GDPR-Compliant AI Coaching: What to Check When Choosing a Platform
The 5 criteria an AI coaching platform must meet to be GDPR-compliant. A checklist for data protection, IT security, and HR teams in the EU.
Philipp Heideker
Co-Founder & CEO
Last updated: May 29, 2026
TL;DR: AI coaching can be run in a fully GDPR-compliant way, but only when the platform meets five core criteria: EU data residency, a robust Data Processing Agreement (DPA) under Art. 28 GDPR, a contractual exclusion of customer data from model training, documented deletion concepts, and a privacy-by-design architecture that answers works-council and employee-trust questions technically rather than just contractually. These five criteria decide whether a platform can actually be procured by an EU enterprise, regardless of how impressive the functionality looks in a demo. This guide explains exactly what data protection officers, IT security, and HR should check, and why most "GDPR-compliant" claims on vendor websites do not survive due diligence.
AI coaching is GDPR-compliant when the platform you deploy is built around EU data residency, a DPA under Art. 28 GDPR, a contractual exclusion of customer data from model training, documented deletion concepts, and an architecture that answers employee-protection questions technically. This guide explains what data protection officers, IT security, and HR should concretely verify during platform selection, and why generic "GDPR-compliant" labels rarely hold up once procurement starts asking real questions.
It is written for organizations of 200+ employees across the EU and beyond that want to introduce AI-supported people development and need to make a defensible platform decision. Sleak is an AI that develops your people: an AI Coach that builds business-critical skills across an organization. It is not a sales training tool, an LMS, a CRM, a copilot, or a call-recording tool. That distinction matters for compliance, because what a platform does with data depends entirely on what it is designed to do.
Is AI coaching GDPR-compliant?
Yes, AI coaching can be run in a fully GDPR-compliant way, but only when the platform is designed around EU data residency, a contractual exclusion of training-data use, and documented data-subject rights. Generic "AI-compliant" tools are not enough. What matters is which data the platform processes, where it is processed, and what is contractually excluded.
The GDPR sets a clear frame: as soon as personal data (any data that can be attributed to an individual) is processed by an AI system, the regulation applies in full. In AI coaching, that includes conversation transcripts, Scorecard results, development histories, and in some cases voice recordings from Training Mode simulations. Each of these data types is personal data.
GDPR compliance therefore does not hinge on the AI technology itself. It hinges on three contractual and architectural decisions: Where is the data stored and processed? Who has access to it? And is it reused for foreign purposes such as training foundation models?
For Sleak specifically: data residency is primarily in the EU (Microsoft Azure in Frankfurt, with AWS and Supabase in the EU), no customer data is used to train AI models, and the product applies neither emotion recognition nor biometric profiling. Those are architectural commitments, not marketing claims, and they are exactly the kind of statements a due-diligence team will test.
What criteria must AI coaching platforms meet to be GDPR-compliant?
Five criteria decide, in the due diligence of EU enterprises, whether an AI coaching platform is fit for purpose. Data protection officers and IT security teams check them in almost every vendor evaluation we have supported over the past twelve months.
| Criterion | What is checked | Typical knock-out reason |
|---|---|---|
| Data residency | Where is data processed and stored? | US hosting, third-country transfer without an adequacy decision |
| Data processing (DPA) | Is there a robust DPA under Art. 28 GDPR? | Missing or incomplete DPA, no sub-processor list |
| Training-data exclusion | Is customer data used to train models? | Standard terms permit reuse |
| Deletion concept | How and when is data deleted (Art. 17 GDPR)? | No documented procedure, unclear retention periods |
| Data-subject rights | Access, rectification, portability (Art. 15, 16, 20) | No self-service, long manual handling times |
Each of these is an individual knock-out criterion. A platform with perfect functionality but US data residency without robust safeguards is simply not procurable in most EU enterprises, regardless of how convincing the demo was. The lesson for buyers is to filter on these five criteria before falling in love with features.
Why is data protection more than a compliance checkbox in AI coaching?
Data protection in AI coaching is not a mere compliance obligation, it is a product-strategy foundation, because people only practice honestly when they feel safe to fail. This is why Sleak treats privacy by default as a product decision, not a legal afterthought.
The mechanics are simple. An AI coaching platform where a salesperson or a manager has to worry that practice sessions will be used for performance evaluation will not be used. Or worse: it will be used, but people will only expose as much as they consider safe. The result is shallow practice, which is the exact opposite of what development requires.
EU organizations understand this intuitively. That is why the employee-representation questions around AI coaching are so specific: Is use voluntary? Who sees individual Scorecard data? Can practice sessions be attributed to an individual for performance evaluation? What happens to the data when someone leaves the company?
