---
title: "Six decisions before an AI platform"
lang: en
type: blog
canonical: https://www.arocom.de/en/blog/rolling-out-langdock-smaller-organisations
alternate: https://www.arocom.de/blog/langdock-einfuehren-verein-mittelstand
author: "Axel Roth"
published: 2026-08-07
last_updated: 2026-09-09
---

# Six decisions before an AI platform

In organisations from 10 people upwards, an AI platform is often decided on by the same people who will run it afterwards. Six points come up before it is switched on: who is the controller under the GDPR and who may pass the resolution, which data categories may go in, which recurring cases are the actual purpose, who looks after the platform afterwards, how seats follow a changing line-up, and on what terms you can get out again. For each point there is a sign in daily work that tells you it is still open. An organisation that has answered all six can run the rollout largely on its own. One that has to pass on three is facing a clarification and not yet a tooling decision.

## Six decisions before an AI platform

In small organisations an AI platform rarely fails on the technology. The
account is created in a morning, the first seats are handed out before
lunch. What happens after that hangs on six decisions nobody made
beforehand, because they appear in no quote and belong to nobody.

The market is little help. The Langdock partner directory sorts its firms
by company size, from the small business up to the corporate group. There
is no category there for associations, federations, law firms or the
public sector. For a training provider with 22 staff, a social services
provider with 60, a family business with 35 or an adult education body
with 400, nobody is explicitly responsible. What Langdock can do
as a product is covered in our overview of
[Langdock](https://www.arocom.de/en/knowledge/ai/langdock). This piece is about what comes
before that.

## What is different from 10 people upwards

Below roughly ten seats the administrative problem a platform solves
does not exist yet: three people working together need no permissions
concept. Above that the question no longer changes, only its shape.

Two things are settled before the discussion starts.
Operations: at Langdock a dedicated instance starts at 2,000 seats,
own-cloud hosting and on-premise at 5,000, below that multi-tenant SaaS
on Microsoft Azure with servers inside the EU remains. And the price:
volume discounts start at 51 seats, below that the list price applies.
Whether Langdock negotiates in an individual case is documented nowhere.
The 20 % for annual payment is independent of size.

What remains are the roles. Sponsor, administrator, data protection lead
and the one or two people who will later build assistants are often two
people in a small house, sometimes one. That speeds up
decisions and only becomes a problem when nobody names the roles and
everyone later assumes someone else thought about data protection.

Size shifts that. From roughly a hundred staff the roles sit on
different shoulders, there is an IT lead with a say, several departments
register use cases of their own, and approving a use case takes longer
than setting it up. The six decisions stay the same; from that size a
committee makes them rather than management alone.

## First decision: controllership and the mandate to decide

The controller under the GDPR is the organisation as a legal entity,
represented by its board or management. Not the colleague who creates
the account, and not Langdock: Langdock is a processor. You have to
request the data processing agreement through the Trust Center, together
with the subprocessor list. What to check in it is covered in our piece
on [GDPR-compliant AI](https://www.arocom.de/en/knowledge/ai/gdpr-compliant-ai); the eight
commitments in Article 28(3) GDPR as a checklist, walked through against
a real contract, are in
[what an AI platform is worth contractually](https://www.arocom.de/en/blog/one-contract-instead-of-four).

The second half of this decision is the more awkward one, because it
touches on who is in charge. A running licence for thirty people is
subject to a formal resolution under many statutes and rules of
procedure. And a tool capable of recording conduct and performance
triggers co-determination, in one of four forms depending on who runs
the organisation:

- In private-sector businesses the **works council**, section 87(1)
  no. 6 BetrVG, and the outcome is a works agreement.
- In public authorities and public bodies the **staff council**, under
  the BPersVG or the staff representation act of the relevant federal
  state, and the outcome is a service agreement.
- Under church sponsorship the **employee representation**, under the
  MAVO on the Catholic and the MVG-EKD on the Protestant side, again
  with a service agreement as the outcome.
- Where there is no such body, a written house rule takes its place,
  adopted by management and made known to everyone.

Which of the four applies follows from your legal form and your
sponsoring body; size has nothing to do with it. This is an assessment and
not legal advice; the binding answer comes from your own legal counsel.
Settling it only after the trial period uses up the trial period.

