Use AI with personal data. Your data stays in the EU.
GoalCube helps you follow the GDPR and EU AI Act rules when you use personal data about customers, employees and suppliers with ChatGPT, Claude or Copilot. The AI only sees codes like [PERSON_1], a person decides on cases about people, and everything is documented when the supervisory authority asks.
- Works inside your AINo new platform. Your staff keep writing to ChatGPT, Claude or Copilot as before.
- Ready for the regulatorInventory, policy, training records and decisions in one report.
- From €0 a monthFixed price per company, based on number of users. AI Map is free.
| Customer | Location | Topic | |
|---|---|---|---|
| Sarah Murphy | sarah.murphy@example.com | Cork | Refund |
| Daniel Kelly | daniel.kelly@example.com | Galway | Delivery |
| Claire Walsh | claire.walsh@example.com | Limerick | Complaint |
| Thomas Camilleri | thomas.camilleri@example.com | Sliema | Delivery |
| Emma Byrne | emma.byrne@example.com | Dublin | Refund |
Enquiry Hi, my name is Sarah Murphy and I returned order 7012345678 two weeks ago, but I still haven't received my money. Please transfer it to IE29 AIBK 9311 5212 3456 78. Kind regards, Sarah
| Customer | Location | Topic | |
|---|---|---|---|
| [PERSON_1] | [EMAIL_1] | [STED] | Refund |
| [PERSON_2] | [EMAIL_2] | [STED] | Delivery |
| [PERSON_3] | [EMAIL_3] | [STED] | Complaint |
| [PERSON_4] | [EMAIL_4] | [STED] | Delivery |
| [PERSON_5] | [EMAIL_5] | [STED] | Refund |
Enquiry Hi, my name is [PERSON_1] and I returned order [ID_1] two weeks ago, but I still haven't received my money. Please transfer it to [IBAN_1]. Kind regards, [PERSON_1]
Sarah Murphy and Emma Byrne are waiting for a refund and should get a reply today. Thomas Camilleri has waited 10 days for a parcel. Suggested reply to Sarah Murphy: "Dear Sarah Murphy, thank you for your patience. Your money is on its way and will be in your account within 5 working days."
[PERSON_1] and [PERSON_5] are waiting for a refund and should get a reply today. [PERSON_4] has waited 10 days for a parcel. Suggested reply to [PERSON_1]: "Dear [PERSON_1], thank you for your patience. Your money is on its way and will be in your account within 5 working days."
| Candidate | Born | ID number | Employer | Experience |
|---|---|---|---|---|
| Louise Brennan | 1985-03-12 | 1234567TA | Shannon Timber Ltd | 12 |
| Michael Doyle | 1992-11-02 | 2345678KB | Liffey Logistics Ltd | 4 |
| Maria Borg | 1988-06-21 | 0123488M | Grand Harbour Metals Ltd | 9 |
| David Fenech | 1979-01-30 | 0456779M | Valletta Pharma Ltd | 18 |
CV Louise Brennan has 12 years' experience in budgeting and monthly reporting at Shannon Timber Ltd. She implemented a new ERP system and leads a team of three. Contact: louise.brennan@example.com.
| Candidate | Born | ID number | Employer | Experience |
|---|---|---|---|---|
| [PERSON_1] | 40–49 years | [ID_1] | [VIRKSOMHED_1] | 12 |
| [PERSON_2] | 30–39 years | [ID_2] | [VIRKSOMHED_2] | 4 |
| [PERSON_3] | 30–39 years | [ID_3] | [VIRKSOMHED_3] | 9 |
| [PERSON_4] | 40–49 years | [ID_4] | [VIRKSOMHED_4] | 18 |
CV [PERSON_1] has 12 years' experience in budgeting and monthly reporting at [VIRKSOMHED_1]. The person implemented a new ERP system and leads a team of three. Contact: [EMAIL_1].
Louise Brennan and Maria Borg have more than 5 years' experience and should be invited to interview; ask Maria Borg about experience with ERP systems. Michael Doyle has 4 years' experience; the requirement is 5. A person makes the decision.
