Growtur · AI security & compliance
AI is already part of marketing, bookings and operations. Now it is time to identify the obligations that apply, find the gaps and document how you use it.
From assessment to ongoing support
Start with an audit, then agree the scope of implementation and ongoing support. Each proposal reflects your actual tools, data and AI uses.
We review AI uses and the obligations affecting your organisation to identify gaps and prioritise action.
We turn the report's findings into measures and documentation your team can apply in its daily work.
We support you as regulations, tools and AI uses change, so your documentation stays relevant.
Obligations depend on the system, its use and the organisation's role. AI literacy and certain transparency obligations already apply; not every tourism tool is a high-risk system. Read the official AI Act timeline.
Technology and legal expertise
Lawyer specialising in data protection and regulatory compliance
Gina Andrés (Georgina Andrés) brings legal expertise to our AI compliance service. Her background includes legal advice on data protection, information society services and e-commerce.
Her legal expertise complements Growtur's experience in AI for tourism: understanding the legal framework and how your organisation works, within one service.
Why now
Using AI calls for a review of applicable obligations, processed data and internal controls, not just the choice of a tool.
AI literacy has applied since February 2025 and certain transparency obligations since August 2026. Annex III high-risk obligations are scheduled for December 2027 and Annex I obligations for August 2028. We assess each system and your role as a user or provider.
Entering personal data from bookings, PMS or CRM into AI tools requires a review of safeguards and legal basis. It affects every company in the group and the data flows between them.
Teams using personal AI accounts with rates, contracts and databases. This can create risks management has not identified.
Relationships with chains, OTAs, tour operators and corporate clients may include data and AI requirements. We review how to address contractual terms.
The two pillars
Complying with the law is useless if your data leaks, and hardening security is useless if you breach the AI Act. We work both fronts with a group-wide view.
How we work
Inventory of AI tools in use by company and department, the data they touch and your current compliance level.
Executive report with financial and reputational impact, plus technical detail for IT and legal.
Corporate AI use policy, secure tool configuration, access control and oversight protocols.
Role-based training and ongoing support for your AI committee as regulation evolves.
Who it's for
We have a dedicated proposal for the public and associative sector.
Let's discuss your situation
Tell us which tools you use and what you need to review: an audit, implementation or ongoing legal support. We will prepare a proposal tailored to your organisation.
The scope and terms are agreed in the proposal. The indicative self-check does not replace an audit or a legal opinion.
Complement legal work with practical training. Our business course includes AI security and compliance alongside agents, GEO, CRM and data analysis.
Growtur × ITH Academy · New edition
Starts October 19, 2026
42 online hours to put AI to work in your business: from agents and security to new search positioning and campaigns.
6 modules · 42 hours · 100% online · ITH Academy + Growtur certificate
€315 + VAT
Up to 100% FUNDAE funding in Spain