EU AI Act Compliance Notice

Company Identification:
This Annex forms part of the Data Processing Agreement between Tanqory Inc. and the Customer and applies to AI systems provided to, or used in connection with, the European Union/EEA and the United Kingdom. It is designed to align with the EU AI Act alongside GDPR/DPA 2018/PECR for data processing.

This notice sets out how Tanqory implements the EU Artificial Intelligence Act (“EU AI Act”) and related data-protection requirements. It emphasizes safety, transparency, human oversight, and accountability for Tanqory-developed systems and third-party AI components we integrate. Where we provide services from outside the EU/EEA, we will appoint an authorised representative under Article 25 (akin to GDPR Article 27) and disclose representative contact details in the DPA/contact page.

Scope and roles

This notice covers AI systems that Tanqory develops, deploys, or integrates for customers in the EU/EEA and UK, including internal modules (fraud/risk scoring, recommendations) and third-party model integrations. Tanqory acts as provider for business customers and as deployer when using AI toward end users. Customers using our APIs/SDKs are deployers/controllers of their own data. Roles are recorded in contracts, and responsibilities under GDPR and the AI Act are separated. An internal AI registry tracks systems offered in the EU/EEA.

Risk classification

We classify systems under the EU AI Act categories: prohibited, high-risk, limited-risk, and minimal-risk. Prohibited use cases (e.g., unlawful social scoring) are disallowed. High-risk systems (e.g., biometric identification, credit/job screening) follow Title III obligations. Limited-risk systems provide transparency/opt-out where required. Minimal-risk systems apply privacy/security-by-design. Classifications are reviewed when data, models, or purposes change, with rationale logged in the AI registry.

Risk management, data sets (Art. 9/10), and technical documentation (Art. 11/18)

High-risk systems follow a risk-management cycle (identify, analyse, mitigate, reassess) aligned with Art. 9 and ISO/IEC 31000 and 23894. Training/validation/test data are checked for quality, representativeness, completeness, and bias mitigation per Art. 10. Synthetic data is used where appropriate; personal data is minimized. Sources, preprocessing, tests, and outcomes are recorded in technical documentation and traceability logs per Art. 11/18 for auditability.

Data, model training, and legal bases

Training/validation/inference data derive from transactions, product usage, and synthetic/anonymized sources. GDPR legal bases are applied appropriately: contract, legal obligation, legitimate interests (with LIAs), consent for sensitive data/marketing, and vital interests. DPIA/AI impact assessments are performed for higher-risk cases, addressing source quality, bias, rights, access/erasure of training data/logs where legally feasible, and exclusion of prohibited data. RoPA/DPIA records and supplier/model contracts document purpose limitation.

AI governance and record-keeping

An AI governance program defines roles (DPO, AI lead, Security lead), policies for design/test/launch/retire, and maintains the AI registry, risk/test records, and technical documentation. Change management logs model/parameter updates and impacts. Approval gates precede deployment; periodic reviews follow. Intake channels for complaints/bug reports have defined SLAs. Staff training covers EU AI Act/GDPR.

Framework alignment, not certification: Our AI management system is designed in accordance with the principles of ISO/IEC 42001, ISO/IEC 27001, and the AICPA SOC 2 Trust Services Criteria. Tanqory is not currently certified against these frameworks; references to "alignment" describe internal control design, not third-party attestations. Our certification roadmap (SOC 2 Type 1 → ISO 27001 → ISO 42001) is published at https://trust.tanqory.com.

Fundamental rights and impact assessments

For use cases that could materially affect individuals, we conduct fundamental rights impact assessments (FRIA) alongside DPIAs, covering intended purpose, stakeholder groups, potential discrimination or exclusion, safeguards, and residual risk. Outcomes feed into risk treatment, human-oversight design, and user disclosures. Where deployers (customers) must conduct their own FRIA/DPIA, we provide relevant model documentation, data sheets, and usage constraints to support compliance.

Quality management system and documentation retention

High-risk systems operate under a quality management system aligned with Art. 17 and relevant harmonized standards, covering roles, procedures, testing, incident handling, and supplier management. Technical documentation, conformity evidence, instructions of use, and post-market monitoring reports are retained for at least the minimum periods required by the AI Act (typically 10 years after placement on the market) unless longer retention is mandated by law. We maintain vulnerability intake channels and publish security reporting guidance to support coordinated disclosure.

Provider obligations (Title III) and post-market monitoring

High-risk systems maintain technical documentation, instructions of use, traceability, and CE marking. Conformity assessments (self/third-party per Annex) are completed and registered in the EU database for high-risk systems. A post-market monitoring plan tracks performance and anomalies. Serious incidents are reported to regulators without delay in the prescribed format; corrective actions/recall are executed when needed. Update/rollback plans and customer communications are prepared for safety or compliance issues. Testing/inspection records are retained per Art. 64.