[PERSON_1] and [PERSON_3] have more than 5 years' experience and should be invited to interview; ask [PERSON_3] about experience with ERP systems. [PERSON_2] has 4 years' experience; the requirement is 5. A person makes the decision.
| Supplier | Contact | Account | Expires |
|---|---|---|---|
| Atlantic Components Ltd | Peter Walsh | IE64 IRCE 9205 0112 3456 78 | 2027-01-31 |
| Malta Data Hosting Ltd | Anna Grech | MT84 MALT 0110 0001 2345 MTLC AST0 01S | 2026-12-31 |
| Midlands Precision Ltd | Simon Nolan | IE12 BOFI 9000 0112 3456 78 | 2028-06-30 |
| Celtic Packaging Ltd | Nicole Ryan | IE02 AIBK 9310 6512 9876 54 | 2027-03-31 |
Terms Atlantic Components supplies specialist components for Project Skellig. The price is adjusted annually by the consumer price index plus 3%. Liability is capped at 10% of the annual contract value. Contact Peter Walsh about any changes.
| Supplier | Contact | Account | Expires |
|---|---|---|---|
| [VIRKSOMHED_1] | [PERSON_1] | [IBAN_1] | 2027-01-31 |
| [VIRKSOMHED_2] | [PERSON_2] | [IBAN_2] | 2026-12-31 |
| [VIRKSOMHED_3] | [PERSON_3] | [IBAN_3] | 2028-06-30 |
| [VIRKSOMHED_4] | [PERSON_4] | [IBAN_4] | 2027-03-31 |
Terms [VIRKSOMHED_1] supplies specialist components for [PROJEKT_1]. The price is adjusted annually by the consumer price index plus 3%. Liability is capped at 10% of the annual contract value. Contact [PERSON_1] about any changes.
Atlantic Components Ltd renews automatically unless it is terminated by 31 October. It is important for an internal project, so renegotiate the price rather than terminate. Celtic Packaging Ltd also renews automatically; the deadline is 31 December.
[VIRKSOMHED_1] renews automatically unless it is terminated by 31 October. It is important for an internal project, so renegotiate the price rather than terminate. [VIRKSOMHED_4] also renews automatically; the deadline is 31 December.
Choose a dataset. Point at a name or a pseudonym to see what belongs together.
- Claude
- ChatGPT
- Microsoft 365 Copilot
- Mistral Vibe
Microsoft 365 Copilot and Mistral Vibe are being tested now.
Map. Protect. Prove.
Three sides of the same cube. Start free with the overview, and add protection when you want to use AI on real data.
GoalCube AI Map
Free
See how you use AI and what the law expects of you.
- AI inventory that spots the risk with fixed rules
- AI policy you can adapt and adopt in one click
- AI literacy training with proof for every employee
- Deadlines, templates and a report for supervisors and auditors
Art. 4 and 26 AI Act
GoalCube Data Vault
From €9 per month
AI on your data, without the data leaving the EU.
- Upload tables (Excel, CSV) and documents (PDF, Word)
- Names, emails, ID numbers and account numbers become pseudonyms
- Your secret terms – projects, customers, products – are always hidden
- The AI’s answer appears with the real names, only on your side
Art. 5, 25 and 44 GDPR
GoalCube Human Decision
From €15 per month with Data Vault
When AI helps with a decision about a person, a person decides. And you can prove it.
- One case at a time, with the facts and the AI’s recommendation
- Approve, choose a different decision or ask for more information
- Passkey, audit log and independent timestamps
- GoalCube for HR: Data Vault and Human Decision for recruitment and HR cases
Art. 22 GDPR and Art. 14, 26 and 86 AI Act
Tailored to the people your data is about.
Guests, members, applicants, tenants or subcontractors: pick yours and see what you can use AI for, what the law says and how the data stays in the EU.
Employees and applicants (HR)
Customers, guests, members and users
- Online shop customers
- Guests
- Software users
- Members
- Subscribers
- Patients and clients in healthcare
- Clients of advisers
- Students and learners
Suppliers and partners
- Goods suppliers
- Subcontractors
- Consultants and freelancers
- IT and software vendors
- Transport and logistics
- Resellers and agents
- Franchisees
- Commercial landlords
A person decides. And you can prove it.
