European AI Act
The Regulation has required AI literacy since February 2025, and in August 2026 high-risk obligations arrive, with fines of up to €35M or 7% of global turnover.
Consulting · AI security & regulation for groups and companies
Scale AI in your company without exposing data or breaching the law
Business groups, hotel chains, operators and tourism companies already run AI across marketing, bookings and operations. We help you do it under control: complying with the AI Act and GDPR and protecting your customer data.
Why now
The risk is no longer only regulatory, it's commercial
Obligations already apply and AI-related security incidents are multiplying across the sector.
GDPR and customer data
Feeding booking, PMS or CRM data into AI tools without safeguards breaches GDPR. It affects every company in the group and the data flows between them.
Shadow AI and know-how leakage
Teams using personal AI accounts with rates, contracts and databases. It's the most common leak route and the least visible to management.
Partner and tour operator requirements
Chains, OTAs, tour operators and corporate clients already demand AI guarantees in contracts and vendor audits.
The two pillars
Regulatory compliance and security, side by side
Complying with the law is useless if your data leaks, and hardening security is useless if you breach the AI Act. We work both fronts with a group-wide view.
Regulation & compliance
- Map of applicable obligations: AI Act, GDPR, NIS2 and sectoral guidelines.
- Risk-level classification of the AI systems in each business unit.
- Team AI literacy (mandatory since Feb 2025, art. 4 AI Act).
- Corporate AI use policy, consistent across the whole group.
- Documentation and traceability ready for inspection, audit or due diligence.
AI security
- Shadow AI audit by department: marketing, revenue, reservations, HR and operations.
- Leak prevention: corporate licences (ChatGPT, Claude, Gemini) configured with no training on your data.
- Protection of sales agents and chatbots against prompt injection and hallucinated prices or conditions.
- Human oversight and review protocols before publishing or sending generated content.
- AI incident response plan and continuity for critical vendors.
How we work
A clear assessment in four steps
01
Risk & compliance assessment
Inventory of AI tools in use by company and department, the data they touch and your current compliance level.
02
Gap map
Executive report with financial and reputational impact, plus technical detail for IT and legal.
03
Policy & measures
Corporate AI use policy, secure tool configuration, access control and oversight protocols.
04
Training & support
Role-based training and ongoing support for your AI committee as regulation evolves.
Who it's for
Business groups and tourism companies
- Business groups and tourism holdings
- Hotel chains and restaurant groups
- Tour operators, DMCs and agencies
- OTAs, channel managers and travel tech
- Wineries, wine tourism and experience companies
Are you a destination, institution or association?
We have a dedicated proposal for the public and associative sector.
Do you know which AI is being used in your company today?
We deliver an initial risk and compliance assessment, with no commitment. You'll know exactly where you stand and what steps to take.