[ 01 ]
AI use inventory
A list of where AI is or will be used, which data it sees, the model and provider, and who owns each use.
AI in regulated environments
Use AI where the rules are strict, with controls you can show.
We help teams in finance, health and other regulated fields set up AI use with masking, residency decisions, audit trails and policies. We build the controls. Your counsel decides what they mean legally.
PII masking before promptsAudit trailsNo legal advice
[ 01 — WHAT YOU GET ]
Technical controls and clear paperwork.
Rules such as revDSG, GDPR and the EU AI Act shape what is allowed. We translate your legal team's decisions into working guardrails.
- [ 02 ]
PII masking and redaction
Names, account numbers and other identifiers are replaced before a prompt reaches a model, and restored only where allowed. - [ 03 ]
Data residency and provider choice
Documented decisions on where processing runs and which providers may be used for which data class. - [ 04 ]
Audit trails
Who asked what, which model answered, what the human decided. Retained for the period your rules require. - [ 05 ]
Policies and training
A short, usable AI policy and role-based training so staff know what is allowed with which data.
[ 02 — PROCESS ]
From inventory to working controls.
We work alongside your compliance, legal and IT roles.
- 01
Inventory and data classes
We list AI uses, including shadow use, and sort the data involved into classes with your compliance lead.1 to 2 weeks - 02
Decisions on paper
We prepare the options for each use: provider, region, masking, retention. Your counsel reviews and decides.2 weeks - 03
Build the controls
Masking layer, logging, access rules and approval steps, implemented for one pilot workflow.4 weeks - 04
Review routine
A periodic check of logs, incidents and changes in rules or providers.Quarterly
[ 03 — USE CASES ]
Where controls make it possible.
Typical scenarios. None of these describe a specific client.
Client correspondence drafts
- Today
- Advisers cannot paste client mails into a chatbot.
- With the workflow
- Identifiers are masked, the model drafts, and the adviser restores names and checks the text before sending.
Case file summaries
- Today
- Summaries of long files are written manually.
- With the workflow
- A model in an approved region summarises with citations. Access and requests are logged.
Shadow AI clean-up
- Today
- Staff use personal accounts on public tools.
- With the workflow
- An approved tool with a clear policy replaces them, with usage visible to the AI owner.
[ 04 — SCOPE & PRICE ]
An assessment before any build.
Regulated AI assessment · 3 to 4 weeks
from CHF 6,500fixed scope · excl. VAT
This is not legal advice. Implementing the controls is quoted separately. Extensions: CHF 2,200 per day.
- AI use inventory and data classes
- Data flow map
- PII masking concept
- Draft AI policy for your counsel to review
[ 05 — QUESTIONS ]
What people ask about regulated AI.
Is this legal advice?
No. niivo provides technical and organisational guidance. Legal interpretation and compliance decisions rest with your counsel and your compliance function.
Can you make us compliant?
No one can promise that from the outside. We help you build controls and records that your compliance team can assess.
Does masking remove all personal data?
It reduces exposure, but it is not perfect. We test it on your real documents, report what it misses and combine it with access rules and provider choice.
Do you cover the EU AI Act?
We cover awareness and practical steps such as an inventory and risk-level sorting of your uses. The legal assessment stays with your counsel.
Where does our data go during this work?
We work on samples or masked data where we can, inside your environment. We agree the handling in writing before we start.
Start with the rules you have to meet.
Bring your compliance lead to the intro call. We map what can be built.