.png?width=200&height=80&name=CanDo%20Logo%20transparent%20(500%20x%20200%20px).png)
Artificial intelligence makes project management more efficient, but introduces new compliance risks. Businesses using AI for project analysis, resource planning or early risk identification need to consider data protection, access rights, the reliability of specialist analysis and the EU AI Act. Particular care is needed when AI accesses confidential business information or prepares decisions about employees.
What risks arise? When does project management AI become a data protection concern? How can businesses use it safely while retaining its benefits?
This article explains seven central compliance risks and how suitable technical and organisational measures can reduce them.
AI increasingly supports portfolio analysis, capacity planning and identification of critical developments. It frequently processes information that requires particular protection:
The challenge extends beyond the security of the AI model. It matters which information AI may process, how it draws conclusions and which decisions it influences.
The GDPR, existing information security requirements and the EU AI Act are therefore relevant.
| Risk | Typical challenge | Response |
|---|---|---|
| 1. Shadow AI | Uncontrolled disclosure of confidential project data | Centrally managed AI environment |
| 2. Personal data | Profiling and problematic employee assessments | Data minimisation and purpose limitation |
| 3. Permissions | Access to projects outside the user's authorisation | User-based access controls |
| 4. Misinterpretation | Incorrect capacity or risk analysis | Defined specialist calculation rules |
| 5. Auditability | AI conclusions cannot be traced | Documented rules and logging |
| 6. AI governance | Unclear ownership and inconsistent rules | Defined responsibilities |
| 7. EU AI Act | Incorrect risk classification | Assessment of the specific intended purpose |
A project manager uploads a confidential plan to a public AI assistant to identify risks. A resource manager transfers utilisation data for bottleneck analysis.
If the services have not been approved, this is shadow AI: use outside the organisation's intended IT and governance arrangements.
Confidential information may reach external systems without sufficient clarity about how it is processed, stored or deleted. An employer-funded personal AI account does not automatically resolve this. What matters is whether the organisation can control its actual use and data processing.
Provide centrally managed AI solutions and binding rules about which data can be used for which applications. Assess data residency, possible international transfers, processor arrangements and access rights.
Centrally administered enterprise AI can reduce shadow AI, but does not replace assessment of individual use cases.
Project and resource management processes personal information such as working hours, qualifications, assignments, availability and individual utilisation. Problems can arise when AI derives new conclusions about individual performance.
Consider two questions. “What is this employee's planned utilisation over the next four weeks?” is a typical resource query. “Which employees are least efficient based on previous project performance?” is different. AI might combine historical project outcomes, missed deadlines and working hours to produce individual performance assessments.
Such assessments may fall within GDPR profiling rules. Depending on the intended purpose, high-risk classification under the EU AI Act may also be relevant. There is also a practical problem: high utilisation or repeated delays do not necessarily indicate an employee's performance. They may handle particularly complex work or regularly take over projects already in difficulty.
Data minimisation is the key measure. Assessing whether a department has sufficient capacity next quarter often does not require individual employee profiles. Aggregated capacity information may be sufficient.
Particularly sensitive information, such as health data, should be processed only where necessary and legally permitted.
Can Do example: Can Do models projects, resources, capacity and dependencies in a central simulation model. Specialist calculations can take place within the system. AI can analyse relevant results without automatically needing to process all underlying personal data.
A project manager can access five customer projects, but the connected AI technically has access to the whole portfolio. A question about the most critical projects could lead the AI to use confidential information the manager is not authorised to see.
This risk particularly affects agents connecting to several business systems. The core principle is that AI should access no more information and perform no broader actions than the user. The signed-in user's identity must be respected all the way to the original data source.
Two permission types must be distinguished:
Permission to read a status does not automatically justify moving milestones or changing budgets.
Can Do example: Can Do's AI operates in the context of the signed-in user. Its access to information and actions reflects that user's permissions in the project management system.
