AI & Data Governance Statement

How AI is used in Audomate, which models run where, and the controls that keep outputs grounded and client data protected.

1. Model inventory

2. Grounding — how outputs stay factual

The engine is retrieval-augmented generation: documents are chunked (512 tokens, 64 overlap) and embedded; for every checklist requirement it retrieves the most relevant fragments (top 5–10, with cross-encoder reranking, filtered by tenant), and the model answers only against retrieved context — returning a verdict (COMPLIANT / PARTIAL / NON-COMPLIANT), a justification, cited source fragments and a confidence score.

3. Human in the loop — mandatory

No AI verdict is final without human approval. A compliance officer reviews, edits or overrides every proposal; every change is recorded with author, timestamp and reason in a hash-chained audit trail. AI outputs are decision support, not decisions.

4. Data protection in the AI layer

• Prompts and completions are transient at the model provider (OpenAI Ireland Ltd, EU data residency) — Zero Data Retention approved on the project; never used for training, by DeepTech or the provider. No other cloud AI provider is used.
• Per-tenant session isolation; session context in memory only, cleared at session end.
• Prompt-injection detection and input sanitisation before any model call.
• Per-tenant token budgets with utilisation alerts.

5. No training on customer data — contractual and technical

Contractual. Our agreement with the model provider — the OpenAI API Services Agreement with the OpenAI Data Processing Addendum (OpenAI Ireland Ltd) — excludes the use of prompts and completions for training or improving models and provides Zero Data Retention. OpenAI abuse monitoring would by default keep API request logs for up to 30 days; ZDR has been approved on our project, so no prompts or completions are stored, and the project is pinned to EU data residency. OpenAI, L.L.C. (parent of OpenAI Ireland Ltd) is certified under the EU-U.S. Data Privacy Framework for residual support / telemetry access. Our Data Processing Agreement with each client commits DeepTech not to use client content for training or product development beyond the client's own tenant.

Technical. There is no training or fine-tuning pipeline on client content in the platform: documents are used only for retrieval within the client's tenant; prompts and completions are not written to durable storage; vector indexes are isolated per tenant and deleted with the client's data. Where a plan includes customer-specific configuration or tuning (e.g. checklists and prompts adapted to the client's documentation), it is performed solely for that client, on its instruction, within its tenant, and is never applied to other clients or passed to the model provider.

6. Data protection impact assessment

Because the contract-audit module systematically processes documents that may contain personal data of third parties (signatories, contact persons, representatives of ICT vendors) using AI, DeepTech carries out a data protection impact assessment (art. 35 GDPR) for this module, following the ICO seven-step template, coordinated by the Data Protection Coordinator (Kacper Raubo, kacper.raubo@deeptech.pl), and reviews it when the processing or the models change. The assessment for the current version of the module was prepared in October 2026 and is undergoing sign-off by the CTO, the CEO and the Data Protection Coordinator. A summary is available to clients on request to support their own DPIA as controllers.

7. Regulatory monitoring

A separate engine subscribes to ESMA, EBA and KNF publication feeds, delta-diffs regulatory changes against active checklists, and places changes in pending-review status — a compliance manager approves before anything goes live.

8. EU AI Act position

Based on our assessment, Audomate is not a high-risk AI system within the meaning of Annex III of the EU AI Act: it is a decision-support tool for corporate regulatory compliance — a use case not listed in Annex III — and, by design, no AI-generated verdict is final without human approval, consistent with the human-oversight principles of art. 14. We operate as a deployer of general-purpose AI models with transparency toward users about AI involvement, and we monitor Commission and ESA guidance; this position will be updated if the legal landscape changes.

Document control