As a team we handle personal data across a few different streams: customer data, team member data, and performance data. Each carries legal responsibility under GDPR and, increasingly, under newer rules built specifically for AI.

This page lays out what applies to us, in plain language, so the team understands the "why" behind the guardrails and the rules themselves.

GDPR: the foundation

https://gdpr.eu/what-is-gdpr/

GDPR is Float's compliance cornerstone. A few articles come up across our AI use:

• Article 5 (data minimization): only use what's necessary for the purpose. Pasting a full transcript into Claude when you only need the deal terms goes beyond what's necessary.

• Article 6 (lawful basis): there has to be a legitimate reason to process personal data in the first place, employment necessity, legitimate interest, or consent, depending on the context.

• Article 9 (special category data): health information and other special category data (for example, medical details a team member shares with a manager) falls into this stricter category. This type of personal data should never be uploaded into a Slack message or an AI tool, full stop.

• Article 22 (automated decision-making): GenAI makes inferences from the data it ingests, and with personal data the outcome can be harmful and inaccurate.

  If an AI output feeds into a decision with real effects on someone (like a performance review), a human must oversee it and have the authority to change the outcome.

• Article 28 (sub-processor disclosure): any tool that touches customer personal data needs to be listed on the Subprocessors list in our Float Trust Center. An undisclosed tool touching customer data is a compliance gap and could have costly and harmful repercussions.

• Article 35 (DPIA): before starting any processing likely to create high risk (which AI-assisted performance evaluation qualifies for), we're required to assess that risk first. This is where @Chris Nash our SRE lead and his team come in and perform a risk review in Vanta. This is a requirement on its own, separate from having safeguards like redaction or human review in place.

The EU AI Act: the additional layer

https://artificialintelligenceact.eu/

This is a separate regulation sitting alongside GDPR, specifically for AI. The pieces that matter for us:

• Article 4 (AI literacy): applies to every organization using AI, whatever the risk level, and has applied since February 2025. This is why we're building AI training for the team.
• Annex III lists high-risk AI use cases, employment (hiring) and performance evaluation tools like the ones we use 15Five and Pinpoint are examples of these tools.
• Article 27 (FRIA) is a Fundamental Rights Impact Assessment. It applies to public bodies, private entities providing public services, and deployers of certain high-risk systems used for credit scoring and life and health insurance pricing. That isn't Float, so it's out of scope for us. A DPIA under GDPR still applies where processing is high-risk.
• Article 6(3) carves out an exception for AI used in a purely preparatory way, not the final decision itself. Where our AI use lands depends on how it's used as much as what it's used for.
• High-risk obligations take effect December 2, 2027 (extended by the Digital Omnibus Regulation).

How this maps to what we do