Most small and mid-sized companies already use AI, often through personal accounts on public chat services. The risk is not the AI itself but where the data goes: contracts, salaries, customer records and email end up with providers outside the company's control, usually outside the EU.
TEMERON helps SMEs adopt AI on their own terms. We decide with you which data may go where, keep the sensitive part on infrastructure you or we control, in the EU, and keep a person responsible for anything that changes data or reaches third parties. Before a pilot we explain in writing the locations, administrator access and any providers. It is how we run our own company, with NEXUS, our private AI assistant.
Three ways to run AI — and when each fits
- Public AI services: the most capable models, fine for public or non-sensitive work (drafting, research, code without client data). Not for personal data, salaries or confidential documents.
- A dedicated, hosted AI for your company: your own application and data in the EU, run for you by TEMERON at a location stated in writing.
- Private AI on hardware you or we control: for mail, HR, contracts and anything with personal data. Less powerful than the largest cloud models, but the data stays on hardware you or we control.
What we do
- Data map: which information you hold, how sensitive it is, and which kind of AI may process it.
- Private AI set-up for the work that touches sensitive data, with logging and a person in charge.
- An AI brain for your company with TEMERON NEXUS (in pilot).
- AI governance: usage rules for staff, AI-literacy measures, and alignment with GDPR and the EU AI Act — the same governance and AI ethics work we provide in EU research projects.
- Security around it: access control, monitoring and hardening, from our cybersecurity practice.
The EU AI Act in one paragraph
Since 2 February 2025, providers and deployers of AI systems must take measures to support the AI literacy of the staff who operate and use them, taking into account their training and the context of use; the Regulation does not require a guaranteed level for any individual (Regulation (EU) 2024/1689, Art. 4, applicable under Art. 113). Most other obligations depend on the risk class of the system. A short assessment of how your company uses AI is the first step.
More
Frequently asked questions
Can a small company run its own AI?
Yes, for many routine tasks such as sorting documents, finding information and drafting. A private model is less powerful than the largest cloud models, so a person reviews the work before anything is executed.
Is using ChatGPT or Copilot with company data a GDPR problem?
It depends on the contract, the settings and the data. Personal data needs a legal basis, a processing agreement and, outside the EU, a transfer mechanism. The safest default is to keep sensitive personal data out of public AI services and process it privately.
What does the EU AI Act require from an SME that uses AI?
At minimum, measures that support the AI literacy of the staff using AI systems (Art. 4, applicable since 2 February 2025). Further obligations depend on whether a system is high-risk or interacts with people in specific ways.
Do we have to replace the tools we use today?
No. Public AI tools can stay for non-sensitive work. We add a private path for the sensitive part and rules on which data goes where.
Sources
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Art. 4 and Art. 113, consolidated text of 27 July 2026