Is AI Language Training GDPR-Compliant? The 5-Point Checklist

Five Checkpoints

1. Server location & data flow: Where do audio and video streams travel, where does the AI respond? The provider must be able to name the complete data flow – EU servers are the benchmark.

2. No AI training on user data: Enterprise APIs from major AI providers do not use data for model training by default – free consumer chatbots often do. Get it confirmed in writing.

3. Retention & deletion: Are conversations stored permanently or discarded after the session? Clear deletion periods and access rights belong in the contract.

4. Data processing agreement (DPA): The provider processes employee data on your behalf – a DPA under Art. 28 GDPR including a sub-processor list is mandatory, not optional.

5. AI transparency labelling: Employees must know they are talking to an AI. From 2 August 2026, Art. 50 of the EU AI Act makes this a legal requirement.

The GDPR Checklist

Server location & data flow — why it matters: voice recordings are personal data; third-country transfers need additional safeguards (Art. 44 ff. GDPR). What to look for: EU servers for media streams; a complete map of all services involved, not just the frontend.

No training on user data — why it matters: if conversations feed model training, they permanently leave your control – deletion becomes practically impossible. What to look for: written confirmation that API data is not used for training; be wary of free consumer tools.

Retention & deletion — why it matters: the GDPR requires storage limitation (Art. 5) – employee conversations stored indefinitely are a liability risk. What to look for: defined deletion periods; recordings only with users' explicit consent.

DPA & sub-processors — why it matters: without a data processing agreement under Art. 28 GDPR, your company is liable for an unclear processing chain. What to look for: DPA with a complete sub-processor list (STT, LLM, TTS, avatar, hosting) before signing.

AI labelling (transparency) — why it matters: from 02.08.2026, Art. 50 EU AI Act requires that users can recognise AI interaction and AI content is labelled. What to look for: the avatar is openly named as AI – avoid providers that pass their AI off as human.

Co-determination & internal sign-off — why it matters: systems that could capture performance data touch co-determination rights in Germany (§87 BetrVG). What to look for: involve the works council and DPO early; clarify that learning progress is not performance appraisal.

How Does Simmonds Protect the Data?

The most important difference is architectural: the audio and video streams of our AI avatar sessions run through a self-hosted LiveKit server on our own hardware at Hetzner in Nuremberg, Germany. Media streams do not pass through a US video vendor's cloud – they stay on EU infrastructure under our direct control. Avatar rendering also runs on our own server.

For speech understanding and the avatar's responses we use enterprise interfaces from major AI providers. According to OpenAI's API policy, data sent via the API is not used to train models by default – which fundamentally distinguishes enterprise APIs from free consumer chatbots. Conversation content is not permanently stored; recordings exist only on request and under the users' control. We provide the complete sub-processor list and the DPA before you sign – details and DPA on request.

And because the question comes up regularly: your employees' learning progress serves the training itself – it is not a performance appraisal tool and is not prepared as one.

EU AI Act from 2 August 2026

From 2 August 2026, the transparency obligations of the EU AI Act apply (Art. 50, Regulation (EU) 2024/1689). Two points affect AI language training directly: first, people interacting with an AI system must be informed – an AI avatar must not pass itself off as a human teacher. Second, AI-generated content such as avatar video must be labelled as AI-generated in a machine-readable, recognisable way.

Our position: honest labelling is a mark of quality, not a weakness. Our AI avatar is called exactly that everywhere – AI avatar. Nobody should believe they are talking to a human; the avatar is the practice tool between sessions with real native-speaker trainers. We therefore see the AI Act's labelling obligations not as a burden but as a commitment we are actively implementing – and as a useful filter: providers that hide their AI usually don't answer the data protection questions above cleanly either.

What's Next?

If you are evaluating AI language training for your team, we recommend this order: first send the checklist above to all candidates, then involve your works council and DPO, then test. We answer the five points transparently and are happy to show you the AI avatar in a free demo session.

Note: This page provides general information and is not legal advice. Binding assessments for your specific case come from your data protection officer and legal team. Last updated: July 2026.