The AI can prepare a case about an applicant or an employee. A person makes the decision, one case at a time – and GoalCube records who decided what, when and why.
Case facts
Louise Brennan
- Current title
- Senior controller
- Experience
- 12 years
- CV
- Louise Brennan has 12 years' experience in budgeting and monthly reporting at Shannon Timber Ltd. She implemented a new ERP system and leads a team of three. Contact: louise.brennan@example.com.
The AI’s recommendation
Invite to interview
Reasoning: 12 years' experience in budgeting and reporting, has implemented an ERP system and comes from a manufacturing company.
The AI is unsure about:
Audit log
- Decisions are saved here with the time and a timestamp.
Your staff hardly notice a thing.
Low-risk use is approved automatically under fixed rules, so staff just keep working. The person in charge spends about 5 minutes a week on a single list.
Summarise the customer enquiries from September.
Here is the summary. Most enquiries are about refunds and delivery; three cases are urgent.
4 awaiting a human · approx. 5 minutes
Waiting for you
- Decide on 3 candidates for the financial controller roleRecruitment spring 2027 · the AI has made recommendations
- Confirm new use: replies on HR casesDecisions about people need a human
Approved automatically
- Summary of customer enquiriesLow risk · approved automatically on Monday
- Overview of supplier contractsLow risk · approved automatically on Tuesday
What we don’t promise
We can’t promise you follow the law
No software can promise that. GoalCube helps you follow the EU AI Act and GDPR, and shows what you have done.
Pseudonyms are still personal data
For you, pseudonymised data is still personal data, because you hold the key. So the rest of your GDPR work needs to be in order too.
Not legal advice
Rules and templates make the work easier. If you are unsure about a specific case, ask a lawyer.
One price for the whole company.
One fixed price per company, based on number of users. AI Map is free, and Data Vault starts at €9 a month for up to 5 users.
Answers to what you need to know
Short answers on the EU AI Act and GDPR, written for managers – with live examples.
- The EU AI Act explained
What is the EU AI Act – and what does it mean for your business?
4 min readThe AI Act is the EU's law on artificial intelligence. Who it applies to, the four risk levels, the deadlines and what an ordinary business has to do.
- Policy, training and inventory
Article 4 AI Act: What does AI literacy require of small businesses?
5 min readArticle 4 of the AI Act applies to every business that uses AI at work. What you need to do, what the Digital Omnibus changed, and how to show it.
- AI in practice
AI in recruitment: What is allowed when AI reads CVs and applications?
2 min readAI for CV screening is high-risk under the AI Act, and GDPR requires a human decision. The rules, and what a fair hiring process with AI looks like.
- ChatGPT, Copilot and other AI services
ChatGPT and GDPR: Can businesses use ChatGPT on personal data?
2 min readBusinesses can use ChatGPT, but only with the right plan, a data processing agreement and control over the data. The checklist, and how names stay in the EU.
- The EU AI Act explained
When does the AI Act apply? Every deadline after the Digital Omnibus
4 min readFrom the bans in 2025 to high-risk in December 2027: every date in the AI Act, as it stands after the Digital Omnibus (Regulation 2026/1744).
- AI in practice
AI in HR: What can you use AI for in employee matters?
2 min readMeeting notes, absence, bonuses, rotas and monitoring: see what is minimal risk, high-risk and prohibited when AI is used on employees.
- GDPR and AI
Can we use ChatGPT, Claude or Copilot on personal data?
5 min readUsing AI on personal data can be lawful – with a legal basis, only the data you need and a provider agreement. How to keep the real names in the EU.
- Policy, training and inventory
AI policy for employees: What should it include?
3 min readAn AI policy tells staff which AI tools they may use, what for and with which data. The points it must cover, and a short template.
- ChatGPT, Copilot and other AI services
Microsoft 365 Copilot and GDPR: Does your data stay in the EU?
2 min readMicrosoft 365 Copilot doesn't train on your data and is covered by the EU Data Boundary – with one important exception. Here is what to check.
