Why this matters for every MSP

You’re an MSP. Your business systems (PSA, RMM, CRM) contain ticket data, client names, employee names, device details, contract values, and operational metrics for every customer you serve. This is personal data under GDPR, and it belongs to your clients, not to you.

When you connect an AI agent to query that data, every question you ask sends information to the AI provider’s servers. That makes the AI provider a sub-processor under data protection law. And that triggers a chain of legal obligations under Article 28 GDPR you cannot ignore.

Proxuma Power BI gives you a structured semantic model with clearly labeled measures, tables, and relationships across your entire tool stack. This is what makes AI queries possible in the first place: the data is structured and labeled, so an AI can write precise DAX queries instead of fumbling through raw APIs. But the AI still needs to see the query results. And that’s where the privacy question begins.

Your obligations under GDPR (Article 28)

Under GDPR, MSPs are data processors. Your clients are data controllers. When you introduce an AI provider, they become a sub-processor. Article 28(2) GDPR requires prior written authorization from the controller before engaging any sub-processor.

In either case: you must update your Data Processing Agreements before connecting any AI to client data. If your DPA was written before AI tools existed (most were), it almost certainly does not cover this use case. The EDPB’s guidelines on Article 28 provide detailed guidance on what DPAs must contain.

Where does your data actually go?

This is the critical question. Different AI providers handle your data very differently. Here’s the comparison that matters:

Five paths to AI, compared

Each hosting model trades off between capability, privacy, cost, and compliance burden. Here’s what each means for your MSP in practice.

The EU-US data transfer question (and Schrems III)

If your AI provider is US-based (and most are), sending EU client data to their servers is an international data transfer under GDPR Chapter V (Articles 44-49). The legal mechanism for this has been invalidated twice before, and may be challenged again.

The simplest way to avoid this entire issue: choose an AI provider with EU data residency. Azure OpenAI with the EU Data Zone, AWS Bedrock in Frankfurt, or Google Vertex AI in an EU region. If your data never leaves the EU, the transfer question doesn’t arise.

What applies where

MSPs in different countries face different (but overlapping) requirements. Here’s the quick reference:

Cyber insurance and AI: the exclusion wave

Starting January 2026, major insurers began applying AI exclusion endorsements to policies. Verisk (the industry standard-setter for insurance forms) released new AI-specific exclusion language that carriers are adopting rapidly. This directly affects MSPs.

What data should you actually send to the AI?

GDPR Article 5(1)(c) requires data to be “limited to what is necessary.” The EDPB Opinion 28/2024 on AI models and personal data further clarifies how this principle applies to AI processing. Every API call to an AI service is a processing operation. The less personal data you send, the lower your compliance burden.

Where Proxuma Power BI fits: Because the data is already structured in a semantic model with clear measures and dimensions, you can query aggregated metrics (total hours, ticket counts, revenue per service line) rather than raw record-level data. This naturally aligns with Level 2 data minimization. The AI sees numbers and categories, not individual names and ticket descriptions.

The MSP AI compliance checklist

Before connecting any AI to your client data, work through this list. Items are ordered by priority.

How to notify your clients

Under GDPR’s general authorization model, you must formally notify clients before introducing a new sub-processor. Here’s a template you can adapt:

Subject: Notice of New Sub-Processor — AI-Assisted Service Management

Dear [Client Name],

As part of our continuous improvement of service delivery, we are
writing to inform you of our intention to engage [AI Provider Name]
as a sub-processor under our existing Data Processing Agreement
dated [Date].

PURPOSE: [AI Provider] will be used for [specific purpose, e.g.,
"automated ticket classification, reporting analytics, and service
trend analysis"] to improve response times and service quality.

DATA PROCESSED: The following categories may be processed:
- Aggregated service metrics and ticket statistics
- Device categories and configuration summaries
- Service performance indicators

We do NOT send the following to this sub-processor:
- Passwords or authentication credentials
- Financial data (banking, credit card information)
- Individual employee personal details

SAFEGUARDS IN PLACE:
- Data encrypted in transit (TLS 1.2+) and at rest
- [Provider] maintains SOC 2 Type II / ISO 27001 certification
- Data processed within [EU/under EU-US Data Privacy Framework
  with Standard Contractual Clauses]
- [Provider] does not use customer data for model training

YOUR RIGHT TO OBJECT: In accordance with Section [X] of our Data
Processing Agreement, you have 30 days from receipt of this notice
to object. Please direct objections in writing to [email].

Kind regards,
[MSP Name]
[Compliance Officer / DPO]

The EU AI Act: what MSPs need to know

The EU AI Act (Regulation 2024/1689) reaches full applicability on August 2, 2026. Even before then, some obligations already apply. The AI Act Explorer provides a navigable version of the full text.

Regardless of risk classification, transparency is required (Article 50): if clients interact with AI-generated content, they must be informed.

Key takeaways

Sources & further reading

All claims in this guide are supported by the official sources below. Links verified February 2026.