Transparency and user rights

We inform users when AI is used in impactful functions, provide high-level explanations (main factors, limitations), and state opt-outs for marketing/profiling and rights to human review where legally required. We disclose data used and retention periods and provide contact channels (privacy@tanqory.com / dpo@tanqory.com). Requests are logged and answered under EU/UK data protection timelines with reference to EDPB/ICO guidance. Plain-language FAQs and detailed enterprise documentation are available for explanation needs.

Specific transparency (Art. 52: chatbot/deepfake/generative AI)

We clearly signal chatbot interactions, label AI-generated content, and provide markings/provenance for synthetic/deepfake media using watermarking/metadata where appropriate. Users can opt out of non-essential AI-mediated communications.

Human oversight and automated decision-making

Higher-impact systems include human-in/on-the-loop controls calibrated to risk. Escalation paths exist for uncertain or abnormal outputs. Human review is applied to decisions with legal or similar significant effects (e.g., account suspension, transaction denial, order blocking). Users may request explanations/appeals. Reviewers are trained on bias and model limits; decision logs are kept. Social scoring and unlawful surveillance are prohibited. ADM workflows are reviewed at least annually or upon model changes.

Safety, accuracy, robustness, and testing

Models are validated pre-deployment and periodically thereafter for accuracy, robustness, and bias. Monitoring/logging detect drift or anomalies; patch/rollback plans exist. Security controls include encryption, RBAC/MFA, segregation of duties, secure SDLC, and continuous monitoring (centralized logging + alerting). Engineering on-call coverage operates around the clock; a dedicated 24x7 SOC service is on our compliance roadmap and is not yet in production. Playbooks cover model poisoning/data leakage; exercises are conducted. Third-party libraries/models are assessed, and vulnerability advisories are tracked. Test results and remediations are recorded for audit.

Third-party providers and models

Due diligence covers legal, security, and ethical factors for external AI providers. Contracts define roles, responsibilities, data protection, and audit rights. Categories of providers (hosting, payments, analytics, security, language models) are disclosed and subprocessors listed at https://legal.tanqory.com/legal/data-protection/subprocessor-list. Necessary input/output logs are kept with data minimization. Performance and risk are measured pre- and post-integration, and exit plans allow rapid cessation when needed.

General-purpose and foundation models

Where we use general-purpose or foundation models, we assess model documentation, known limitations, and provider assurances on training data provenance, safety, and copyright safeguards. We layer domain constraints, guardrails, filters, and human oversight appropriate to context, and prohibit use cases that would elevate risk to prohibited or high-risk categories without the required controls. We monitor updates from model providers and adjust usage or suspend integrations if safety or compliance issues emerge.

Cross-border data transfers and data location

Data transfers outside the EU/EEA use lawful mechanisms (adequacy, SCCs, derogations) and, where relevant, the UK Addendum/IDTA. We disclose destinations, recipients, purposes, retention, rights to object/withdraw, and potential impacts. Technical/organizational measures include encryption, access controls, and logging. Transfer risk assessments and justifications are recorded; adequacy changes prompt contract updates. Principal destinations (EU/UK/US/Singapore) are communicated for transparency. Data scoping is tightened when relying on derogations, and EU/UK-aligned hosting options are offered where feasible.

Incident management and notifications

If AI systems or related data are accessed, altered, or disclosed without authorization, we notify customers within 24 hours and relevant supervisory authorities within 72 hours where criteria are met, and notify data subjects without undue delay when high risk exists. Notices include incident details, affected data/systems, impacts, remediation, and risk-reduction guidance. Containment and mitigation occur immediately; post-incident reviews and decision records (notify/not notify) are retained. “Serious incident” follows AI Act definitions (malfunction causing legal breach or risk to life/health/fundamental rights). Prescribed reporting templates are used.

Updates, audits, and training

AI compliance is reviewed at least annually or upon legal/service changes. Internal audits, pen tests, and third-party assessments are conducted proportionate to risk. Training (engineering, product, legal, operations) covers AI governance, data protection, security, and bias mitigation. Record-of-change and public changelog are maintained; material changes are pre-announced via dashboard/email. Guidance from the EU AI Office/Board, EDPB, and ICO is tracked. Complaint/dispute channels are available for AI issues, and Tanqory cooperates with regulators during inquiries.

Contact

• Privacy email: privacy@tanqory.com
• Data Protection Officer: dpo@tanqory.com
• Policy site: https://legal.tanqory.com/

Change history