Existing roles and permissions must remain effective for AI queries and agent actions. This is an important selection criterion.
Generative AI can analyse large amounts of data and explain complex relationships. It does not automatically understand a project management system's specialist rules.
For example, an employee works 40 hours a week, has two days of leave, is assigned to several projects and also handles organisational duties.
An AI receiving only separate raw data points might calculate available project capacity incorrectly because it does not fully account for parallel projects, priorities or dependencies. The recommendation may sound convincing while being technically wrong.
This becomes especially critical if resources, dates or investment decisions are changed on that basis.
Separate specialist calculations from generative analysis. Dedicated project management systems calculate capacity, dependencies, effort and risks using defined rules. AI uses the results to explain relationships, identify patterns and present options.
The specialist system calculates; AI analyses and explains.
Can Do follows this approach with its central project and resource simulation model. AI can query the system's results for further analysis instead of reconstructing complex calculations from scattered raw data.
This reduces potential error sources, although interpretation still needs review.
AI reports that a strategically important project is likely to miss its delivery date. Management needs to know why: which bottlenecks were considered, which data was used and which rules informed the assessment?
Professional business use requires outputs that can be checked. Three levels matter:
Distinguish calculated information from an AI-generated hypothesis. If AI suggests a relationship between resource shortages and delays, test that hypothesis against available project data.
Can Do can use defined AI skills and reference information to specify which project management functions an analysis should use. Documenting these rules and workflows supports controlled AI use. Legal documentation requirements depend on the use case.
Even with suitable data protection and access controls, a central question remains: who defines the professional rules for assessing project information?
Organisations use different methods to assess status, risks and bottlenecks. General-purpose AI does not automatically know their rules. Controlled use should distinguish three kinds of knowledge:
The software vendor can provide system knowledge and general methods. The organisation needs to define its own rules and ownership for maintaining them. If criteria for critical projects change, the corresponding AI rules need updating too.
For CIOs and PMO leaders, this means governance cannot sit with IT alone. Business teams, data protection, information security and compliance need to work together.
The EU AI Act establishes a European regulatory framework for AI. Not every project management application is automatically high-risk. Analysing dates, identifying resource bottlenecks or explaining budget variances does not, by itself, place a system in a high-risk category.
The position may differ when AI evaluates employees or allocates tasks based on personal characteristics or individual behaviour. Annex III expressly addresses certain employment and workforce management applications.
A request to identify employees with a technical qualification who are available next month is initially a resource query. Using individual performance profiles to decide who should preferentially receive important projects may raise high-risk requirements. Classification depends on the specific intended purpose and legal criteria. Human approval at the end does not automatically rule out high-risk classification.
Before implementation, assess each use case's purpose, data processing, influence on decisions and regulatory requirements. Other obligations, particularly under the GDPR, remain relevant regardless of high-risk classification.
Before implementation, establish:
These criteria help CIOs, PMO leaders and compliance teams select software and assess existing AI applications.
For businesses with demanding data protection and compliance requirements, architecture matters as much as features.
General-purpose enterprise AI can combine and analyse information from different sources. It does not automatically know specialist calculation rules, project dependencies or organisational governance requirements. Dedicated project management systems can offer advantages when they connect specialist logic, access controls and AI analysis in a controlled way.
Can Do combines AI analysis with specialist project and resource management. Its central simulation model captures relationships between projects, resources, effort, timeframes and dependencies. AI can use the results for further analysis.
Calculated results can be supplied without transferring all underlying personal data to AI.
AI operates in the signed-in user's context and respects their access and action permissions.
Capacity, dependencies and project risks are calculated using the project management system's defined logic.
Defined AI skills and reference information can specify how particular analyses should be performed.
Company-specific rules and requirements can be incorporated into AI use.
These architectural principles support controlled use and can reduce significant compliance risks. They do not automatically establish GDPR or AI Act compliance. Organisations still need to assess their own use cases and processes.