A platform that answers these questions architecturally rather than contractually (through defaults, access rights, and data models, not just terms-and-conditions clauses) is both GDPR-compliant and effective as a product. This connection between data protection and product effectiveness is the reason the common reflex "GDPR is annoying" is misleading in AI coaching. Here, GDPR is the enabler.
How does a GDPR-compliant DPA for AI coaching work?
A GDPR-compliant Data Processing Agreement for AI coaching governs six things at its core: the purpose of processing, data categories, data residency, the sub-processor list, training-data exclusion, and deletion procedures. A vendor's standard agreement is rarely enough; EU data protection teams regularly require a version tailored to the actual processing operation.
The six points in detail:
- Purpose of processing. A precise description of what the data is processed for (coaching conversations, Scorecard evaluation, development reports). No general clauses such as "to improve our services."
- Data categories. Exactly which data is processed: audio, transcript, evaluations, metadata. Special categories (health data, trade-union membership) must be explicitly excluded or handled separately.
- Data residency. Processing in the EU/EEA. Where US-based LLM providers are used, Standard Contractual Clauses (SCCs) plus additional safeguards (for example pseudonymization before transfer) must be documented.
- Sub-processor list. A complete list of all sub-processors (LLM providers, hosting providers, transcription services) with jurisdiction and purpose of processing. Changes only with advance notice and a right to object.
- Training-data exclusion. A clear contractual commitment that customer data is not used to train foundation models or general-purpose models. For custom fine-tuning: a separate opt-in agreement.
- Deletion procedures. Documented retention periods for standard deletion, deletion on request, and the technical implementation (including backups, logs, and vector databases).
If any one of these six points is missing, the DPA is incomplete from the perspective of an EU data protection officer. In practice this rarely leads to immediate rejection, but it does lead to weeks or months of renegotiation, time that materially lengthens procurement cycles. Sleak provides a DPA under Art. 28 GDPR designed to cover these six points out of the box, which is one of the fastest ways to compress that timeline.
What does employee representation check in AI coaching platforms?
Employee representatives (such as a German works council or comparable bodies elsewhere in the EU) evaluate AI coaching platforms under one central question: Can the tool be used for individual performance monitoring or evaluation, and if so, under what conditions? Many EU jurisdictions grant co-determination or consultation rights for technical systems capable of monitoring employee behavior or performance, and AI coaching regularly falls under those rights.
In practice, the focus is on four points:
- Voluntariness. Is use voluntary? Does an employee face professional disadvantages for not participating?
- Access rights to individual data. Who sees the Scorecard values of individual people? Managers? HR? Only the employee themselves?
- Pseudonymization and anonymization. Is practice data decoupled from the person? Can individual sessions be traced back?
- Legal consequences of use. Can data from AI coaching be used for warnings, terminations, or performance reviews?
Platforms that answer these questions architecturally in advance (for example through a private mode in which people control their own practice data and decide what to share with managers) typically pass employee-representation approval without major resistance. Platforms where managers have access to individual practice data by default are almost always pushed back or approved only with significant restrictions.
The experience from numerous procurement processes: employee representation is not a blocker, it is the most thorough product review a vendor can get. Vendors that take the conversation seriously and answer with architecture rather than legal assurances shorten the approval process considerably.
What about the EU AI Act and certifications?
Sleak's core product is not high-risk under Annex III, Category 4 of the EU AI Act, and the platform runs on ISO 27001 certified Azure infrastructure, while Sleak's own external ISO 27001 certification is in preparation for Q3 2026. Being precise about this distinction matters, because overstated certification claims are themselves a due-diligence red flag.
A few clarifications buyers should insist on from any vendor:
- EU AI Act classification. AI systems used in employment contexts can fall under Annex III. The classification depends on the specific use. For Sleak, the core AI Coach product (skill development through Coaching Mode and Training Mode) is assessed as not high-risk under Annex III, Category 4. A vendor should be able to explain its reasoning, not just assert a category.
- Infrastructure vs. company certification. The underlying Azure infrastructure Sleak uses is ISO 27001 certified. Sleak's own external ISO 27001 certification is in preparation, targeted for Q3 2026, and is not yet obtained. Any vendor conflating "our cloud is certified" with "we are certified" should be questioned.
- No emotion recognition, no biometric profiling. Sleak does not use emotion recognition or biometric profiling. These are exactly the features that can push a system into higher-risk territory, so their absence is worth confirming contractually.
The takeaway: ask vendors to separate infrastructure certifications, company certifications in progress, and AI Act classification. A vendor that answers these precisely is easier to trust than one that markets a single sweeping "compliant" badge.
A GDPR checklist for selecting an AI coaching platform
Before selecting an AI coaching platform, data protection officers and IT security should concretely ask these twelve questions:
- Is the platform hosted exclusively in the EU/EEA? Which data centers specifically?
