Terms of Service

1. Service Description

AI Attest (“the Service”) is a multi-regulation EU compliance platform provided at aiattest.io. The Service helps organizations assess, build, and document compliance with the EU AI Act (Regulation (EU) 2024/1689), GDPR Data Protection Impact Assessments (Regulation (EU) 2016/679, Article 35), and the EU Cyber Resilience Act (Regulation (EU) 2024/2847).

2. Not Legal Advice

The Service is a compliance assistance tool. It does not provide legal advice.

Gap reports, coverage assessments, readiness scores, remediation recommendations, and compliance reports generated by the Service are informational outputs intended to assist your compliance efforts. They are not legal opinions, regulatory certifications, or guarantees of compliance with any regulation.

You should engage qualified legal counsel to review all compliance decisions, regulatory submissions, and compliance reports before relying on them. AI Attest does not act as your legal advisor, compliance officer, or Data Protection Officer.

3. AI-Generated Content

The Service uses AI models (large language models provided by Anthropic, OpenAI, and Google) in its Audit Mode to classify documents and assess field-level coverage. These AI-generated outputs may contain errors, misclassifications, or omissions.

See our AI Transparency Disclosure for full details on which features use AI and which are deterministic. Build Mode outputs (compliance reports, audit trails, cascade analysis) are produced by deterministic algorithms and are not AI-generated.

4. Your Data

You retain ownership of all documents you upload and all content you create in the Service. AI Attest does not claim any intellectual property rights over your content.

When you run an audit, your uploaded documents are sent to the AI model provider you have selected (Anthropic, OpenAI, or Google) for processing. You supply your own API key for this purpose. AI Attest does not store or broker API keys beyond encrypted storage for your convenience.

All AI model providers are contractually bound by their respective API terms of service, which prohibit training on API inputs. AI Attest does not use your data for model training or any purpose other than providing and improving the Service.

AI Attest records usage analytics (such as audit events, regulation selections, and readiness scores) and in-app feedback to improve the product. This data is linked to your account and is not shared with third parties. See our Privacy Policy for full details.

5. Data Retention

Project data is retained according to regulation-specific retention policies:

• EU AI Act projects: 10 years (per Article 18)
• GDPR DPIA projects: duration of processing + 3 years
• CRA projects: 10 years (per Article 23)

Projects under retention cannot be deleted. Projects under legal hold cannot be deleted regardless of retention period. You may request data export at any time.

6. Accuracy and Regulatory Mapping

AI Attest maps regulatory requirements to compliance artifact templates based on our interpretation of the applicable regulations. These mappings represent our best understanding and are provided in good faith, but they have not been validated by a regulatory authority or notified body.

Regulatory interpretations may change as enforcement guidance, harmonised standards, implementing acts, and case law develop. AI Attest updates its regulatory mappings periodically but cannot guarantee they reflect the most current interpretation at any given time.

7. Limitation of Liability

To the maximum extent permitted by applicable law:

AI Attest shall not be liable for any regulatory penalties, fines, enforcement actions, or compliance failures arising from your use of the Service, including but not limited to reliance on AI-generated gap reports, coverage assessments, or compliance reports.

AI Attest provides tools and information. Compliance decisions are yours. The responsibility for regulatory compliance rests with the provider or deployer of the AI system, product, or processing activity being assessed — not with AI Attest.

In no event shall AI Attest's total liability exceed the amounts paid by you for the Service in the twelve (12) months preceding the claim.

8. Cryptographic Audit Trail

The Service produces a cryptographic audit trail (SHA-256 content hashing, Ed25519 digital signatures, RFC 3161 trusted timestamps) for Build Mode projects. This audit trail is designed to provide tamper-evident records of compliance activities.

The audit trail is a technical record, not a legal certification. Its evidentiary value in any regulatory or legal proceeding depends on the applicable jurisdiction and the discretion of the reviewing authority.

9. Beta Period

During the beta period, the Service is provided free of charge. The Service is provided “as is” and “as available” without warranties of any kind, whether express or implied, including but not limited to implied warranties of merchantability, fitness for a particular purpose, and non-infringement. Features, APIs, and data formats may change during beta without prior notice.

10. Acceptable Use

You agree not to use the Service to generate fraudulent compliance documentation, misrepresent your compliance status to regulators, or upload documents containing illegal content. Accounts engaging in such activities will be terminated.

11. Account Termination

You may request account deletion at any time. Project data under retention or legal hold will be preserved as required by the applicable retention policy. All other data will be deleted within 30 days of the request.

12. Governing Law

These Terms are governed by and construed in accordance with the laws of the European Union and the applicable national law of the jurisdiction where AI Attest is established. Any disputes shall be subject to the exclusive jurisdiction of the competent courts of that jurisdiction.

13. Changes to These Terms

We may update these Terms from time to time. Material changes will be communicated via the email address associated with your account at least 30 days before taking effect. Continued use of the Service after changes take effect constitutes acceptance.

14. Contact

AI Attest — aiattest.io