- AI in practice
AI in customer service: How to use AI on customer enquiries
2 min readAI can sort enquiries and draft replies in seconds. The rules for customer data, chatbots and decisions – and how your customers' names stay in the EU.
- Policy, training and inventory
What is an AI register, and do we need one?
2 min readAn AI register lists your uses of AI with purpose, data and risk. What it should contain, and why it is the foundation for the AI Act and GDPR.
- ChatGPT, Copilot and other AI services
Claude and GDPR: What should you check before using Claude on personal data?
2 min readClaude Team and Enterprise don't train on your data and include a DPA, but data is stored in the US. How to use Claude without names leaving the EU.
- The EU AI Act explained
Digital Omnibus: what did the EU change in the AI Act in 2026?
3 min readRegulation (EU) 2026/1744 delayed the high-risk rules, adjusted AI literacy and added new bans. Here are the changes and what they mean for you.
- GDPR and AI
How do we show that a human made the decision? GDPR Article 22 and AI
6 min readUsing AI on applicants or staff? A human must really decide. What GDPR Article 22 on automated decision-making and the EU AI Act require – and how to prove it.
- GDPR and AI
Can we send personal data to a US AI? International data transfers under GDPR
3 min readSending personal data to ChatGPT, Claude or Copilot in the US is a transfer out of the EU. The legal bases, the Data Privacy Framework and the safest route.
- AI in practice
AI for credit scoring and insurance: What does the AI Act require?
2 min readCredit scoring of individuals and life and health insurance pricing are high-risk. The requirements, FRIA, right to an explanation and fraud exception.
- ChatGPT, Copilot and other AI services
Which AI is best for personal data? ChatGPT, Claude, Copilot, Mistral and Gemini compared
2 min readTraining on your data, EU data residency, data processing agreements and custom connectors: the five big AI services side by side, checked by GoalCube.
- GDPR and AI
Pseudonymisation or anonymisation – what's the difference, and what does GDPR require?
2 min readPseudonymisation vs anonymisation: pseudonymised data is still personal data; anonymous data is not. The 2025 EU court ruling, and what it means for AI.
- The EU AI Act explained
The four risk levels in the EU AI Act – where does your use of AI fit?
2 min readThe EU AI Act risk categories: prohibited, high-risk, limited and minimal risk. See examples and requirements, and try classifying a use of AI yourself.
- Policy, training and inventory
Shadow AI: what do we do when employees use AI without asking?
2 min readShadow AI: many employees use free AI tools with company data without management knowing. The risks, and how to bring it into the open without a ban.
- Policy, training and inventory
What should AI training for employees cover?
2 min readThe AI Act requires AI literacy, not a certificate. The topics a short course should cover, and how to document who has completed it.
- AI in practice
AI in education: What can schools and training providers use AI for?
2 min readFeedback is low risk, while admissions, grading and exam proctoring are high-risk, and emotion recognition is prohibited. The rules for schools and courses.
- GDPR and AI
Do we need a data protection impact assessment (DPIA) before using AI?
2 min readIf you use AI to assess people, on sensitive data or at scale, the GDPR usually requires a DPIA. Here is when, what it must contain, and a template.
- The EU AI Act explained
Which AI is prohibited under Article 5 of the AI Act?
3 min readEmotion recognition at work, social scoring and manipulation are banned. Here is the full list, with examples from ordinary businesses.
- ChatGPT, Copilot and other AI services
Does the AI train on our data – and how do we switch it off?
2 min readDoes AI train on our data? Free plans may use your chats for training; business plans usually don't. What the big services do, and what to check.
- AI in practice
AI in clinics and care: How do you use AI on health data?
2 min readAI can help with admin and writing; diagnosis is a medical device. How clinics and care providers use AI without sending health data and names to the US.
- ChatGPT, Copilot and other AI services
Data processing agreement with your AI provider: what should you check?
2 min readIf an AI service processes personal data for you, you need a data processing agreement. Here is what it must cover, and the pitfalls typical of AI.
- GDPR and AI
Can we use AI on sensitive data such as health and religion?