AI can significantly improve project management and resource planning. It can analyse portfolios, reveal risks early and support complex decisions. To use these benefits reliably, organisations must consider data protection, access rights, specialist rules and governance from the outset.
The model is only part of the picture. Its available data and functions, and the ability to verify results, are equally important. Secure project management AI needs controlled access, dependable specialist systems and binding organisational rules.
Can Do combines AI analysis with a specialist project and resource management system's calculation logic, helping businesses use AI while reducing key compliance risks.
For practical examples, read AI in Project Management: 5 Practical Use Cases for Businesses.
The English whitepaper Artificial Intelligence in Project Management by Thomas Schlereth and Michael Fenske explains AI-supported planning, its practical applications and limitations, and its relationship with hybrid project management.
Download the English whitepaper (PDF)
The main risks are uncontrolled disclosure through shadow AI, data protection breaches, insufficient access controls, incorrect analysis, poor traceability, unclear responsibilities and possible AI Act violations. Applications processing sensitive project or employee data or influencing employment decisions need particular care.
Look for user-based permissions, data minimisation, traceable analysis and controlled interfaces. Specialist systems such as Can Do can offer advantages because project and resource calculations take place within the management system and AI can access the results. Suitability for specific compliance requirements needs individual assessment.
Using ChatGPT for confidential project information is neither universally prohibited nor automatically GDPR-compliant. The plan, contractual terms, processing arrangements, technical settings and intended purpose matter. Organisations need to assess the legal basis, processor arrangements, possible international transfers and security measures.
The AI Act can be relevant to project management applications. High-risk classification may apply to certain employee evaluation, performance monitoring or task allocation applications based on personal characteristics or individual behaviour. Analysing project dates or aggregated resource bottlenecks does not alone make a system high-risk.
It can be compliant where there is an appropriate legal basis for processing personal data and principles such as purpose limitation, data minimisation and transparency are respected. Aggregated capacity data often raises fewer data protection concerns than automated assessment of individual performance.
Provide centrally managed AI solutions approved for business use, supported by clear policies, technical access controls, training and rules for confidential project data. A controlled alternative is often more effective than a blanket ban.
General-purpose AI supports research, writing and information analysis. Specialist project management AI can also use the calculation logic of a project and resource management system. Capacity, dependencies and status can then be evaluated using defined calculations rather than reconstructed solely by a language model.
Separate specialist calculations from generative analysis. Dedicated systems should calculate capacity, dependencies and risks using defined rules. AI can then interpret and explain the results. Verifiable sources, testing and human review of important decisions are also necessary.
Can Do can support important compliance principles by respecting existing user permissions and using calculated results from the project and resource management system. This can reduce unnecessary data transfers and technical misinterpretation. It does not automatically establish full GDPR or AI Act compliance.
Start by identifying and classifying intended use cases. Assess data flows, legal bases, permissions, specialist decision logic and possible AI Act requirements. Then implement technical and organisational safeguards, testing, documented responsibilities and regular reviews.
Can Do's AI is designed as an integrated capability for analysis, assessment and management across portfolios, projects and resources.
Its focus includes:
This differs from using a generic assistant alongside the project management system.
Discover what AI-supported project and resource management could look like in your organisation.
A short initial conversation reviews your requirements and current situation to establish whether Can Do is a suitable fit. A personalised product demo then focuses on those requirements.
-2.png?width=30&name=Kein%20Titel%20(400%20%C3%97%20400%20px)-2.png){kind=small}
Ariane Becker : 06.11.2026
Discover how years of AI research and development at Can Do earned recognition through Germany’s R&D tax incentive ...
Ariane Becker : 06.11.2026
See how AI helps prioritise project risks, identify skill shortages and make reliable delivery commitments through ...
Editorial Team : 06.11.2026
Learn where Excel resource planning reaches its limits and how integrated capacity planning, simulation and AI help ...