In a call for tenders for an AI chatbot, the GDPR section is there to secure verifiable commitments from the supplier on data, security, hosting and contracts. Without them, you are exposed to legal risk under the AI Act, the European regulation on artificial intelligence, and to fines of up to 4% of turnover. Here are the criteria to include.

In 2026, 73% of companies still struggle to define these requirements.

Key takeaways

• Without explicit consent, a supplier that trains its models on your conversations is considered "high risk".

• Four security measures are non-negotiable, including an alert within 48 hours in the event of a breach.

• Server location often eliminates 50% of bidders.

Under the GDPR, you remain responsible for the data your chatbot processes

Choosing an AI chatbot means entrusting a supplier with processing a large amount of personal data. Yet you remain the data controller, meaning the organisation that decides why and how this data is processed. Solid specifications ensure your compliance (Article 28 of the GDPR, AI Act), rule out risky suppliers and protect your data.

What data will your AI chatbot process?

The first step in your call for tenders is to map the data flows. Ask each supplier what the chatbot collects: names, email addresses, phone numbers, but also browsing histories and voice data. Above all, ask whether it uses your conversations to train its large language models (LLMs).

• Training: require a no-training option or a strict opt-in, meaning explicit prior consent. Without this consent, the supplier is now considered "high risk".

• Retention: a configurable period (3, 6 or 12 months) and automatic deletion on expiry.

• Reversibility: a deadline for permanent deletion at the end of the contract, with a certificate.

Your specifications must impose four security measures

Your tender document must impose four technical measures, which are non-negotiable. They protect your customers' data, whether it is stored or in transit. They also allow you to meet your deadlines with the CNIL, the French data protection authority, in the event of a breach.

1. Encryption: in transit (TLS 1.3 at minimum) and at rest, on the servers (AES-256).

2. Access control: mandatory multi-factor authentication (MFA) for administration.

3. Incident notification: the supplier notifies you within 48 hours of a breach, so that you can meet the CNIL's 72-hour deadline.

4. Chains of sub-processors: a complete list of third parties (hosting providers, model APIs such as OpenAI or Mistral, analytics tools) and proof of signed DPAs.

Where will your data, and its backups, be hosted?

Server location is the criterion that often eliminates 50% of bidders. Ask for the hosting country, France or the European Union, and check that backups also stay within the Union. If any data leaves it, ask which legal mechanism governs these transfers (transfer impact assessment, standard contractual clauses).

A serious supplier provides four contractual documents at the tender stage

A serious supplier should be able to hand you four contractual documents straight away. They cover data processing, security measures, resistance to attacks and the AI's risk level. Ask for them at the tender stage, before scoring the bids.

• DPA (Data Processing Agreement): the data processing agreement required by Article 28.

• Security annex: the details of the technical measures.

• Penetration test report (pentest) less than 12 months old.

• AI Act sheet: the risk level of the proposed AI.

Free template: download the Excel specifications

To save you time, we have brought these best practices together in a ready-to-use tool. It includes more than 60 criteria sorted by theme (GDPR, technical, business), an automatic scoring grid for bids and three levels of requirement (mandatory, important, optional).

.xlsx format, compatible with Google Sheets. Estimated time saved: 15 hours of drafting.

Frequently asked questions

What are the mandatory requirements for an AI chatbot? At a minimum: a DPA, data encryption, a clear retention policy and transparency about model training.

Is hosting in France mandatory? No, the European Union is legally sufficient. Hosting in France remains a strong advantage for data sovereignty and limits the risks associated with extraterritorial laws, meaning foreign laws that apply outside their own country.

What does the CNIL say about conversational agents? It stresses data minimisation: only collect what is necessary. It also asks that users be clearly informed, so that they know from the very first message that they are talking to a machine.