2 min readHealth, religion, union membership, ethnicity and biometrics are special categories under the GDPR. The rules when AI is involved, and how to protect them.
- The EU AI Act explained
When is AI high-risk? Annex III explained for ordinary businesses
3 min readRecruitment, HR decisions, credit, insurance and education are high-risk under the AI Act. See the list, the exceptions and what to do from December 2027.
- AI in practice
AI for contracts and procurement: How to use AI without giving your terms away
2 min readAI is good at finding deadlines and terms in contracts. What to watch out for: contact persons, confidentiality clauses, prices and project names.
- GDPR and AI
Can we put contracts, prices and customer lists into an AI?
2 min readPrices, contracts, customer lists and project names are trade secrets – but only if you protect them. Here is how to use AI without giving them away.
- The EU AI Act explained
What must we do when we use AI? Deployer obligations under the AI Act
3 min readIf you use AI at work, you are a deployer. Here are the duties for all AI and the extra requirements in Article 26 when the use is high-risk.
- AI in practice
AI in marketing: What can you do with customer data, profiling and AI content?
2 min readPersonalised offers, segments and AI images: the rules on profiling, consent, labelling deepfakes and the ban on manipulation.
- GDPR and AI
What legal basis do we have for using AI on personal data?
2 min readAI doesn't need a new legal basis, but the use must fit the purpose the data was collected for. Here are the usual bases and the test for a new purpose.
- The EU AI Act explained
Are we a provider or a deployer under the EU AI Act?
3 min readProvider vs deployer: if you use AI, you are a deployer. Build AI into your product or put your name on it, and you may become a provider. Find your role.
- AI in practice
AI in associations and clubs: Can we use AI on members and volunteers?
2 min readAssociations are controllers, just like businesses. The rules for using AI on member lists, volunteers and membership fees – and on the data that is sensitive.
- The EU AI Act explained
How big are the fines under the AI Act and GDPR?
2 min readUp to €35 million or 7% of turnover for prohibited AI. See every fine cap in the AI Act and GDPR, and what applies to small businesses.
- GDPR and AI
Do we have to tell customers and employees that we use AI?
2 min readTelling customers and staff about AI use: what GDPR requires in your privacy notice, what the EU AI Act adds for chatbots and high-risk AI, plus sample wording.
- The EU AI Act explained
The AI Act for small and medium-sized businesses – what do you actually need to do?
3 min readA practical AI Act guide for businesses with 1–250 employees: the five things to do, what can wait, and what has been made easier for SMEs.
- GDPR and AI
How do we handle access and erasure requests when data has been in an AI?
2 min readPeople can ask for access to and erasure of their data – including what has been in an AI. Here are the deadlines, and how pseudonymisation makes it easier.
- The EU AI Act explained
Does our chatbot have to say it is an AI? Article 50 explained
3 min readFrom 2 August 2026, people must be able to see that they are talking to an AI, and deepfakes must be labelled. The rules and a notice you can use.
- GDPR and AI
An employee pasted personal data into ChatGPT. What do we do now?
2 min readPersonal data sent to an AI service with no agreement in place can be a personal data breach. Here are the first steps and the 72-hour deadline.
- The EU AI Act explained
Who enforces the EU AI Act in Ireland, Malta and the EU?
5 min readWho enforces the EU AI Act in Ireland, Malta and the EU: the AI Office of Ireland, the DPC, Malta's MDIA and IDPC, and the EU AI Office. How it works.
- The EU AI Act explained
Human oversight of AI: what does the law require, and how do you do it?
3 min readHigh-risk AI needs human oversight: a person who understands it, can step in and can say no. What that looks like in practice – and how to document it.
- The EU AI Act explained
What is a FRIA, and do we need one?
2 min readA FRIA is a fundamental rights impact assessment under Article 27 AI Act. See who must do one, what it contains and how it differs from a DPIA.
- The EU AI Act explained
ChatGPT, Claude and Gemini as general-purpose AI models – what do the rules mean for users?
2 min readThe rules for general-purpose AI models apply to OpenAI, Anthropic, Google and Mistral – not to you as a user. But you still have duties of your own.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.