order tracking in natural language.

And the data it processes. The chatbot sees chat transcripts, order details, and customer contact information, which is personal data. Register it.

The chatbot is registered and now has its own workspace. Back to the inventory to add the rest of the estate.

Small businesses also run plenty of systems that are not AI. Nordwind's customer relationship management system holds customer accounts and order history, so it needs registering as a standard IT system.

The CRM processes names, addresses, and purchase history, so it sits squarely under GDPR. Register it.

Two systems now in the inventory, one AI and one not, and the compliance engine is tracking both.

Every AI system needs a risk classification, because the AI Act calibrates its obligations to it. Open the chatbot's risk and impact tab.

Start the risk assessment. The questions mirror the AI Act's own logic, walking through purpose, sector, and the Annex three high risk areas.

Its purpose is natural language processing: the chatbot.

It serves the general public, in general business. No high risk sector under Annex three applies.

The screening questions come next: no subliminal techniques, no exploitation of vulnerable groups, no social scoring, no employment decisions, and no impact on access to essential services. Nordwind's chatbot passes all of them.

There is human oversight: the chatbot hands complex cases to a person. But there are two honest answers here. The chatbot can generate content that reads as human, and customers are not always told they are talking to a machine.

Submit the assessment.

The chatbot is classified as limited risk, under Article 50. Not high risk, but the transparency obligation still applies: people interacting with it must be told it is an AI.

The classification generated a real compliance checklist for the chatbot, spanning both regimes. Open it.

Every item is an obligation. Working one here shows the pattern: read the requirement, and mark it complete with evidence. This is how the audit trail is built.

Progress updates instantly, and the same figure feeds the dashboard, the obligations page, and the report.

Documents come next. Governance and Docs holds the whole catalogue: AI governance policy, records of processing, breach reports, and more.

GDPR Article 30 requires a record of processing activities: what you process, why, and who you share it with. One click generates the draft from everything already in the platform.

The same goes for the AI governance policy, the document that sets out how the company will run its AI responsibly. Generate it, and review the draft in the preview.

Now the GDPR side of day to day work. The Trust and Privacy Hub holds requests, breaches, processors, and consent.

A customer has asked for a copy of everything Nordwind holds about them. That is a data subject request under Article 15, and it has a hard one month deadline. Log it.

The countdown starts immediately, because a data subject request is a legal deadline, not good practice.

And if the worst happens, a personal data breach has a seventy two hour clock. Nordwind's support engineer emailed an export to the wrong recipient. Log it with the detail.

The seventy two hour notification countdown is now running, and the platform will walk the team through the notification itself.

The AI Act's Article 4 requires every organisation to ensure AI literacy among its staff. The platform turns that into a short assessment. Open it.

Answer the questions. For a small team this is a quick, practical way to prove the literacy duty is being met.

Passed. The certificate is evidence, ready to attach to the compliance record.

Post market monitoring under Article 72 keeps the record live after deployment. Open the chatbot's monitoring timeline.

Add a monitoring entry: a weekly review of the chatbot's performance, with the metrics that back it up.

And when something goes wrong with a system, Article 73 requires an incident report. Nordwind's chatbot briefly misrouted a refund request. Log the incident with its impact and corrective action.

Compliance is a team job. Invite Priya, who handles support, as an editor so she can log requests and evidence without admin rights.

Now the evidence that ties it together. Upload the bias evaluation report for the chatbot to the evidence vault, linked to the system.

Every action, from registration to this upload, is in the audit trail with its actor and timestamp. That is accountability made visible.

Back on the dashboard, the picture has changed completely. Systems registered, framework scores rising, urgent alerts with their deadlines, and the whole programme now visible at a glance.

That is the journey: onboard, register, classify, work the checklists, document, and keep the evidence current. None of it is one big step, it is a steady pattern, and this platform exists to make it repeatable.