Why not just use ChatGPT, Notion, a law firm or a GRC tool? How Themio approaches AI Act and GDPR compliance for SMEs

Most SMEs we speak to already pay for an AI assistant and a workspace tool, and some have a lawyer on call. A compliance platform earns its place only if it does a job those three cannot.

What is Themio built for?

Themio gives SMEs a compliance tool that is efficient, reliable and accessible. Efficient, because your team should not spend weeks reading regulations to work out which ones apply. Reliable, because every finding must trace back to the law and to your own documents. Accessible, because an SME carries the same AI Act and GDPR obligations as a large group, usually without a legal department or a compliance budget to match.

Four problems come up again and again for SMEs: not knowing which rules apply, documents that are scattered or out of date, audits that cost a lot and age quickly, and AI tools adopted with no clear view of what the AI Act expects. We designed Themio around those four.

ChatGPT, Notion, a law firm, a GRC tool or Themio: which does what?

These options combine well. A realistic setup for a 20-person company: Themio for the systematic work, a lawyer or DPO for the judgment calls, and your existing workspace for everything else.

Can ChatGPT handle AI Act and GDPR compliance?

Article 5(2) GDPR requires you to demonstrate compliance (explore our GDPR compliance guide ). A good chat answer helps you understand a rule, but it gives you nothing you can show an authority.

You can paste your privacy policy into an assistant and get a useful review. Three things are missing by default:

• Coverage. You get answers to the questions you ask. An obligation you have never heard of, such as the record of processing activities under Article 30 GDPR, only appears if you think to ask.
• Evidence. An assistant can explain what Article 13 GDPR requires. Themio tells you which sentence of your 2021 privacy policy falls short, and keeps that finding attached to the document.
• Continuity. Next month, after you update the policy, you want to see what changed. A conversation does not keep a dated, structured history of your file.

How does Themio work?

1. Classify your AI use. For each AI system you use or build, you answer a short questionnaire. Themio returns the risk tier and the article it rests on. Example: a marketing content tool used as a deployer, which interacts with people, lands in limited risk with transparency duties under Article 50 of the AI Act .
2. Upload your documents. Privacy policy, terms and conditions, contracts, internal registers, AI questionnaires, or any other document you need analysed. PDF, Word, Excel, CSV and text files are accepted.
3. Get a rule-by-rule result. Themio checks your file against a rule set built article by article from the GDPR and the AI Act. Each rule receives one status: compliant, partial, non-compliant, no evidence or not applicable.
4. Read findings you can verify. Each finding shows the requirement and its article, what the analysis concluded, the passage quoted from your document, its section and the file it came from. In one test file, an internal AI questionnaire declared deployer input-data controls “not applicable”. Themio flagged the statement against Article 26(4) of the AI Act, quoted the line with its section, and named the source file.
5. Close the gaps. Themio turns each gap into a task, with sub-actions, due dates and comments for your team or DPO. You can export the plan and the compliance report as PDF. On selected plans, Themio also drafts the documents your analysis found missing, such as a record of processing activities, a privacy notice, a data breach register or an AI system classification record. Themio pre-fills each draft with the information you gave at onboarding, and you adapt it as you see fit before adopting it.
6. Keep a dated record. The engagement record exports, as PDF or CSV, a timeline of checks, scores, plans, completed tasks and filed documents.

You can also ask Themis, the built-in assistant, questions about your own file. Its answers are grounded in your documents and findings, with sources listed. When a three-person company asked whether all of the GDPR applied to it, Themis listed what applies regardless of size and what it likely did not need, such as a DPO, which Article 37 requires only in specific cases.

What does “no evidence” mean in a compliance check?

Most first-pass reviews sort requirements into compliant and non-compliant. Themio adds a third answer: your documents do not show it either way. If nothing in your file describes how you would notify a data breach within 72 hours under Article 33 GDPR, Themio reports no evidence and does not guess. That is the gap an auditor or a supervisory authority will ask about first.

Who designs Themio’s rules?

Regulatory specialists build and maintain Themio’s rules, article by article, and Themio checks every file against them in the same way. When the texts change, we update the rules, so your next analysis reflects the law as it stands.

When your situation turns on interpretation, such as whether a specific AI system falls under Annex III of the AI Act, Themio hands you a structured file and the open questions, and your lawyer or DPO makes the call.

