Important Hosting Update (25/01/25)

We’re now able to offer assistants that keep your conversations within the EU 🇪🇺. If you’re located in the European Union, we encourage you to use the ISMS Copilot EU, and our specialized assistants for EU regulations (DORA, NIS2, EU AI ACT, Cyber Resilience Act, GDPR) based on your compliance needs. Conversations are hosted in France and deleted after 90 days.

If you’re fine with US hosting, know that ISMS Copilot Free or ISMS Copilot X are also knowledgeable on these regulations, even if less specialized. This information supersedes any other information about EU hosting.

For more details, please visit our FAQ for EU users.

GDPR Copilot Documentation

About This AI System

The GDPR Copilot is an AI-powered chatbot that helps organizations navigate the General Data Protection Regulation (GDPR). It delivers actionable insights for managing data privacy and protection requirements, ensuring compliance with one of the world's strictest privacy laws. As required by the EU AI Act, we inform you that you are interacting with an artificial intelligence system.

Classification Under EU AI Act

Risk Classification

GDPR Copilot is classified as a limited risk AI system (chatbot) based on:

• Intended Purpose: Provides guidance for GDPR compliance, focusing on privacy, data protection, and breach management.
• Functionality: Offers tailored support for data processing, consent management, and compliance reporting.
• Risk Level: As a limited risk chatbot, it supports compliance efforts without affecting fundamental rights.
• Decision Making: Provides advisory support while users maintain control of compliance decisions.
• Data Processing: All conversation data is stored exclusively in the EU, meeting GDPR data residency requirements.

Rationale for Classification

The system does not qualify as high-risk under Article 6 and Annex III because:

• It does not make decisions that directly affect fundamental rights.
• Human oversight is integral to all compliance activities.
• Data residency in the EU minimizes privacy and security risks.
• Its purpose is advisory, providing general guidance on GDPR compliance.