Legal

AI Addendum

What applies when a company turns Atitic's AI features on.

Effective: 2026-10-31 · Version 1.0

This is the current published master. Customers see this document rendered with their own legal identity substituted in the placeholders below.

AI Addendum

Version: 1.0

Draft pending legal review. The English text is the authoritative version; translations are provided for convenience.

1. Parties and scope

This AI Addendum is entered into between Atitic, MB ("Atitic") and [Your organisation] (the "Customer"). It supplements the Terms of Service and the Data Processing Addendum between the parties and applies only while AI features are turned on for the Customer's workspace. Where it conflicts with the Data Processing Addendum on a data-protection matter, the Data Processing Addendum prevails.

2. The AI features

  • Ask Atitic: answers questions from a summary of the workspace.
  • AI drafts: proposes the text of policies, continuity plan sections and custom frameworks.
  • AI ingest and proposals: indexes documents from the storage connections the Customer sets up and proposes evidence and policies from them.

Everything an AI feature produces is a proposal. A person in the Customer's organisation must accept, edit or reject it before it changes the Customer's records.

3. What is sent, and to whom

When an AI feature is used, Atitic sends the AI model provider named in Annex I of the Data Processing Addendum the request and the parts of the Customer's data that request needs:

  • for Ask Atitic, a summary of the kinds of records the Customer allows under Administration, Tenant settings (counts, titles, statuses and dates); it never includes DPIA answers, special categories of personal data or file contents;
  • for AI drafts, the record being drafted and the requirements linked to it;
  • for AI ingest, the text of documents in the folders the Customer selected.

The provider processes this content on its own infrastructure, which may be located outside the EU/EEA, including in the United States. Such transfers rely on [the European Commission's Standard Contractual Clauses and, where the recipient is certified, the EU-US Data Privacy Framework].

4. No training, limited retention

Atitic does not use Customer Data to train AI models, and its contract with the provider does not allow the provider to train on it. The provider keeps the content only as long as it needs to serve the request [and for any abuse monitoring its terms require].

5. The Customer's controls

The Customer may at any time, under Administration, Tenant settings:

  • turn AI features off: from then on nothing is sent to the provider;
  • choose which kinds of records Ask Atitic may draw on;

and decide who may use each AI feature through roles. AI ingest only reads the folders the Customer selects, and the Customer may remove a connection and its index at any time.

6. Turning AI features off

Turning AI features off stops all further sending. Proposals and drafts already made remain Customer Data in the workspace until the Customer deletes them.

7. Accuracy

AI output may be incomplete or wrong and is not legal advice. The Customer remains responsible for what it accepts.

8. Acceptance

An Authorised User accepts this AI Addendum on the Customer's behalf by turning AI features on. Atitic records who accepted, when and which version.