Important Hosting Update (25/01/25)

We’re now able to offer assistants that keep your conversations within the EU 🇪🇺. If you’re located in the European Union, we encourage you to use the ISMS Copilot EU, and our specialized assistants for EU regulations (DORA, NIS2, EU AI ACT, Cyber Resilience Act, GDPR) based on your compliance needs. Conversations are hosted in France and deleted after 90 days.

If you’re fine with US hosting, know that ISMS Copilot Free or ISMS Copilot X are also knowledgeable on these regulations, even if less specialized. This information supersedes any other information about EU hosting.

For more details, please visit our FAQ for EU users.

ISMS Copilot EU Documentation

While we recommend anonymizing content before sharing, using ISMS Copilot EU means:

Your data is not used to train our models (none of our models)

Your data stays within the EU (your data is stored in France)

Your data is automatically deleted after 90 days

About This AI System

This is an advanced AI chatbot designed to support information security and compliance workflows while ensuring full compliance with EU data residency requirements. It is suitable for organizations prioritizing EU-specific privacy protections. In accordance with EU AI Act transparency requirements, we inform you that you are interacting with an artificial intelligence system.

Classification Under EU AI Act

Risk Classification

ISMS Copilot EU is classified as a limited risk AI system (chatbot) based on:

• Intended Purpose: Provides general guidance for information security and compliance workflows, with data hosted exclusively in the EU.
• Functionality: Offers tailored support for ISO 27001, GDPR, SOC 2, and other security frameworks.
• Risk Level: Classified as a limited risk chatbot, focusing on providing advisory services without critical impacts on fundamental rights. It doesn’t provide legal advice either.
• Decision Making: Supports but does not replace human decision-making in security and compliance processes.
• Data Processing: Operates with data minimization and strict 30-day retention policies in compliance with EU regulations.

Rationale for Classification

The system does not qualify as high-risk under Article 6 and Annex III because:

• It does not operate in sectors like health, law enforcement, or critical infrastructure.