How is Themio priced?

A consulting engagement is priced on time: someone reads your documents and writes up the gaps, and the next review starts again from reading. Themio’s rules are built once and applied to every file, which keeps the cost of each additional analysis low. We listened to what the SMEs in our survey said they could spend on compliance tools and set our plans accordingly. Every plan starts with a free trial. Current plans are on our pricing page .

Why act on the AI Act now?

The AI Act is already partly in force. Regulation (EU) 2024/1689 was amended by the Digital Omnibus, Regulation (EU) 2026/1744 , in force since 27 July 2026. The dates that matter for an SME:

• Since 2 February 2025: the bans on prohibited practices (Article 5) and the AI literacy duty (Article 4). Since July 2026, Article 4 requires you to take measures that support your staff’s AI literacy, without guaranteeing a level for each person.
• Since 2 August 2026: transparency duties under Article 50. People must know when they are interacting with an AI system, and some AI-generated content must be disclosed. Generative systems placed on the market before that date have until 2 December 2026 for machine-readable marking.
• 2 December 2027: obligations for high-risk systems listed in Annex III, such as recruitment, credit scoring and education. 2 August 2028 for AI embedded in products covered by Annex I.

The delay changes the high-risk deadline only. You still decide now, under Article 6, whether your system is high-risk, and the evidence takes months to build.

The GDPR applies in parallel whenever your AI tools process personal data. Fines reach €15 million or 3% of worldwide turnover for most AI Act breaches, including Article 50, with SMEs capped at the lower of the two (Article 99(4) and (6)). Under Article 83(5) GDPR, they reach €20 million or 4%.

More SMEs use AI every year. According to Eurostat , 20.0% of EU enterprises with 10 or more employees used AI in 2025, up from 13.5% in 2024. Among small enterprises, the figure was 17%.

Why Themio works alongside your lawyer and DPO

Themio prepares and maintains your compliance file. Your lawyer or DPO interprets, advises and represents you. Themio gives no legal advice and issues no certificate, so its findings stay factual and traceable, and your adviser can check them without rebuilding the file.

Themio records a task you mark as done as your own declaration and does not verify it. It never counts a missing document as compliance. Coverage is explicit: the AI Act and the GDPR at launch, with NIS2, DORA, CSRD, AML and anti-bribery and corruption (ABC) in preparation.

What is on Themio’s roadmap?

Themio launches with the AI Act and the GDPR. Five further frameworks are in preparation:

• NIS2 (Directive (EU) 2022/2555): scope qualification and the cybersecurity risk-management measures of Article 21. Our free NIS 2 Diagnostic already checks scope and readiness.
• DORA (Regulation (EU) 2022/2554): ICT risk management and third-party oversight for financial entities and the ICT providers that serve them.
• CSRD (Directive (EU) 2022/2464): sustainability reporting, including the value-chain data requests SMEs receive from larger customers.
• AML : the EU single rulebook on anti-money laundering, Regulation (EU) 2024/1624, which applies from 10 July 2027, for obliged entities such as accountants, estate agents and dealers in high-value goods.
• Anti-bribery and corruption (ABC) : Directive (EU) 2026/1021 on combating corruption, together with national laws such as France’s Sapin II law.

Anti-corruption is the newest of these obligations. Directive (EU) 2026/1021 , published in the Official Journal on 11 May 2026, harmonises corruption offences across the EU and makes companies liable, including for failures of supervision. For the most serious offences, fines reach 5% of worldwide turnover or €40 million. Member States must transpose most provisions by 1 June 2028. The directive recognises effective compliance programmes as a mitigating factor, so building one before that date pays off. In France, Sapin II already requires an anti-corruption programme from companies with at least 500 employees and more than €100 million in turnover, and those companies assess their suppliers, SMEs included.

Which framework do you need first? Tell us : your answers shape the order in which we build.

Nicolas Pinault

Co-founder & Product Development

Software architect with over 20 years of experience designing SaaS solutions and deterministic rules engines.

Majda Skrijelj Fetiveau

Consultant & Chief Regulation Untangler

Senior Compliance Officer at an international financial institution, with more than 20 years of experience in governance, anti-corruption and European regulatory risk (GDPR, AI Act, DORA).