Six decisions before an AI platform

Below roughly ten seats the administrative problem a platform solves does not exist yet: three people working together need no permissions concept. Above that the question no longer changes, only its shape.

Two things are settled before the discussion starts. Operations: at Langdock a dedicated instance starts at 2,000 seats, own-cloud hosting and on-premise at 5,000, below that multi-tenant SaaS on Microsoft Azure with servers inside the EU remains. And the price: volume discounts start at 51 seats, below that the list price applies. Whether Langdock negotiates in an individual case is documented nowhere. The 20 % for annual payment is independent of size.

What remains are the roles. Sponsor, administrator, data protection lead and the one or two people who will later build assistants are often two people in a small house, sometimes one. That speeds up decisions and only becomes a problem when nobody names the roles and everyone later assumes someone else thought about data protection.

Size shifts that. From roughly a hundred staff the roles sit on different shoulders, there is an IT lead with a say, several departments register use cases of their own, and approving a use case takes longer than setting it up. The six decisions stay the same; from that size a committee makes them rather than management alone.

The controller under the GDPR is the organisation as a legal entity, represented by its board or management. Not the colleague who creates the account, and not Langdock: Langdock is a processor. You have to request the data processing agreement through the Trust Center, together with the subprocessor list. What to check in it is covered in our piece on GDPR-compliant AI; the eight commitments in Article 28(3) GDPR as a checklist, walked through against a real contract, are in what an AI platform is worth contractually.

The second half of this decision is the more awkward one, because it touches on who is in charge. A running licence for thirty people is subject to a formal resolution under many statutes and rules of procedure. And a tool capable of recording conduct and performance triggers co-determination, in one of four forms depending on who runs the organisation:

• In private-sector businesses the works council, section 87(1) no. 6 BetrVG, and the outcome is a works agreement.
• In public authorities and public bodies the staff council, under the BPersVG or the staff representation act of the relevant federal state, and the outcome is a service agreement.
• Under church sponsorship the employee representation, under the MAVO on the Catholic and the MVG-EKD on the Protestant side, again with a service agreement as the outcome.
• Where there is no such body, a written house rule takes its place, adopted by management and made known to everyone.

Which of the four applies follows from your legal form and your sponsoring body; size has nothing to do with it. This is an assessment and not legal advice; the binding answer comes from your own legal counsel. Settling it only after the trial period uses up the trial period.

Two lists, permitted and forbidden, both short and both written down. Membership data, applications, counselling records and anything health-related belong on the second one as long as the legal basis is unclear. This decision cannot be handed to IT, because it depends on the legal basis rather than on the technology.

Model selection belongs with it, and on a platform the administrator makes it. A count by gewusst-ki.de as of 4 August 2026 arrives at 35 models available in Langdock, 7 of which have no EU region. For models with global deployment the terms of service permit inference worldwide. If you have to promise EU-only processing, disable the affected models and document it. This decision is made once and applies to every seat.

A tool without a named purpose turns into a toy for the three people who like trying new things anyway. A workable first case recurs regularly, is text-heavy, an error in it is cheap, and there is a person who does it today and would happily hand it over. In small organisations these are almost always the same three candidates:

• Meeting minutes. The board assistant hands over the audio recording of a meeting and gets back a draft set of minutes with resolutions and owners, and approves it. Eight to twelve meetings a year is the usual volume here.
• First reply to recurring enquiries. For a member enquiry that has arrived, the office gets a draft reply citing the stored membership fee and statute rules, and sends it by hand. Twenty to forty enquiries a month.
• Funding documents. The project lead uploads a funding decision and receives the deadlines, the conditions and the required form of the spending report as a list with due dates. Six to twelve decisions a year.

These volumes come from our first conversations and should be read as orders of magnitude. You take your own figure before switching on. Issuing formal decisions of your own, personnel matters and anything that goes out without human approval do not belong on this list.

