Growtur · AI security & compliance
AI is already part of visitor services, promotion and internal management. Now it is time to identify applicable obligations and document how your organisation uses it.
From assessment to ongoing support
Start with an audit, then agree the scope of implementation and ongoing support. Each proposal reflects your actual tools, data and AI uses.
We review AI uses and the obligations affecting your organisation to identify gaps and prioritise action.
We turn the report's findings into measures and documentation your team can apply in its daily work.
We support you as regulations, tools and AI uses change, so your documentation stays relevant.
Obligations depend on the system, its use and the organisation's role. AI literacy and certain transparency obligations already apply; not every tourism tool is a high-risk system. Read the official AI Act timeline.
Technology and legal expertise
Lawyer specialising in data protection and regulatory compliance
Gina Andrés (Georgina Andrés) brings legal expertise to our AI compliance service. Her background includes legal advice on data protection, information society services and e-commerce.
Her legal expertise complements Growtur's experience in AI for tourism: understanding the legal framework and how your organisation works, within one service.
Why now
Obligations apply progressively and need to be assessed for each system and its use within the organisation.
AI literacy has applied since February 2025 and certain transparency obligations since August 2026. The official timeline places Annex III high-risk obligations in December 2027 and Annex I obligations in August 2028. We assess what applies to each use.
Where a chatbot or assistant processes personal data, the legal basis, vendor agreements and need for an impact assessment must be reviewed. We also assess applicable public-sector security requirements.
We review tender and contract clauses when AI is involved: data use, training terms, traceability and vendor exit conditions.
A destination assistant inventing opening hours, prices or rules damages the institution's credibility and that of every business it represents.
The two pillars
We work the legal framework and technical security in an integrated way, adapted to how an administration or association actually operates.
How we work
Inventory of the destination's AI systems (official and unofficial), data processed and current compliance level.
A report for management and for the technical team: applicable obligations, risks and fix priorities.
Institutional AI use policy, procurement clauses, secure configuration and oversight protocols.
Training for staff and member businesses, plus ongoing support as regulation evolves.
Who it's for
We have a dedicated proposal for chains, groups and companies in the sector.
Let's discuss your situation
Tell us which tools you use and what you need to review: an audit, implementation or ongoing legal support. We will prepare a proposal tailored to your organisation.
The scope and terms are agreed in the proposal. The indicative self-check does not replace an audit or a legal opinion.
Complement legal work with practical training. Our business course includes AI security and compliance alongside agents, GEO, CRM and data analysis.
Growtur × ITH Academy · New edition
Starts October 19, 2026
42 online hours to put AI to work in your business: from agents and security to new search positioning and campaigns.
6 modules · 42 hours · 100% online · ITH Academy + Growtur certificate
€315 + VAT
Up to 100% FUNDAE funding in Spain