> Markdown version of [/events/world-congress-2026-europe/sessions/1393-your-enterprise-rag](https://www.wearedevelopers.com/events/world-congress-2026-europe/sessions/1393-your-enterprise-rag). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Your Enterprise RAG Has No Legal Basis


- **Date:** Friday, Jul 10, 2026
- **Time:** 16:20–16:50 (30 min)
- **Room:** Stage 10 - powered by TikTok
- **Event:** World Congress 2026 Europe

## Recording

[Watch recording](https://www.wearedevelopers.com/videos/100344-your-enterprise-rag-has-no-legal-basis)

## Description

Your RAG system works beautifully. Under GDPR, it has no legal basis to exist.

Clean architecture. Proper embeddings. Maybe even agentic tool calling. You followed best practices. But when the auditor asks "what's the legal basis for this processing?" there's no answer. General-purpose "ask anything" chatbots have no defined purpose. Without a defined purpose, no legal basis can exist under GDPR. The architecture itself is the violation.

In this talk, I'll live-code a "best practices" enterprise knowledge bot, then ask the questions nobody asks: Where is purpose limitation enforced? Where is legal basis documented? I'll show why anonymization doesn't save you. 97% accuracy isn't "anonymous" under GDPR. It's still PII.

Then I'll show you the fix: a purpose-scoped bot architecture where legal basis is a first-class configuration item. Each bot gets a defined purpose, scoped data access, configured tools, and documented legal basis. The architecture enforces the boundaries. The retrieval layer can only access documents within that bot's scope. Non-compliance becomes architecturally impossible.

The good news? You didn't waste your investment. This is a 50k governance layer, not a rewrite.

Takeaways:
  - Why your RAG has no legal basis and how to fix it
  - The purpose-scoped bot pattern: document, enforce, and audit compliance by design
  - A brownfield rescue roadmap for existing systems


## Speakers

### [David Klemme](https://www.wearedevelopers.com/@david-klemme)

Co-founder and CTO of Komplyzen
### [Tilman Mürle](https://www.wearedevelopers.com/@tilman-murle)

Managing Director and Co-founder of Komplyzen


## Related talks at this congress

- [The day the chatbot asked for sudo](https://www.wearedevelopers.com/events/world-congress-2026-europe/sessions/1027-the-day-the-chatbot) — Alex Olivier
- [Testing AI Agents: Automated Evaluation for Chatbots & RAG Systems](https://www.wearedevelopers.com/events/world-congress-2026-europe/sessions/1341-testing-ai-agents) — Sebastian Messingfeld
- [Building Sovereign AI: Lessons from Deploying Secure RAG Systems using Confidential Computing](https://www.wearedevelopers.com/events/world-congress-2026-europe/sessions/1109-building-sovereign) — Isha Salania
- [POC Prison: Why agentic systems never escape the lab and how to fix that in 90 days](https://www.wearedevelopers.com/events/world-congress-2026-europe/sessions/1325-poc-prison-why) — Luise Freese