Part of the purpose is the number you will later read the result off. It has to be taken before you switch on, because nobody reconstructs it afterwards: today's handling time for the case, measured on the people who do it. The seven-day trial without a credit card is enough for that measurement; its model credit is tightly cut and will not carry a workflow running continuously.

Allow more time than vendor logic suggests, and plan in three stages: first use within days, noticeable relief on the first task after weeks, changed ways of working across the organisation after roughly two months. A published 90-day field test puts time to noticeable benefit at six to ten weeks.

One person has to be named for this, not a department. If nobody takes the task on, the matter is not a priority in the organisation right now, and then it is too early to start. Day-to-day operation itself is administrative work: adding and removing seats, enabling models, setting retention and the spend limit, checking cost. One person with a few hours a month can handle it.

Part of that ownership is briefing those who will work with it. How much briefing depends on who does what internally: someone who only drafts text needs something different from the two people who will build assistants afterwards. A fixed format cannot be set in advance, but the question of who owns the briefing and where the result is documented can. Beyond operating skill, the most important effect is that it replaces what ran before. In almost every organisation, individuals have long been working with private AI accounts without management knowing. What that costs is covered in our piece on shadow AI.

Where volunteers, seasonal staff or project teams work alongside the core, the user count is not a fixed quantity: four people permanently, eight per project, two gone once a project ends. Langdock bills per seat and month, and booking seats by the day is not documented. Deriving the user count from the staff list therefore goes wrong regularly.

A shared account for "the team" is the worst answer to this. Shared logins make any audit trail worthless, prevent offboarding and run counter to the data processing agreement. What works: a small fixed core plus two or three rotating places reassigned at month end. If you do not yet know your own turnover, choose the monthly term and forgo the annual discount.

Several business customers date a change to the usage limits to 21 April 2026 on Trustpilot and report that it happened after they had signed and without notice. Langdock's own documentation does not carry that date. One review from 4 May 2026: "Contract signed, spent days setting everything up and rolling it out in the company, and then usage limits suddenly appear that were never communicated when the contract was signed."

The mechanism is confirmed in Langdock's own documentation: a five-hour session window, a weekly window resetting on Monday, and automatic routing to a fallback model once the limit is hit. What matters is the gap behind it: the quotas per seat type are not published, so before signing you cannot work out when a heavy user will run into the limit.

Four points therefore belong before the signature, asked of the vendor in writing: the quotas per seat type, a notice period for changes to the usage model, a right of extraordinary termination if terms materially worsen, and the route by which you export chats, files and assistants. Nobody rewrites a standard contract at this size; what you can get is a dependable answer, and that is enough to know what you are signing up for. The terms of service name no deletion period after the contract ends, so you have to have one added. The notice periods themselves are manageable: a monthly contract renews automatically with seven days' notice, an annual one for twelve months with 14 days.

Hardly anyone says out loud that a decision is still open. You hear it in sentences that come up in a meeting without anyone objecting.

A single sign is normal. Once they pile up, the order is wrong: the tooling question is standing in front of the clarification, and the tool will not do the clarification for you.

Most of it. Naming the roles, writing the two data lists, choosing the purpose and measuring the baseline, requesting the DPA: those are management decisions, not consulting work. An organisation that has answered all six points for itself sets the platform up in a week and needs nobody for it.

An outside look pays off in two places. First where a decision depends on legal ground nobody in the organisation reads regularly, such as data under Article 9 GDPR or the question of whether a use case falls under the EU AI Act. Second where the answer is uncomfortable and therefore nobody says it out loud, ownership being the usual case. How we carry out that assessment is described on our service page Introducing and supporting Langdock, including the free first conversation in which this can be sorted out without any commitment. What we then propose follows from the assessment and is not fixed beforehand.

One note in our own cause, because it helps with the reading: checked on 7 August 2026, arocom is not a listed Langdock partner. We sell no licences and earn nothing on the licence. The assessment can therefore also come out against the platform.