## Second decision: which data may go in

Two lists, permitted and forbidden, both short and both written down.
Membership data, applications, counselling records and anything
health-related belong on the second one as long as the legal basis is
unclear. This decision cannot be handed to IT, because it depends on the
legal basis rather than on the technology.

Model selection belongs with it, and on a platform the administrator
makes it. A count by gewusst-ki.de as of 4 August 2026 arrives at 35
models available in Langdock, 7 of which have no EU region. For models
with global deployment the terms of service permit inference worldwide.
If you have to promise EU-only processing, disable the affected models
and document it. This decision is made once and applies to every seat.

## Third decision: the purpose

A tool without a named purpose turns into a toy for the three people who
like trying new things anyway. A workable first case recurs regularly,
is text-heavy, an error in it is cheap, and there is a person who does
it today and would happily hand it over. In small organisations these are
almost always the same three candidates:

- **Meeting minutes.** The board assistant hands over the audio
  recording of a meeting and gets back a draft set of minutes with
  resolutions and owners, and approves it. Eight to twelve meetings a
  year is the usual volume here.
- **First reply to recurring enquiries.** For a member enquiry that has
  arrived, the office gets a draft reply citing the stored membership fee
  and statute rules, and sends it by hand. Twenty to forty enquiries a
  month.
- **Funding documents.** The project lead uploads a funding decision and
  receives the deadlines, the conditions and the required form of the
  spending report as a list with due dates. Six to twelve decisions a
  year.

These volumes come from our first conversations and should be read as
orders of magnitude. You take your own figure before switching
on. Issuing formal decisions of your own, personnel matters and anything
that goes out without human approval do not belong on this list.

Part of the purpose is the number you will later read the result off.
It has to be taken before you switch on, because nobody reconstructs it
afterwards: today's handling time for the case, measured on the people
who do it. The seven-day trial without a credit card is enough for that
measurement; its model credit is tightly cut and will not carry a
workflow running continuously.

Allow more time than vendor logic suggests, and plan in three stages:
first use within days, noticeable relief on the first task after weeks,
changed ways of working across the organisation after roughly two
months. A published 90-day field test puts time to noticeable benefit at
six to ten weeks.

## Fourth decision: who looks after the platform afterwards

One person has to be named for this, not a department. If nobody takes
the task on, the matter is not a priority in the organisation right now, and
then it is too early to start. Day-to-day operation itself is
administrative work: adding and removing seats, enabling models, setting
retention and the spend limit, checking cost. One person with a few hours
a month can handle it.

Part of that ownership is briefing those who will work with it. How
much briefing depends on who does what internally: someone who only
drafts text needs something different from the two people who will build
assistants afterwards. A fixed format cannot be set in advance, but the
question of who owns the briefing and where the result is documented
can. Beyond operating skill, the most important effect is that it
replaces what ran before. In almost every organisation, individuals have
long been working with private AI accounts without management knowing.
What that costs is covered in our piece on
[shadow AI](https://www.arocom.de/en/knowledge/ai/shadow-ai).

## Fifth decision: who gets a seat, and for how long

Where volunteers, seasonal staff or project teams work alongside the
core, the user count is not a fixed quantity: four people permanently,
eight per project, two gone once a project ends. Langdock bills per seat
and month, and booking seats by the day is not documented. Deriving the
user count from the staff list therefore goes wrong regularly.

A shared account for "the team" is the worst answer to this. Shared
logins make any audit trail worthless, prevent offboarding and run
counter to the data processing agreement. What works: a small fixed core
plus two or three rotating places reassigned at month end. If you do not
yet know your own turnover, choose the monthly term and forgo the annual
discount.

## Sixth decision: on what terms you can get out again

Several business customers date a change to the usage limits to
21 April 2026 on Trustpilot and report that it happened after they had
signed and without notice. Langdock's own documentation does not carry
that date. One review from 4 May 2026: "Contract
signed, spent days setting everything up and rolling it out in the
company, and then usage limits suddenly appear that were never
communicated when the contract was signed."

