Artificial Intelligence (AI) – Security, Data Protection and Compliance
Enalyzer is committed to the responsible and secure use of artificial intelligence (AI). AI is used both within the Enalyzer software platform and in connection with Enalyzer Consulting services.
Enalyzer’s approach to AI is based on data protection, information security, transparency, regulatory compliance and human oversight. AI-related processing is subject to Enalyzer’s data protection and information security framework, including its Data Processing Agreement (DPA), technical and organisational security measures, and applicable contractual safeguards.
AI in the Enalyzer Platform
AI providers and sub-processors
Enalyzer provides AI functionality in its platform through Microsoft Azure AI Foundry, within Microsoft’s Azure environment in the European Union (EU). The AI Features use OpenAI models sold and hosted by Microsoft. The specific model may vary depending on the feature and use case.
OpenAI does not receive customer data, prompts or AI-generated responses in connection with these AI Features and does not act as a separate sub-processor. No other external AI model providers are involved in this setup.
Microsoft Azure AI Foundry is listed in Enalyzer’s DPA under Optional Sub-Processors – Software. The processing location is stated as EU/EFTA, and the hosting platform is Microsoft Azure.
AI Features are optional. Organisation administrators can enable or disable all AI Features for their organisation. Individual users cannot override this setting; when the features are disabled, they are unavailable to all users in the organisation.
Current and future AI functionality
The current AI Features cover survey creation, questionnaire editing, user support and translation.
AI-based analysis of survey responses or other respondent data, including open-ended or free-text responses, is not included in the current AI Features.
Future AI Features may have a different scope and may process additional categories of customer data where relevant. This could include survey responses, free-text responses, reports or other survey and project-related data, potentially including personal data or special categories of personal data. For each feature, the information processed will be limited to what is relevant to the functionality requested.
Data protection and security
AI Features are subject to Enalyzer’s existing technical and organisational security measures and the security controls applicable to Microsoft’s enterprise Azure services. These include measures relating to:
- Confidentiality and access controls.
- Logical separation of customer data.
- Protection against unauthorised access.
- Monitoring and logging.
- Data processing and sub-processor governance.
Customer data, prompts and AI-generated outputs remain logically separated between Enalyzer customers. The security principles and controls used to protect customer data within the Enalyzer platform also apply when AI Features are used.
Use of data for AI model training
Customer data, prompts and AI-generated responses submitted to Enalyzer’s platform AI Features are not used to train or improve the underlying AI models.
Retention and AI quality
Enalyzer retains AI-related platform logs for 30 days. Microsoft Azure AI Foundry applies automated abuse monitoring to prompts and outputs to detect potentially harmful or abusive use. This automated monitoring does not store prompts or outputs for that purpose. If content is flagged, selected prompts and outputs may be retained and reviewed by specifically authorised Microsoft personnel. For EEA deployments, these personnel are located within the EEA.
Enalyzer uses evaluation and guardrails to help identify and mitigate bias, inaccuracies and harmful outputs. Responses may still be inaccurate and should be reviewed before use.
AI in Enalyzer Consulting
AI-assisted services and processing locations
Enalyzer may use Microsoft Foundry and OpenAI’s ChatGPT Enterprise to provide AI-assisted support across all phases of project delivery. This may include survey design and content development, survey setup and distribution, project management, analysis and interpretation, reporting, development of recommendations, quality assurance, and other related consulting activities.
Microsoft Foundry is configured within Microsoft’s EU Data Zone, which follows the Azure EU Data Boundary and covers the EU/EFTA geographic scope described above. ChatGPT Enterprise is configured within OpenAI’s Europe region, comprising the EEA and Switzerland. Although expressed differently, these geographic scopes cover the same countries: the EU Member States, Iceland, Liechtenstein, Norway, and Switzerland.
All such processing therefore takes place in countries where the GDPR applies or that are recognised by the European Commission as providing an adequate level of data protection under EU data protection law.
Data protection, minimisation and confidentiality
Enalyzer applies data-minimisation principles when using AI in consulting and analytical activities. Wherever possible, consultants use aggregated or appropriately anonymised data rather than individual respondent-level information. Only information reasonably necessary for the intended analytical purpose should be provided to AI systems.
Customer-related information may only be processed using AI services and environments approved by Enalyzer and in accordance with applicable data protection, information security and confidentiality requirements.
Human oversight and quality assurance
AI supports, but does not replace, the professional judgement of Enalyzer’s consultants. AI-generated findings are treated as analytical input rather than established facts. Consultants are responsible for reviewing and validating the accuracy, relevance and context of AI-generated findings before including them in customer-facing analyses, reports or recommendations.
AI Governance and Regulatory Compliance
EU Artificial Intelligence Act
Enalyzer continuously assesses its AI functionality and use of AI services in relation to the EU Artificial Intelligence Act (Regulation (EU) 2024/1689).
Based on the current functionality and intended purposes, Enalyzer’s preliminary assessment is that its AI functionality is unlikely to fall within the high-risk categories defined in Article 6 and Annex III of the AI Act. In particular, the functionality is not currently intended to make or materially determine employment-related decisions concerning individual employees, such as recruitment, promotion, termination, remuneration or individual performance.
This assessment is based on the intended purpose and functionality of the AI systems and may be reconsidered as they develop. Enalyzer also recognises that some AI Act obligations apply independently of high-risk classification and continues to assess applicable requirements.
Employee training and AI literacy
Enalyzer has implemented measures to support AI literacy among relevant employees, including employees who use AI in consulting and analytical activities. Employees receive information and guidance concerning:
- Appropriate and inappropriate uses of AI.
- The capabilities and limitations of AI-generated outputs.
- Responsible handling of customer information.
- Data minimisation and confidentiality.
- Potential inaccuracies and bias in AI-generated content.
- Human review and professional judgement.
Employees using AI are expected to follow Enalyzer’s applicable data protection, information security and confidentiality requirements.
Transparency, accountability and risk management
Enalyzer considers applicable AI Act transparency requirements on a case-by-case basis. Where relevant, it assesses whether users should be informed that they are interacting with an AI system or receiving AI-generated content. Enalyzer’s approach is to use AI to support appropriate human assessment and decision-making.
Enalyzer evaluates AI-related risks in connection with the intended purpose, functionality and processing activities of its AI systems. This includes consideration of:
- Data protection and confidentiality.
- Information security.
- Accuracy, bias and reliability of AI-generated outputs.
- Transparency and human oversight.
- Regulatory requirements and potential impacts on individuals.
Enalyzer uses relevant evaluation, monitoring and safety capabilities available through its AI providers to help identify and mitigate risks. New or materially changed AI use cases are assessed to determine whether additional safeguards or regulatory obligations apply.
Existing data protection and security framework
The introduction and use of AI does not replace or reduce Enalyzer’s existing data protection and information security obligations. AI-related processing is incorporated into Enalyzer’s established governance framework, including:
- The Data Processing Agreement.
- Technical and organisational security measures.
- Sub-processor management.
- Data location and international transfer requirements.
- Access controls and confidentiality obligations.
- Applicable contractual safeguards.
Enalyzer reviews its AI-related governance and compliance measures as its use of AI develops and as regulatory guidance and requirements evolve.
For additional information, please refer to Enalyzer’s Data Processing Agreement and other documentation available in the Trust Center.