Elric is a business AI assistant for SMBs. Unlike a simple chatbot, Elric deploys a team of specialized AI agents (sales, HR, legal, finance, tech, marketing) that access 33 everyday tools and share a persistent company memory.

Is Elric different from meeting bots like Otter or Fireflies?

Yes. Meeting bots mostly stop at transcription. Elric also transcribes, but goes much further: it extracts tasks, delegates them automatically to the right AI agent, triggers follow-up emails, updates the CRM, and enriches its company memory. Meetings are only one trigger in a complete automation system.

Which tools does Elric integrate with?

33 tools: email (Gmail, Outlook), Slack, Notion, Google Drive, Google Calendar, HubSpot, Stripe, Zoom, Google Meet, Teams, and more. Each Elric agent can combine several tools to complete a task end to end.

Is Elric GDPR-compliant?

Yes. Elric is hosted in France on Supabase EU-West-1, all data stays within European territory, RLS is active on every table, and conversations plus memories can be purged on request.

What kind of company is Elric designed for?

Elric is optimized for SMBs (5 to 250 employees), professional firms (consulting, law, accounting), family offices, and small organizations that want to share support functions (admin, sales, HR) without hiring.

How is Elric different from ChatGPT or Microsoft Copilot?

ChatGPT and Copilot answer questions but do not execute, are not visible working, and offer no governance. Elric executes the work, shows each agent at its desk in a virtual Open Space, logs every action, and requires human approval before sensitive actions (external emails, deletions). It is the governed alternative to ungoverned "Shadow AI".

Can Elric execute tasks autonomously?

Yes. You delegate a task to an agent and it runs on its own with its connected tools, then reports back; meeting action items can execute automatically. Sensitive actions (sending an external email, deleting data) always require explicit human validation.

Is an AI agent reading my email compliant?

Yes with documented legal basis, signed DPA, EU hosting, company isolation and clear purpose.

Are US LLMs a problem?

Risk is transfer outside EU. Use vendors with DPA, SCCs and — ideally — EU processing of core data.

Does Elric provide a DPA?

Yes — available at /dpa. EU hosting, no third-party training on your content, RLS isolation.

Must AI agents be declared to the supervisory authority?

Update your Article 30 processing register as soon as an agent processes personal data — emails, resumes, meetings. No separate "AI declaration" if the register is current.

Are Make or n8n GDPR-compatible?

Yes if you map personal data flows, sign DPAs with each connector and limit transferred fields. They do not replace a governed AI OS for business execution.

What about employees using personal ChatGPT?

Ban or channel to a governed workspace (Elric, enterprise Copilot) with DPA, audit and approvals — Shadow AI is the #1 risk in 2026.

ELRIC Lab · Guides 2026

AI agents GDPR SMB 2026: practical compliance guide

AI agents process personal data — emails, resumes, meetings, CRM. This guide helps SMBs deploy AI **without grey zones**: legal bases, hosting, processors, audit and human control.

Last updated : July 6, 2026 · Reading time : ~6 min

3 compliance pillars

GDPR compliance for AI agents rests on three technical pillars. The diagram shows how they fit together.

Data flow and human control

Every sensitive action goes through approval; core data stays in the EU with per-company isolation.

Pillar 1 — Location: core data in the EU, signed DPA, no third-party training on your content.
Pillar 2 — Technical governance: multi-tenant isolation (RLS), encrypted tokens, exportable audit.
Pillar 3 — Human control: approval before external email, data deletion/export, updated processing register.

12-point checklist

Vendor or internal audit: each item is verifiable — not a marketing promise.

Data flow and human control

Every sensitive action goes through approval; core data stays in the EU with per-company isolation.

Identify personal data processed by AI
Document purpose and legal basis
Verify EU hosting of core data
Sign DPA with AI vendor
Require per-company isolation
Enable agent action audit log
Configure human approval for sensitive actions
Limit OAuth scopes to minimum
Train users (no unnecessary sensitive data)
Plan deletion / export procedure
Update processing register
Review LLM subprocessors annually

Hosting compared

Platform	Best for	Score
Elric (EU)	SMB, native RLS, DPA	Compliant
Mistral Le Chat	French model, chat data	DPA + purpose
ChatGPT Enterprise	US + EU options	DPA required
Copilot M365	EU Data Boundary	If M365
Make / n8n	Automation, subprocessors	Map data flows
US tools without DPA	—	Avoid

Decision tree

Your regulatory requirements determine the platform — not the other way around.

EU data + SMB → Elric or EU vendor with DPA
100% Microsoft + EU Boundary → Copilot acceptable
Health / children data → mandatory DPO review
Personal Shadow ChatGPT → ban, centralize workspace
Export outside EU → legal review case by case

FAQ

Is an AI agent reading my email compliant?: Yes with documented legal basis, signed DPA, EU hosting, company isolation and clear purpose.
Are US LLMs a problem?: Risk is transfer outside EU. Use vendors with DPA, SCCs and — ideally — EU processing of core data.
Does Elric provide a DPA?: Yes — available at /dpa. EU hosting, no third-party training on your content, RLS isolation.
Must AI agents be declared to the supervisory authority?: Update your Article 30 processing register as soon as an agent processes personal data — emails, resumes, meetings. No separate "AI declaration" if the register is current.
Are Make or n8n GDPR-compatible?: Yes if you map personal data flows, sign DPAs with each connector and limit transferred fields. They do not replace a governed AI OS for business execution.
What about employees using personal ChatGPT?: Ban or channel to a governed workspace (Elric, enterprise Copilot) with DPA, audit and approvals — Shadow AI is the #1 risk in 2026.