The mechanism is confirmed in Langdock's own documentation: a five-hour
session window, a weekly window resetting on Monday, and automatic
routing to a fallback model once the limit is hit. What matters is the
gap behind it: the quotas per seat type are not published, so before
signing you cannot work out when a heavy user will run into the limit.

Four points therefore belong before the signature, asked of the vendor
in writing: the quotas per seat type, a notice period for changes to the
usage model, a right of extraordinary termination if terms materially
worsen, and the route by which you export chats, files and assistants.
Nobody rewrites a standard contract at this size; what you can get is a
dependable answer, and that is enough to know what you are signing up
for. The terms of service name no deletion period after the contract
ends, so you have to have one added.
The notice periods themselves are manageable: a monthly contract renews
automatically with seven days' notice, an annual one for twelve months
with 14 days.

## How you notice that a decision is still open

Hardly anyone says out loud that a decision is still open. You hear it
in sentences that come up in a meeting without anyone objecting.

| Sign in daily work | Decision that is still open |
| --- | --- |
| The trial account runs on a colleague's private address | Controllership |
| The purchase is in the minutes but not in a resolution, and the co-determination body heard about it in the corridor | Mandate and co-determination |
| Asked which data may go in, you get three different answers | Data categories |
| The benefit is argued as "time saved" while nobody knows today's handling time | Purpose and metric |
| Asked who looks after it, someone names a department | Ownership |
| The seat count in the quote comes from the staff list | Seats and their movement |
| Nobody knows how chats and files would come back out in an emergency | Exit |

A single sign is normal. Once they pile up, the order is wrong: the
tooling question is standing in front of the clarification, and the tool
will not do the clarification for you.

## What you can do yourself

Most of it. Naming the roles, writing the two data lists, choosing the
purpose and measuring the baseline, requesting the DPA: those are
management decisions, not consulting work. An organisation that has
answered all six points for itself sets the platform up in a week and
needs nobody for it.

An outside look pays off in two places. First where a decision depends
on legal ground nobody in the organisation reads regularly, such as data under
Article 9 GDPR or the question of whether a use case falls under the EU
AI Act. Second where the answer is uncomfortable and therefore nobody
says it out loud, ownership being the usual case. How we carry out that
assessment is described on our service page
[Introducing and supporting Langdock](https://www.arocom.de/en/services/langdock), including the free first
conversation in which this can be sorted out without any commitment.
What we then propose follows from the assessment and is not fixed
beforehand.

One note in our own cause, because it helps with the reading: checked on
7 August 2026, arocom is not a listed Langdock partner. We sell no
licences and earn nothing on the licence. The assessment can therefore
also come out against the platform.

### How do we know we are not ready for an AI platform yet?

Most reliably from the second and the fourth decision. If asking which data may go in produces three different answers, and if no name is given for ownership, the basis is missing. Both can be caught up in a few days, but not on the side during the trial period.

### Do we have to make all six decisions ourselves?

Make them, yes, the responsibility cannot be handed over. The assessment, meaning gathering the ground facts and making the open points visible, can come from outside. We then cut our own part to what the assessment shows.

### Can we run Langdock without an IT department?

Yes. Day-to-day operation is administrative work: adding and removing seats, enabling models, setting retention and the spend limit, checking cost. One person with a few hours a month can handle it. The demanding part is the clarification beforehand, not the operation.

### Do we need a data processing agreement, and where do we get it?

Yes. As soon as personal data is processed, Langdock is the processor and you remain the controller. Langdock points to a data processing addendum via its Trust Center; there is no freely linked document. Request it together with the subprocessor list before the first real file is uploaded.

### Does our data stay in Germany?

No, and that sentence should not go into your privacy notice either. What is documented is multi-tenant SaaS on Microsoft Azure with servers inside the EU. Langdock names no city or Azure region, "Frankfurt" appears only in a third-party source. For models with global deployment the terms of service additionally permit inference worldwide. If you have to promise EU-only processing, disable the affected models and document it.

### How do we get out again if it does not fit?

A monthly contract renews automatically and must be cancelled at least seven days before the end of the period, an annual contract renews for twelve months with 14 days' notice. Clarify beforehand how you export chats, files and assistants, and what deletion period applies after the contract ends. The terms of service name no fixed period.