- Is there a DPA under Art. 28 GDPR that covers the six points above?
- Which sub-processors are used, and in which jurisdictions?
- Is customer data used to train foundation models or generic models? Where is that stated contractually?
- What deletion periods apply to standard data, backups, logs, and vector databases?
- How are data-subject rights (access, rectification, deletion, portability) operationally implemented?
- Is a Data Protection Impact Assessment (DPIA) provided or prepared by the vendor?
- Which roles have which access rights to individual user data?
- Is there a private mode or a pseudonymization architecture for practice sessions?
- Which certifications exist (ISO 27001, SOC 2), and do they cover the company or only the infrastructure?
- Which SSO protocols and HRIS integrations are supported?
- Are employee-representation-ready documents available (architecture summary, record of processing, employee information)?
A platform that answers these twelve points cleanly in the initial review will typically clear data protection and employee-representation approval within 8 to 12 weeks. Platforms that are unclear on more than three points should not even enter the shortlist: the effort to clarify exceeds the benefit.
How Sleak approaches GDPR-compliant AI coaching
Sleak is built so that compliance and product effectiveness reinforce each other rather than compete. The same architecture that makes practice psychologically safe is the architecture that satisfies EU data protection.
Concretely, that means:
- Coaching Mode (KNOW) and Training Mode (DO). People build knowledge in Coaching Mode and practice it through voice simulations with virtual counterparts called Personas in Training Mode. Practice data belongs to the learner by default.
- Scorecards and the Standard of Excellence. Performance against a Scorecard (the Standard of Excellence for a given skill) is structured for development, not surveillance, with access controlled by role.
- Initiatives. Skill-building is organized into Initiatives so that organizations can deploy AI coaching at scale while keeping individual practice data private by default.
- Compliance posture. GDPR-compliant by design, a DPA under Art. 28 GDPR, EU-primary data residency (Azure Frankfurt plus AWS and Supabase in the EU), no customer data used for AI training, no emotion recognition, no biometric profiling, and a clear EU AI Act assessment.
The result is a platform an EU enterprise can actually procure, and one its people will actually use.
FAQ
Is AI coaching GDPR-compliant?
Yes, when the platform offers EU data residency, a robust DPA under Art. 28 GDPR, a contractual exclusion of training-data use, documented deletion concepts, and an architecture suitable for employee representation. The blanket question "Is AI coaching GDPR-compliant?" cannot be answered globally; what matters is the specific platform implementation.
Which AI tools for people development are GDPR-compliant?
GDPR compliance is not a label a vendor can grant itself. It results from reviewing the contract and the architecture. All five core criteria (data residency, DPA, training-data exclusion, deletion concept, data-subject rights) must be met. Additional certifications such as ISO 27001 ease due diligence but do not replace it, and buyers should check whether a certification covers the company or only the underlying infrastructure.
Does employee representation need to approve an AI coaching platform?
In many EU jurisdictions, employee representatives have co-determination or consultation rights for technical systems capable of monitoring behavior or performance, and AI coaching regularly falls under those rights. A usage agreement covering voluntariness, data access, and limits of use is therefore common. Platforms with a private mode and pseudonymization make this process considerably easier.
Is data from AI coaching used to train the AI models?
With serious vendors: no. The contractual exclusion of training-data use is at the core of any robust DPA for AI coaching. Sleak does not use customer data to train AI models. Where underlying LLM providers are used, the platform vendor must demonstrate that this exclusion is contractually enforced toward those sub-processors as well.
What does a GDPR-compliant AI coaching platform cost compared to a non-compliant one?
The pure license price rarely differs significantly. GDPR compliance is a hygiene factor today, not a premium feature. The real cost difference lies in downstream costs: compliant platforms clear review and employee-representation approval in 8 to 12 weeks; non-compliant platforms often need six or more months of renegotiation or are rejected outright. The hidden price of missing GDPR compliance is the lost implementation cycle.
Is Sleak ISO 27001 certified?
The Azure infrastructure Sleak runs on is ISO 27001 certified. Sleak's own external ISO 27001 certification is in preparation and targeted for Q3 2026, and is not yet obtained. We recommend asking every vendor to distinguish infrastructure certification from company certification.
Does Sleak use emotion recognition or biometric profiling?
No. Sleak uses neither emotion recognition nor biometric profiling. These are among the features that can push an AI system into higher-risk classifications under the EU AI Act, so their absence is worth confirming contractually with any vendor.
Related reading
- What is AI sales coaching? Definition, benefits, and how it works
- Security questionnaires for AI vendors: what to ask before you buy
- Scaling sales training: why classic approaches fail and how AI solves the problem
Want to see how a privacy-by-design AI Coach handles EU data protection in practice? Try Sleak and walk your data protection and IT-security teams through the architecture directly.